
token-burner
Use when autonomously burning tokens on productive project improvements — code review, tests, docs, dependency audit, refactoring. Each task isolated in a git worktree with verification before merge.
- Installs
- 538
- Last 24h
- —
- Trending rank
- —
- Security
- Not audited
Install
Works with every agent the skills CLI supports.
npx skills add https://github.com/wu529778790/shenzjd-skills --skill token-burner- 01
Install
Run the command in your project. The CLI asks which agents to install for.
- 02
Describe the task
Ask your agent for something this skill covers. It loads token-burner automatically when relevant.
- 03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.
SKILL.md
The instructions your agent reads when the skill is triggered.
Token Burner
在 token 过期前自动执行有价值的项目改进任务,不浪费任何额度。
Overview
自动扫描项目,发现代码审查、测试生成、文档完善、依赖审计、重构等任务,按优先级排序后自主执行。使用 worktree 隔离每个任务,执行后自动验证,确保每次修改都是安全的。
When to Use
- User wants to use tokens productively before they expire
- User wants to run an autonomous code improvement session
- User says "burn tokens" / "token burner" / "用掉 token"
- User wants to auto-discover and fix issues across a project
- User inputs
/token-burner - User wants automated code review across the project
- User wants to find and fix code smells automatically
- User wants to improve test coverage without manual effort
- User wants to do a full project health check and cleanup
When NOT to Use:
- User wants to work on a specific, well-defined task (use normal workflow)
- User wants to chat or brainstorm (no token waste concern)
- User's project has no code to improve
- User wants to run automated tests only (use test runner directly)
- User wants to generate documentation only (use doc generation tools)
- User wants to refactor specific files (do it manually for better control)
Core Pattern
Step 1: 项目扫描
检测项目类型和结构,发现可执行任务:
# 检测项目类型
test -f package.json && echo "Node.js"
test -f go.mod && echo "Go"
test -f requirements.txt && echo "Python"
test -f Cargo.toml && echo "Rust"
# 检测 git 状态
git log --oneline -5 # 最近变更
git diff --stat HEAD~3 # 变更范围
git status --porcelain # 未提交变更
任务发现引擎:(详见 templates/task-discovery.md)
| 任务类型 | 发现方式 | 优先级 |
|---|---|---|
| 🔒 依赖安全 | 如果 dependency-audit skill 可用则委派,否则直接运行审计工具 | P0 - 立即执行 |
| 🐛 代码缺陷 | 分析 git diff 中的逻辑问题 | P0 - 立即执行 |
| 🧪 测试覆盖 | 找无测试的源文件,检查覆盖率 | P1 - 高优先级 |
| 📝 文档缺失 | 检查 README、函数注释、API 文档 | P2 - 中优先级 |
| ♻️ 代码重构 | 重复代码、复杂函数、code smell | P2 - 中优先级 |
| 🧹 Git 清理 | 过时分支、conflict markers、大文件 | P3 - 低优先级 |
生成任务列表,每个任务包含:type、file、description、impact(high/medium/low)、risk(high/medium/low)。
Step 2: 优先级排序
按 score = impact_score × (1 - risk_score) 排序:
| 因子 | high | medium | low |
|---|---|---|---|
| impact | 3 | 2 | 1 |
| risk | 0.8 | 0.4 | 0.1 |
安全策略:
- P0 任务(安全漏洞、缺陷)→ 立即执行
- P1 任务(测试)→ 可以执行,但每个任务在 worktree 中隔离
- P2 任务(文档、重构)→ 可以执行
- P3 任务(清理)→ 只在有剩余 token 时执行
前置依赖检查:
执行前先检查所需工具是否可用,缺失时跳过对应任务类型而非静默失败:
# 检查工具可用性
command -v jq >/dev/null 2>&1 || echo "⚠️ jq 未安装,安全审计任务将跳过"
command -v npm >/dev/null 2>&1 || echo "⚠️ npm 未安装,Node.js 审计将跳过"
command -v go >/dev/null 2>&1 || echo "⚠️ go 未安装,Go 审计将跳过"
command -v pip-audit >/dev/null 2>&1 || echo "⚠️ pip-audit 未安装,Python 审计将跳过"
过滤规则:
- 跳过
node_modules/、vendor/、.git/等目录 - 跳过已由其他 skill 覆盖的任务(如 git-hooks-setup 已配置的)
- 跳过超过 500 行变更的大任务(拆分为子任务)
Step 3: 自主执行
使用 Agent tool 逐个执行任务,每个任务在独立 worktree 中:
对每个 task in 队列:
retries = 0
max_retries = 3
while retries < max_retries:
1. Agent(task.prompt, {
subagent_type: "general-purpose",
isolation: "worktree",
description: "token-burner:" + task.type
})
2. 在 worktree 中跑测试验证
3. 如果测试通过 → 合并到主分支,break
4. 如果测试失败 → retries++
- 如果 retries < max_retries → 回滚 worktree,重试
- 如果 retries >= max_retries → 记录失败原因,跳过此任务
5. 更新任务状态
每种任务的执行策略:
| 任务类型 | 执行方式 | 验证方式 |
|---|---|---|
| 🔒 依赖安全 | 运行审计工具,生成修复命令 | 重新审计确认 |
| 🐛 代码缺陷 | 分析 diff,定位问题,修复 | 跑相关测试 |
| 🧪 测试覆盖 | 为源文件生成单元测试 | 跑新测试确认通过 |
| 📝 文档缺失 | 生成 README/注释/API docs | 检查文档格式 |
| ♻️ 代码重构 | 提取函数、消除重复、简化逻辑 | 跑全量测试 |
| 🧹 Git 清理 | 清理无用文件、格式化 | git status 确认 |
执行限制:
- 每个任务最多 3 次重试
- 单个任务超时 5 分钟则跳过
- 总任务数默认最多 20 个(可通过
--max-tasks调整)
Step 4: 记录和报告
每个任务完成后记录到 memory(任务类型、文件、状态、说明),执行结构见 templates/execution-report.md。
Step 5: 收尾
生成最终报告 templates/execution-report.md,包含:
- 执行统计(成功率、耗时、token 消耗估算)
- 每个任务的详细结果
- 未执行任务的原因
- 下次运行建议
Quick Reference
Note: Parameters below are natural language hints parsed by the AI. Without parameters, the AI will ask interactively.
/token-burner # Scan and execute all tasks
/token-burner 只跑测试和文档 # Only test and doc tasks
/token-burner 最多跑 10 个任务 # Limit to 10 tasks
/token-burner 只扫描不执行 # Scan only, don't execute
/token-burner 扫描 /path/to/repo # Target specific project
| Hint | Description | Default |
|---|---|---|
只跑 type | Task type filter (security/bug/test/docs/refactor/clean) | All |
最多跑 N 个任务 | Maximum tasks to execute | 20 |
| 只扫描不执行 | Scan only, don't execute | false |
扫描 path | Target project path | Current directory |
Common Mistakes
| 错误 | 正确做法 | 原因 |
|---|---|---|
| 不跑测试就合并 | 每个任务执行后必须验证 | 避免引入新 bug |
| 一次执行太多任务 | 控制在 20 个以内 | 避免 token 耗尽时半途而废 |
| 跳过 worktree 隔离 | 始终用 isolation: "worktree" | 避免任务间互相干扰 |
| 不记录执行结果 | 写入 memory 文件 | 下次运行需要知道哪些做过 |
| 对生产代码不做验证 | 改完必须跑测试 | 确保不破坏现有功能 |
| 不检查工具可用性 | 执行前验证工具是否存在 | 缺失工具的任务应跳过而非报错 |
| 在大项目上不限制任务数 | 设置 --max-tasks 限制 | 避免 token 耗尽后任务中断 |
| 跳过风险评估 | 按 impact × (1 - risk) 排序 | 高风险任务应谨慎处理 |
| 不区分 node_modules 等目录 | 跳过 vendor/node_modules/.git | 扫描第三方代码浪费 token |
| 重构时不做 diff 检查 | 限制单任务变更 < 500 行 | 过大变更难以验证安全性 |
FAQ
What does the token-burner skill do?
Use when autonomously burning tokens on productive project improvements — code review, tests, docs, dependency audit, refactoring. Each task isolated in a git worktree with verification before merge.
How do I install token-burner?
Run npx skills add https://github.com/wu529778790/shenzjd-skills --skill token-burner in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/token-burner/ (personal) or .claude/skills/token-burner/ (project).
Which AI agents can use token-burner?
Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.
Is token-burner safe to install?
No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.
Who maintains token-burner?
It is published by wu529778790 in wu529778790/shenzjd-skills. It has 538 recorded installs.
More from wu529778790/shenzjd-skills
docker-build-deploy
wu529778790/shenzjd-skills
Use when containerizing a Node.js app and setting up GitHub Actions CI/CD to build, push to GHCR, and deploy via SSH. Multi-stage build, non-root user, caching.
dependency-audit
wu529778790/shenzjd-skills
Use when auditing project dependencies for security vulnerabilities, outdated packages, or license compliance across npm/yarn/pnpm, pip, go, and cargo.
git-hooks-setup
wu529778790/shenzjd-skills
Use when setting up git hooks (pre-commit, commit-msg, pre-push) with husky or native hooks for linting, formatting, commit conventions, and secret scanning.
db-migration-helper
wu529778790/shenzjd-skills
Use when generating database migration SQL from model or schema changes — compares current vs desired schema, detects diffs, outputs reversible safe migrations.
github-profile-beautifier
wu529778790/shenzjd-skills
Use when creating or improving a GitHub profile README — themed stats cards, project showcase, tech-stack badges, and typing banner. 5 themes, smart project ranking (snake contribution graph needs separate setup).
api-doc-generator
wu529778790/shenzjd-skills
Use when generating OpenAPI/Swagger API docs from existing code — scans routes/annotations, extracts params and responses, outputs a YAML/JSON spec.
Popular code quality & workflow skills
grill-me
mattpocock/skills
A relentless interview to sharpen a plan or design.
improve-codebase-architecture
mattpocock/skills
Scan a codebase for deepening opportunities, present them as a visual HTML report, then grill through whichever one you pick.
handoff
mattpocock/skills
Compact the current conversation into a handoff document for another agent to pick up.
domain-modeling
mattpocock/skills
Build and sharpen a project's domain model. Use when discussing codebase terminology, writing or editing a GLOSSARY.md, or recording or editing an ADR.
codebase-design
mattpocock/skills
Shared vocabulary for designing deep modules. Use when the user wants to design or improve a module's interface, find deepening opportunities, decide where a seam goes, make code more testable or AI-navigable, or when another skill needs the deep-module vocabulary.
diagnosing-bugs
mattpocock/skills
Diagnosis loop for hard bugs and performance regressions. Use when the user says "diagnose"/"debug this", or reports something broken/throwing/failing/slow.