Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/ChouChiu/heya-skillnpx agentmods add skills/chouchiu/heya-skill/darwin-skillWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/chouchiu/heya-skill/darwin-skill)<a href="https://agentmods.dev/skills/chouchiu/heya-skill/darwin-skill"><img src="https://agentmods.dev/badge/skills/chouchiu/heya-skill/darwin-skill/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/chouchiu/heya-skill/darwin-skill"><img src="https://agentmods.dev/badge/skills/chouchiu/heya-skill/darwin-skill.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00195 | $0.07679 |
| Opus 5.5 | $0.00078 | $0.03072 |
| Sonnet 5.5 | $0.00039 | $0.01536 |
| Haiku 4.5 | $0.00019 | $0.00768 |
Grade A, and why
darwin-skill scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
86% identical to darwin-skill — 81 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 493 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Darwin Skill 2.0
v2.0 · 2026-05-28 — 吸收 Microsoft Research SkillLens（arXiv 2605.23899）的 9 维评分药方 + SkillOpt（arXiv 2605.23904）的 validation-gated 验证机制 + human in the loop 三层守关。
借鉴 Karpathy autoresearch 的自主实验循环，对 skills 进行持续优化。 核心理念：评估 → 改进 → 实测验证 → 人类确认 → 保留或回滚 → 生成成果卡片 GitHub: https://github.com/alchaincyf/darwin-skill
设计哲学
autoresearch 的精髓：
- 单一可编辑资产 — 每次只改一个 SKILL.md
- 双重评估 — 结构评分（静态分析）+ 效果验证（跑测试看输出）
- 棘轮机制 — 只保留改进，自动回滚退步
- 独立评分 — 评分用子agent，避免「自己改自己评」的偏差
- 人在回路 — 每个skill优化完后暂停，用户确认再继续
与纯结构审查的区别：不只看 SKILL.md 写得规不规范，更看改完后实际跑出来的效果是否更好。
评估 Rubric（9维度，总分100）
设计依据：基于 SkillLens 论文（arXiv 2605.23899）实证发现——LLM-as-judge 评估 skill 质量准确率仅 46.4%（接近随机），加入 meta-skill 三维度后提升到 73.8%。本 rubric 强化 dim3 / dim5 评分标准，新增 dim9「反例与黑名单」，权重平衡到 100。目的：让评分对真实质量更敏感，减少 LLM judge 的乐观偏差。
结构维度（59分）— 静态分析
| # | 维度 | 权重 | 评分标准 |
|---|---|---|---|
| 1 | Frontmatter质量 | 7 | name规范、description包含做什么+何时用+触发词、≤1024字符、禁结尾加"灵活应用/根据情况判断"等空话尾巴 |
| 2 | 工作流清晰度 | 12 | 步骤明确可执行、有序号、每步有明确输入/输出 |
| 3 | 失败模式编码 | 12 | 必须显式编码失败模式（写出"如果 X 失败 → Y"的明确分支）；有fallback路径、错误恢复；只写正向流程而不写失败分支扣 ≥3 分（SkillLens meta-skill 维度） |
| 4 | 检查点设计 | 6 | 关键决策前有用户确认、防止自主失控；检查点必须显性标记（🔴/STOP/CHECKPOINT），仅靠"如果...建议..."措辞不算 |
| 5 | 可执行具体性 | 17 | 不模糊、有具体参数/格式/示例、可直接执行；禁止"建议/可以考虑/根据情况/灵活把握/视情况而定"等软化措辞——出现 ≥3 处扣 ≥3 分（SkillLens actionable specificity 维度） |
| 6 | 资源整合度 | 4 | references/scripts/assets引用正确、路径可达 |
效果维度（35分）— 需要实测
| # | 维度 | 权重 | 评分标准 |
|---|---|---|---|
| 7 | 整体架构 | 12 | 结构层次清晰、不冗余不遗漏、与花叔生态一致；冗余/AI腔废话段落（说白了/换句话说/首先其次综上等花叔禁用词）出现一处扣 1 分 |
| 8 | 实测表现 | 23 | 用测试prompt跑一遍，输出质量是否符合skill宣称的能力 |
Meta-skill 维度（6分）— 反例与黑名单
| # | 维度 | 权重 | 评分标准 |
|---|---|---|---|
| 9 | 反例与黑名单 | 6 | skill 必须有"不要做什么"的反例清单；只写"应该做 X"没有"不要做 Y"扣 ≥3 分；红灯/危险动作/反模式应单独章节列出（SkillLens risk-action blacklist 维度） |
评分规则
- 维度1-7、9：每个维度打 1-10 分，乘以权重得到该维度得分
- 维度8（实测表现）：跑2-3个测试prompt，按输出质量打1-10分
- 总分 = Σ(维度分 × 权重) / 10，满分100
- 改进后总分必须 严格高于 改进前才保留
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 493 lines · 195 tokens per session scan A c3220018f42a
darwin-skill is a skill published in the GitHub repository ChouChiu/heya-skill (18 stars, last pushed today), licensed MIT. It adds 195 tokens to every session and 7,679 once invoked, about $0.0008 per session on Opus 5.5. A static security scan graded it A with 0 findings. It is 86% identical to darwin-skill, differing in 81 lines, and is treated as a copy.
Other skills, from other repositories
loom-typescript
TypeScript language expertise for type-safe, production-quality code.
frontmcp-development
Use when building any FrontMCP server component other than a tool (for tools, use create-tool). Covers @Resource static resources and parameterized URI templates; @Prompt reusable prompts (RAG, multi-turn); @Provider singleton dependency-injection providers (database pools, API clients); @Agent autonomous LLM agents…
aws-cdk
Provides AWS CDK TypeScript patterns for defining, validating, and deploying AWS infrastructure as code. Use when creating CDK apps, stacks, and reusable constructs, modeling serverless or VPC-based architectures, applying IAM and encryption defaults, or testing and reviewing cdk synth, cdk diff, and cdk deploy…
aws-lambda-typescript-integration
Provides AWS Lambda integration patterns for TypeScript with cold start optimization. Use when creating or deploying TypeScript Lambda functions, choosing between NestJS framework and raw TypeScript approaches, optimizing cold starts, configuring API Gateway or ALB integration, or implementing serverless TypeScript…
typescript-security-review
Provides security review capability for TypeScript/Node.js applications, validates code against XSS, injection, CSRF, JWT/OAuth2 flaws, dependency CVEs, and secrets exposure. Use when performing security audits, before deployment, reviewing authentication/authorization implementations, or ensuring OWASP compliance for…
dynamodb-toolbox-patterns
Provides TypeScript patterns for DynamoDB-Toolbox v2 including schema/table/entity modeling, .build() command workflow, query/scan access patterns, batch and transaction operations, and single-table design with computed keys. Use when implementing type-safe DynamoDB access layers with DynamoDB-Toolbox v2 in TypeScript…