Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add anton-abyzov/vskill --skill stripe-refund-auditorgit clone --depth 1 https://github.com/anton-abyzov/vskillWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/anton-abyzov/vskill/stripe-refund-auditor)<a href="https://agentmods.dev/skills/anton-abyzov/vskill/stripe-refund-auditor"><img src="https://agentmods.dev/badge/skills/anton-abyzov/vskill/stripe-refund-auditor/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/anton-abyzov/vskill/stripe-refund-auditor"><img src="https://agentmods.dev/badge/skills/anton-abyzov/vskill/stripe-refund-auditor.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00052 | $0.00891 |
| Opus 5 | $0.00026 | $0.00445 |
| Sonnet 5 | $0.00010 | $0.00178 |
| Haiku 4.5 | $0.00005 | $0.00089 |
Grade A, and why
stripe-refund-auditor scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 89 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/stripe-refund-auditor
Audit Stripe refunds over a date range to surface anomalies — refund-rate spikes, missing reasons, suspicious duplicates — and emit a markdown report.
When to use
Trigger when the user asks any of:
- "Audit our Stripe refunds for the last 30 days"
- "Check refund anomalies in Stripe"
- "Review refund activity since {date}"
What this skill does
- Read
STRIPE_API_KEYfrom the environment (or.env.localnext to this skill). - Run
scripts/audit.pywith the requested date range. The script paginates through/v1/refundsand emits a JSON record per refund. - Run
scripts/grader.pyover the JSON output to compute a deterministic anomaly score in[0, 1]. - Render a markdown report listing the highest-scoring anomalies with their
id,amount,currency,status, andreason.
Files in this skill
scripts/audit.py— the deterministic refund-pull + anomaly-detection helper.scripts/grader.py— pure-function grader producing a 0..1 numeric score.tests/integration_test.py— pytest integration test (skipped withoutSTRIPE_API_KEY).references/refund-schema.md— Stripe Refund object field reference.evals/evals.json— LLM-judged behavioral evaluation cases..env.example— placeholder template; copy to.env.localand fill in real values.
Preflight
Before invoking, run vskill check stripe-refund-auditor to verify:
- The Stripe MCP server is configured in your Claude config.
STRIPE_API_KEYis resolvable from env or.env.local.- Python
>=3.10is on PATH. pytest --collect-only tests/succeeds.
Step 1 — Pull refunds. Run this immediately:
python3 scripts/audit.py --since "$(date -u -v-30d +%Y-%m-%d)" --until "$(date -u +%Y-%m-%d)" > /tmp/refunds.jsonl
Step 2 — Score anomalies. Run this immediately:
python3 scripts/grader.py /tmp/refunds.jsonl > /tmp/refund-scores.json
Step 3 — Render the report. Run this immediately:
python3 -c "import json,sys; data=json.load(open('/tmp/refund-scores.json')); print(json.dumps({'top_anomalies': data['anomalies'][:10], 'score': data['overall_score']}, indent=2))"
What ships with it
6 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 89 lines · 52 tokens per session scan A f60edd0ee9bc
stripe-refund-auditor is a skill published in the GitHub repository anton-abyzov/vskill (45 stars, last pushed 5d ago), licensed MIT. It adds 52 tokens to every session and 891 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
prereview
Review the current diff against this team's conventions and invariants before it ships. Invoke with /prereview before opening a PR, or run as a pre-push gate.
agent-config-setup
Generate AI agent config files for any project — Cursor, Claude Code, Copilot, Windsurf, Cline, AGENTS.md. Use when setting up a new project for AI agents.
optimize-skill-loop
Deterministic outer-loop optimizer for a skill that already carries a frozen eval (produced upstream by an eval source such as create-skill-eval). Runs the frozen eval across user-chosen agents on fresh headless sessions via a pluggable adapter, grades quality/cost/perf, keeps the pareto-best variant, and versions…
create-skill-eval
Author a frozen, graded eval harness for ONE inner skill and freeze it inside that skill as a conformant eval/ directory (scenarios + deterministic evaluator + rubric + fixtures + HARNESS.md manifest). The eval content is skill-specific; this skill is the reusable methodology that produces it. Its output is consumed…
fork-and-publish-skill
Customizes an installed agent skill and ships it back upstream or as a versioned fork using qvr's edit/publish authoring loop. Use when a user wants to modify, customize, fork, release, or publish a qvr skill — e.g. "edit this skill", "publish my changes", "fork a skill to my own repo", "cut a v1.0.0 release of a…
onboard-skills
Discovers and installs agent skills into a project (or the user-global lane) with the qvr CLI, where qvr.toml declares intent and qvr.lock is the resolved source of truth for what loads. Use when a user wants to find, add, register, or install skills from a skills registry or GitHub repo with qvr — e.g. "register a…