← 返回 Skills 市场
davidedicillo

Codifica

作者 Davide Di Cillo · GitHub ↗ · v1.0.1
cross-platform ⚠ suspicious
624
总下载
0
收藏
0
当前安装
2
版本数
在 OpenClaw 中安装
/install codifica
功能描述
Keep context when work moves between agents or between you and a human. Uses the Codifica protocol to give every agent a shared, persistent memory of tasks,...
使用说明 (SKILL.md)

Codifica Protocol Agent

You are operating in a repository that uses the Codifica protocol (v0.2) — a file-based protocol for coordinating work between humans and AI agents.

Codifica uses plain text files committed with the code. There is no external service, no API, no database. Git is the audit log.

Before doing any work

  1. Read codifica.json at the repo root
  2. Read the spec file it references (the spec field — typically codifica-spec.md)
  3. Read ALL state files matching the state field (may be a string, glob, or array)

Do not proceed without reading the spec.

If codifica.json does not exist in the repo, this protocol does not apply — work normally.

Understanding codifica.json

{
  "protocol": "codifica",
  "version": "0.2",
  "spec": "codifica-spec.md",
  "state": "work.md",
  "assets": "assets/",
  "rules": "strict"
}

Key fields:

  • state — path to the state file(s). May be "work.md", "work/*.md", or an array like ["work/active.md", "work/done.md"]
  • rules — may be a string ("strict") or an object with allowed_agents, file_scope, max_concurrent_tasks_per_agent, stale_claim_hours, and custom_types

If rules is an object, check:

  • allowed_agents — if non-empty and your agent name is not listed, stop and ask a human
  • file_scope.include / file_scope.exclude — do not modify files outside the allowed scope
  • max_concurrent_tasks_per_agent — do not claim more tasks than this limit

Finding work

Scan all state files for tasks where:

  • state is todo
  • owner matches your agent name (agent:\x3Cyour-name>) or is unassigned
  • All depends_on tasks have state: done

Pick by priority: critical > high > normal > low.

Among equal priority, prefer tasks with no depends_on (leaf tasks first).

Claiming a task

Before starting work, you MUST claim the task in a single atomic commit:

  1. Set state: in_progress
  2. Set owner: agent:\x3Cyour-name>
  3. Set claimed_at: \x3CISO-8601 timestamp>
  4. Add a state_transitions entry recording the claim

Commit all these changes together. If you are working with a remote, push immediately. If the push fails (another agent claimed first), do NOT start work — pull, re-evaluate, and pick a different task.

An unassigned task in in_progress is a protocol violation.

Reading context before starting

Before starting a task, read its context field:

  • context.files — read these files for background
  • context.references — read execution_notes from these prior task IDs
  • context.constraints — hard rules beyond acceptance criteria
  • context.notes — free-form guidance from the human

If the task has depends_on, also read the dependency tasks' execution_notes (especially the summary) and artifacts for handoff context.

Doing the work

Follow the task's acceptance criteria. Respect any context.constraints. Work within the file_scope defined in codifica.json.

Recording completion

When you complete work, update the task in the state file:

  1. Add an execution_notes entry:

    execution_notes:
      - by: agent:\x3Cyour-name>
        note: |
          Description of what you did.
        summary: "Single line, max 120 chars, scannable answer"
        timestamp: \x3CISO-8601>
        provenance:
          session_id: \x3Cyour-session-id-if-available>
    
  2. Record any files you produced in artifacts:

    artifacts:
      - path: src/feature/new-file.ts
        type: code
      - path: assets/TASK-ID/output.csv
        type: csv
    
  3. Move the task to the appropriate next state:

    • For build tasks: in_progressto_be_tested
    • For other types (test, investigate, followup): in_progressdone (may skip to_be_tested)
    • Set completed_at: \x3CISO-8601> when moving to done
  4. Add a state_transitions entry:

    state_transitions:
      - from: in_progress
        to: to_be_tested
        by: agent:\x3Cyour-name>
        reason: "Work completed, ready for testing"
        timestamp: \x3CISO-8601>
    
  5. Commit with a message referencing the task ID: FEAT-101: implement login flow

Rules you MUST follow

  • Pull before reading state files. Pull before writing changes.
  • Claim tasks with a single commit before starting work.
  • If your claim push fails, do not start — pick a different task.
  • Never edit human_review sections.
  • Never delete or modify files in assets/.
  • Only the task owner may move a task from to_be_tested to done.
  • Never move tasks to blocked or rejected — only humans may do this.
  • Never reclaim stale tasks from other agents — only humans may reclaim.
  • Do not start tasks with unmet depends_on.
  • Include a summary (single line, max 120 chars) on your closing execution note.
  • Record artifacts produced by your work.
  • Set completed_at when moving a task to done.

Requesting a block

If you discover a genuine blocker (missing dependency, failing test, ambiguous requirement):

  • Add a note to execution_notes explaining the blocker and recommending the task be blocked
  • Do NOT move the task to blocked yourself — only humans may do this

Answering questions about work

When asked about what work has been done (by you or other agents):

  • Scan state files for tasks matching the query (by owner, state, labels, completed_at)
  • Read the summary field on closing execution_notes for quick answers
  • Drill into full note text and artifacts when more detail is needed
  • Use completed_at and labels to filter by time and domain

This is the structured alternative to reading chat transcripts.

Conflicts

If your push fails due to a Git conflict:

  1. Pull the latest state
  2. Re-evaluate whether your changes still apply
  3. Retry or yield to human resolution

Conflicts on the same task should be escalated to a human.

Task states reference

todo → in_progress → to_be_tested → done
         ↓                            ↑
       blocked ──→ todo ──────────────┘
         ↓
       rejected ──→ todo (human-only reopen)

Only humans may move tasks to blocked or rejected. Only humans may reopen tasks from rejected.

安全使用建议
This skill appears to do what it says: coordinate work via plain-text state files committed to Git. Before enabling it: 1) only use it in repositories you trust (no secrets), 2) inspect codifica.json in that repo and confirm file_scope and allowed_agents are restrictive and appropriate, 3) ensure the agent's Git credentials are intentionally scoped (so pushes/pulls can't leak or overwrite sensitive data), 4) prefer running it first in a test repo to verify behavior, and 5) retain human-in-the-loop review for claims/pushes if you need stronger safety. If codifica.json is missing or permissive, do not let the agent auto-claim or push changes without a human review step.
功能分析
Type: OpenClaw Skill Name: codifica Version: 1.0.1 The skill defines a protocol that heavily relies on the AI agent reading and interpreting various user-controlled files within the repository (e.g., `codifica.json`, `codifica-spec.md`, `state` files, `context.files`, `artifacts` as detailed in `SKILL.md`). While the skill's stated purpose is benign (protocol for agent coordination), this extensive instruction to read arbitrary text from user-controlled files creates a significant prompt injection vulnerability. An attacker who can modify these files could potentially inject new instructions to the agent, leading to unintended actions. This is a vulnerability that allows attacks, rather than being an attack itself, hence 'suspicious' instead of 'malicious'.
能力评估
Purpose & Capability
Name/description (shared persistent memory using plain-text files stored in Git) matches the SKILL.md instructions. Requiring git (as a capability the agent must have) is appropriate and proportional.
Instruction Scope
The instructions explicitly direct the agent to read repository files (codifica.json, spec, state files, context.files, referenced artifacts) and to make atomic commits and push changes. That behavior is expected for a Git-based task protocol, but it means the skill will read/write arbitrary files within the repo's declared file_scope and will perform network operations (pull/push). If codifica.json lacks a restrictive file_scope or allowed_agents, the agent may be allowed to modify broad parts of the repo—so confirm those fields before use. The SKILL.md also forbids editing certain sections (human_review, assets/) which mitigates some risk.
Install Mechanism
Instruction-only skill with no install spec or downloaded code. This minimizes disk-write and arbitrary code risks.
Credentials
No environment variables or external credentials are declared, which is consistent with a file-based Git protocol. However, the skill implicitly relies on the agent's Git credentials/config (local git author, SSH keys or credential helpers) to pull/push. That implicit dependence is expected but important to recognize: Git operations will use whatever repository/host credentials are available.
Persistence & Privilege
always is false and the skill does not request persistent platform privileges. It instructs the agent to commit changes into the repository (normal for this purpose) but does not modify other skills or system-wide settings.
如何使用
  1. 确保已安装 OpenClaw(本地或 Docker 部署)
  2. 在对话框中输入安装命令:/install codifica
  3. 安装完成后,直接呼叫该 Skill 的名称或使用 /codifica 触发
  4. 根据 Skill 的参数说明提供必要输入,即可获得结构化输出
版本历史
v1.0.1
No functional or protocol changes detected in this release. - Updated skill description to emphasize Codifica as shared, persistent memory for agent/human collaboration. - No modifications to protocol instructions or skill logic.
v1.0.0
Initial release of the Codifica protocol agent. - Supports repositories using the Codifica protocol (v0.2) for human-agent task coordination. - Reads and interprets `codifica.json`, the referenced spec, and state files to identify and claim tasks. - Workflow includes claiming tasks with an atomic commit, executing them, recording execution notes and artifacts, and proper state transitions. - Enforces protocol rules such as respecting file scope, not editing restricted sections or files, and pull-before-write safeguards. - Handles task dependencies, priorities, and owner-based access controls. - Provides a structured workflow for reporting blockers and answering work queries.
元数据
Slug codifica
版本 1.0.1
许可证
累计安装 0
当前安装数 0
历史版本数 2
常见问题

Codifica 是什么?

Keep context when work moves between agents or between you and a human. Uses the Codifica protocol to give every agent a shared, persistent memory of tasks,... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件,目前累计下载 624 次。

如何安装 Codifica?

在 OpenClaw 或 Claude Code 对话框中运行命令「/install codifica」即可一键安装,无需额外配置。

Codifica 是免费的吗?

是的,Codifica 完全免费(开源免费),可自由下载、安装和使用。

Codifica 支持哪些平台?

Codifica 跨平台运行,可在任意部署了 OpenClaw / Claude Code 的环境中使用(cross-platform)。

谁开发了 Codifica?

由 Davide Di Cillo(@davidedicillo)开发并维护,当前版本 v1.0.1。

💬 留言讨论