Borrowing it
Nothing to install: this file belongs to adamayoung/TMDb. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/adamayoung/TMDb/main/.claude/skills/review-knowledge/SKILL.mdgit clone --depth 1 https://github.com/adamayoung/TMDbWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/adamayoung/tmdb/review-knowledge)<a href="https://agentmods.dev/skills/adamayoung/tmdb/review-knowledge"><img src="https://agentmods.dev/badge/skills/adamayoung/tmdb/review-knowledge/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/adamayoung/tmdb/review-knowledge"><img src="https://agentmods.dev/badge/skills/adamayoung/tmdb/review-knowledge.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00113 | $0.05825 |
| Opus 5 | $0.00056 | $0.02913 |
| Sonnet 5 | $0.00023 | $0.01165 |
| Haiku 4.5 | $0.00011 | $0.00583 |
Grade A, and why
review-knowledge scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 342 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Review Knowledge
Audit knowledge/ and .claude/ against reality. Both are a cache of currently-true
facts (knowledge/README.md → Maintenance & retention), and caches go stale
silently: writes are engineered here (/capture-knowledge, /deliver's capture
phase) but retirements are not, so truth decays exactly where the code moves
fastest — Makefile, .github/workflows/ci.yml, Package.swift, target layout,
toolchain pins.
Four independent adversarial auditors — an accuracy lens and a structure lens over each of the two trees — audit them, cross-examine each other's findings within their tree, and converge on a consensus. You adjudicate only what survives disputed.
The base's own entries are the thing under suspicion. An entry that reads confidently and cites a file is exactly the kind that goes stale unnoticed — confidence is not currency here. Verify against the tree or drop the claim.
Agent Behaviour Contract
The point of this skill: do these by default, without being reminded.
- Two lenses × two trees, one Workflow. Run the embedded
Workflowbelow. It fans out four auditors in parallel — each lens against each tree — every one pinned to theopusmodel, then runs a cross-examination round paired within each tree, so the two lenses challenge each other on the same material. Invoking this skill is itself the opt-in to callWorkflow. A tree whose pair doesn't both return is reportedunreconciled, never as consensus. The cross-examination stays onfable— do not unify the two tiers. The rounds are not symmetric: a refutation is written to the permanent refutation memory (item 2) and silently suppresses that finding on every later audit, so a weak refuter costs far more than a weak auditor. An audit miss, by contrast, is re-derivable next run. See ADR-0020. - Consult the refutation memory first. Before reporting, grep
knowledge/skill-improvement-log.mdfor· refutedentries and drop any finding already settled there whose Reconsider when condition is unmet. Say in the report how many you dropped this way. Re-deriving a settled refutation costs a full audit cycle and buys nothing. - Verify, never trust the prose. Every finding must be checked against the
actual tree (
Read/Grep/Bash) and citefile:line. A finding sourced only from reading the knowledge base itself is inadmissible — that is the failure mode being audited. - Critics are read-only. They audit and report. They do not edit
knowledge/, do not fix anything, and do not open PRs. Applying is the conductor's job, after the user approves. - "Nothing needs changing" is a real, respectable outcome. A critic that finds a file accurate must say so and name what it checked. Do not manufacture findings to look thorough — a padded audit trains the next one to be ignored.
- Adjudicate only genuine deadlock. After cross-examination, findings both critics confirm are consensus and need no debate from you. Resolve only what remains disputed, with a stated rationale grounded in the tree.
- Report before you fix. Present the consensus, get the user's go-ahead, then apply. Never silently rewrite the knowledge base on the strength of an audit.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 342 lines · 113 tokens per session scan A ea613ba8db0b
review-knowledge is a skill published in the GitHub repository adamayoung/TMDb (176 stars, last pushed 9d ago), licensed Apache-2.0. It adds 113 tokens to every session and 5,825 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
Swift Patterns
Use this skill when working on Swift projects (SwiftPM packages, iOS/macOS apps) and you want consistent patterns for concurrency, structure, and safety.
using-xtool
This skill should be used when building iOS apps with xtool (Xcode-free iOS development), creating xtool projects, adding app extensions, or configuring xtool.yml. Triggers on "xtool", "SwiftPM iOS", "iOS on Linux", "iOS on Windows", "Xcode-free", "app extension", "widget extension", "share extension". Covers project…
scarf-miniapp-author
Author a Scarf mini-app — a small sandboxed web surface (HTML/CSS/JS) that renders inside a project's cockpit and talks to the bound Hermes session + project data through the versioned window.scarf bridge. Use to build a bespoke panel (a task board, an approval queue, a chart, a data table) for a project.
boutique-best-practices
Best practices for using Boutique with Swift 6 concurrency, @Observable, @ObservationIgnored, Sendable conformance, testing with preview stores, and dependency injection. Use when troubleshooting Boutique issues, migrating to Swift 6, or setting up tests.
plan
Epic decomposition into trackable, right-sized tasks. Three modes — audit-aware (codebase-audit reports), workflow-audit-aware (handoff.yaml with pre-rated findings), standalone (from scratch). Light convention scanning for projects without CLAUDE.md.
workflow-audit
Systematic UI workflow auditing for SwiftUI applications. Discovers entry points, traces user flows, detects dead ends and broken promises, audits data wiring, evaluates from user perspective. Triggers: "workflow audit", "audit flows", "find dead ends", "check navigation".