Borrowing it
Nothing to install: this file belongs to ayutaz/piper-plus. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/ayutaz/piper-plus/dev/.claude/skills/check-pua/SKILL.mdgit clone --depth 1 https://github.com/ayutaz/piper-plusWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ayutaz/piper-plus/check-pua)<a href="https://agentmods.dev/skills/ayutaz/piper-plus/check-pua"><img src="https://agentmods.dev/badge/skills/ayutaz/piper-plus/check-pua/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/ayutaz/piper-plus/check-pua"><img src="https://agentmods.dev/badge/skills/ayutaz/piper-plus/check-pua.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00078 | $0.01114 |
| Opus 5 | $0.00039 | $0.00557 |
| Sonnet 5 | $0.00016 | $0.00223 |
| Haiku 4.5 | $0.00008 | $0.00111 |
Grade A, and why
check-pua scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 95 lines — stays where its author put it; the contents beside it link to each section on GitHub.
PUA Consistency Check
PUA (Private Use Area) 関連の不変条件を一括検査します。pua.json を編集する PR や、新しい多コードポイント音素 (例: 韓国語の濃音、追加母音等) を追加する作業で必ず呼んでください。
何をチェックするか
docs/spec/pua-contract.toml の 4 不変条件:
- Cross-runtime consistency —
pua.jsonと 6 ランタイム (Python/Rust/Go/JS/C#/C++) のテーブルが byte-for-byte 一致 - Inventory coverage —
id_maps.pyの language inventory に出てくる multi-codepoint token は全てpua.jsonに登録済み - Generated id_map keys —
phoneme_id_mapの全 key が単一コードポイント (C++ runtime の制約) - PUA_COMPAT_VERSION sync — 全ランタイムの compat version が
pua.jsonの version 値と一致
加えて:
- Fixture drift —
tests/fixtures/g2p/phoneme_test_cases.jsonのpua_map/pua_map_countがpua.jsonと一致 (PR #389 で踏んだバグ class)
実行ステップ
1. Cross-runtime consistency
python scripts/check_pua_consistency.py --verbose --check-version
期待: OK: pua.json matches all 6 runtime tables で終了。
2. Inventory + fail-fast invariants (Python)
cd src/python/g2p
uv sync --extra all --extra dev
uv run pytest tests/test_pua_invariants.py -v
期待: 全 PASS。
3. Pre-flight config validator
cd src/python
uv sync --extra test
uv run pytest tests/test_update_model_config.py -v
期待: 全 PASS。
4. Fixture drift detection
python scripts/regenerate_test_fixture.py --check
期待: OK: tests/fixtures/g2p/phoneme_test_cases.json already in sync with pua.json。
drift があれば python scripts/regenerate_test_fixture.py を引数なしで再実行して fixture を更新、commit。
5. (任意) ランタイム別 PUA テーブルテスト
時間がある時のみ:
# Rust
cd src/rust && cargo test -p piper-plus-g2p --lib -- token_map
# Go
cd src/go && go test ./phonemize/... -run "TestFixedPUA"
# JS
cd src/wasm/g2p && node --test test/test-pua-map.js
失敗時の典型的な対応
| 失敗内容 | 対応 |
|---|---|
| Cross-runtime mismatch | 該当ランタイムの PUA テーブル (token_map.rs / pua.go / pua-map.js / OpenJTalkToPiperMapping.cs / phoneme_parser.cpp) を pua.json と一致させる |
| Inventory coverage fail | 失敗した token を src/python/g2p/piper_plus_g2p/data/pua.json の entries に追加 (codepoint range は docs/spec/pua-contract.toml の [ranges] セクション参照) |
| Fixture drift | python scripts/regenerate_test_fixture.py で fixture を更新 |
| compat version mismatch | pua.json の version を bump したら、src/python/g2p/piper_plus_g2p/encode/pua.py の PUA_COMPAT_VERSION と src/wasm/g2p/src/pua-map.js の PUA_COMPAT_VERSION と src/rust/piper-plus-g2p/src/token_map.rs の PUA_COMPAT_VERSION を全部同じ値に揃える |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 95 lines · 78 tokens per session scan A 7d545563808c
check-pua is a skill published in the GitHub repository ayutaz/piper-plus (204 stars, last pushed 7d ago), licensed MIT. It adds 78 tokens to every session and 1,114 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
physicsnemo-shard-tensor
Official NVIDIA-authored guidance for PhysicsNeMo ShardTensor domain parallelism — integrate domain parallelism into training/inference scripts (new or existing) with DDP or FSDP2, write and register shard patches to enable new layers/ops, and bootstrap multi-GPU correctness tests. Use when working with ShardTensor…
physicsnemo-discover
Official NVIDIA-authored guidance for navigating PhysicsNeMo — pick the model, datapipe, or example for a SciML/AI4Science task (surrogates, forecasting, downscaling, physics-informed, inverse, generative). Points at existing files via live repo search; never writes code. Do NOT use for installation or environment…
meta-pre-commit-quality-gate
Run three quality gates (ruff + mypy + pytest) in parallel over the staged diff, then arbitrate a single BLOCK/APPROVE verdict. Use before committing changes locally when you want a comprehensive pre-commit gate beyond per-file linting — exactly the same gate set CI enforces.
short-drama-delivery-audit
Internal deterministic delivery gate for meta-short-drama. Verifies real-provider image/video receipts, parent-owned paid-submission dispositions, runtime fallback evidence, decodability, and content-versus-final duration with ffprobe.
skill-creator-smoke-test
Internal tool (not user-invocable). Called by meta-skill-creator as a DAG step (kind: agent) to run G3 (positive smoke) and G4 (negative smoke) gates against a candidate meta-skill SKILL.md. Cross-vendor: fixture-generation LLM != classifier LLM. Returns JSON.
submit-github-bug-issue
Use when converting QA findings, black-box failures, red-team reports, regression evidence, or local bug notes into GitHub Issues for NVIDIA/TensorRT-Model-Connect. Standardizes checking issue templates, checking labels, de-duplicating existing issues, drafting a bug report, creating the issue on GitHub, applying the…