What is review-pubsub-components?

A read-only review procedure for Dapr pub/sub configuration. It examines the message-broker component settings, subscription files, retry rules, Dapr application settings, and .NET Aspire wiring.

It checks secrets, encryption and authentication, dead-letter and retry settings, scopes, consumer groups, stream limits, deprecated settings, subscription ownership, application IDs, and port conflicts.

It exposes configuration that can send messages insecurely, route them incorrectly, retry them poorly, or make applications collide at runtime before deployment.

review-pubsub-components — Skill for Claude Code by diagrid-labs

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add diagrid-labs/dapr-skills --skill review-pubsub-components

Clone the repo

git clone --depth 1 https://github.com/diagrid-labs/dapr-skills

Made for: Claude Code.

Or install dapr-skills, the plugin that ships this one along with the rest of its 29 skills.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/diagrid-labs/dapr-skills/review-pubsub-components/github.svg)](https://agentmods.dev/skills/diagrid-labs/dapr-skills/review-pubsub-components)

Your own site

<a href="https://agentmods.dev/skills/diagrid-labs/dapr-skills/review-pubsub-components"><img src="https://agentmods.dev/badge/skills/diagrid-labs/dapr-skills/review-pubsub-components/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/diagrid-labs/dapr-skills/review-pubsub-components"><img src="https://agentmods.dev/badge/skills/diagrid-labs/dapr-skills/review-pubsub-components.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 68 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 1,063 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00068	$0.01063
Opus 5.5	$0.00027	$0.00425
Sonnet 5.5	$0.00014	$0.00213
Haiku 4.5	$0.00007	$0.00106

Measured 2d ago against content hash b3245b8ec1df, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

review-pubsub-components scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/review-pubsub-components/SKILL.md · 55 lines

How it starts

The opening of the file, as written. The whole thing — 55 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Review Dapr Pub/sub — Components and Configuration

Overview

Reviews the configuration around Dapr pub/sub: pub/sub component YAML, declarative Subscription files, Resiliency policies, dapr.yaml and the Aspire AppHost. Checks for inline secrets, unauthenticated or unencrypted brokers, dead-letter topics without retry policies, missing scopes, consumer-group and stream-limit mistakes, deprecated or mis-scoped subscriptions, the ignored isRawPayload key, and app-id or port collisions. Read-only: this skill never modifies source files. Publisher code and subscriber handler code are out of scope and are covered by review-pubsub-publishing and review-pubsub-subscriptions.

Execution Order

You MUST follow these phases in strict order. Do not load files outside the agreed scope, and do not write or edit any files.

Resolve scope — Read ../dapr-shared/review-scope-prompt.md and follow it to set scope_root.
Detect target — Read ../dapr-shared/review-detect-target-pubsub.md and follow it to produce language, component_files, subscription_files, resiliency_files, run_files, subscriptions and skipped. Stop with the "Nothing to review" report defined in review-report-format.md (no rule id, not counted in Found:) in either case:
- component_files, subscription_files and resiliency_files are all empty: reason no pub/sub component files found in <scope_root>.
- The only component found is agent-pubsub (it sits in skipped): reason only the agent-pubsub component was found, and the Next steps point to review-agent-orchestration.
Load checklist — Always read ../dapr-shared/review-pubsub-components.md. The checklist is language-neutral, so there is one file for dotnet, aspire and python; apply its .NET / Aspire notes or Python notes for the detected language.
Apply rules — Walk component_files, subscription_files, resiliency_files and run_files against rules DPS-CFG-001 … DPS-CFG-014, using subscriptions as context (dead-letter topics, app ids, scopes). Respect each rule's severity conditions: DPS-CFG-001 is info for a local host or an Aspire secret-parameter default, and DPS-CFG-006 is reported under Please verify.
Report — Format every finding using the canonical template from ../dapr-shared/review-report-format.md. The Language: line carries the detected language. Group by severity, then rule id, then file path. Never print credential values; name the metadata key only.
Show final message — Your last output is the report. Do not append a summary or next-action prompt other than the ## Next steps block defined by the report format. Clarifying questions are always allowed during the review (see the report format); once answered, the report is still your last output.

Read the full file on GitHub · 55 lines

Files

What ships with it

1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

REFERENCE.md 4.0 KB

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

2d ago Changed · -44 tokens per session b3245b8ec1df
6d ago First seen · 55 lines · 112 tokens per session scan A fce8eae5806c

Subscribe to this mod's changes

review-pubsub-components is a skill published in the GitHub repository diagrid-labs/dapr-skills (13 stars, last pushed 2d ago), licensed MIT. It adds 68 tokens to every session and 1,063 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-14.

Backend and APIs Code review claude-skills dapr durable-execution skills tutorial workflow

code-review

A structured code-review guide that checks code for correctness, security, edge cases, concurrency problems, tests, and maintainability.

Lion-1209/Lion-Skills · 23 tokens

offensive-api-abuse

Advanced API exploitation methodology focused on business logic abuse and sophisticated attack patterns that bypass traditional security controls. Covers business logic bypass through API call chaining and workflow manipulation. Addresses GraphQL-specific attacks including batching for credential brute-force, query…

SnailSploit/Claude-Red · 184 tokens

flow-next-resolve-pr

Resolve PR review feedback. Fetches unresolved threads, triages, fixes, replies and resolves via GraphQL. Use when asked to address review comments.

gmickel/flow-next · 36 tokens

pr-description-writer

Redacta una descripción de pull request clara y estructurada a partir de un diff de git, resumen de rama o lista de commits. Úsalo cuando te pidan escribir una descripción de PR, redactar una solicitud de cambios o documentar cambios de código. Produce una descripción con resumen, motivación, cambios realizados, pasos…

mohitagw15856/pm-claude-skills · 80 tokens

resolve-pr-comments

Evaluate, fix, answer, and reply to GitHub pull request review comments and conversation comments. Handles both change requests (fix or skip) and reviewer questions (explain using the rationale recalled from past Claude Code transcripts). Use when the user asks to "resolve PR comments", "fix review comments", "address…

tobihagemann/turbo · 96 tokens

reply-to-pr-threads

Draft, confirm, and post replies to GitHub PR review threads. Handles per-category reply formatting, re-fetches thread resolution state so auto-resolved threads are skipped, posts via GraphQL, resolves threads whose entry carries a resolution reason, and dismisses the code-scanning alert behind a thread whose entry…

tobihagemann/turbo · 97 tokens