Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/easyzoom/proofreader-skill/proofreader-skillnpx skills add easyzoom/proofreader-skill --skill proofreader-skillgit clone --depth 1 https://github.com/easyzoom/proofreader-skillWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00181 | $0.01771 |
| Opus 5 | $0.00090 | $0.00886 |
| Sonnet 5 | $0.00036 | $0.00354 |
| Haiku 4.5 | $0.00018 | $0.00177 |
Grade A, and why
proofreader-skill scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 67 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Proofreader
通用校对能力,包含两条并行且同等重要的主线:代码校对 和 文档校对。先判断输入属于哪一类,再进入对应流程;两者都涉及时,分别过一遍。
第一步:分类
- 输入主要是源代码(任意语言) → 进入「代码校对」
- 如果代码语言在下面的「语言特定形式化验证后端」列表里,且代码里出现对应的契约/规约标记 → 额外启用对应后端(可能不止一种,比如既有 ACSL 注释又想找具体反例)
- 否则(或者没有工具支持的语言/没写契约)走通用代码逻辑审查 →
references/code-proofreading.md
- 输入主要是自然语言文档/文本(任意语言) → 进入「文档校对」→
references/doc-proofreading.md - 两者都有(例如 README + 代码示例)→ 分别执行两条流程
语言特定形式化验证后端
| 语言 | 契约/规约标记 | 静态证明 | 运行时验证/找反例 |
|---|---|---|---|
| C | /*@ ... */ 或 //@,含 requires/ensures/assigns/invariant 等 |
references/acsl-frama-c.md(Frama-C WP) |
references/eacsl-runtime.md(E-ACSL) |
| Python | @icontract.require/@icontract.ensure 装饰器 |
references/python-contracts.md(CrossHair,注意不是穷尽证明) |
references/python-contracts.md(icontract 运行时检查) |
| Rust | 用户明确要求验证,或代码里已有 #[kani::proof] harness |
references/rust-kani.md(Kani,无循环代码是穷尽式,含循环需查展开界限) |
同上(Kani 一次跑同时覆盖) |
| Java | //@ 或 /*@ ... */ 注释,含 requires/ensures/invariant 等(JML) |
references/java-openjml.md(OpenJML -esc) |
同上(OpenJML 同一个命令一次跑完) |
| C++ | 用户明确要求验证(没有成熟的 ACSL for C++ 标准) | references/cpp-cbmc.md(CBMC,无循环代码是穷尽式,含循环需查展开界限,和 Kani 同理) |
同上(CBMC 一次跑同时覆盖) |
每种后端都遵循同一个模式:契约本身要先人工校对(规约是否写全、写对),再实际调用工具验证,不要仅凭肉眼判断。跑工具前先检查工具是否已安装,缺失就如实告知并给出安装方式,不要假装验证过。
代码校对总原则
- 不只看语法和风格,要追踪数据流/控制流,找真正会在具体输入或状态下触发的问题,而不是泛泛的"风格建议"。
- 每个发现都要给出:文件位置、触发场景(什么输入/状态下出错)、以及现有代码为什么没有覆盖这种情况。
- 有工具可做形式化验证时,优先实际跑工具得出结论,不要仅凭肉眼判断规约/契约是否成立——静态证明和运行时检查都比人工推演可靠,但要注意不同工具的严格程度不同(例如 Frama-C/WP 是穷尽式数学证明,CrossHair 只是有限预算内的符号搜索,不能混为一谈,具体差异见对应 reference 文件)。
文档校对总原则
见 references/doc-proofreading.md。核心是语法正确性、术语一致性、跨语言表达自然度、格式规范,不擅自改写作者的行文风格。
参考文件
references/code-proofreading.md— 通用代码逻辑校对方法论(不限语言)references/acsl-frama-c.md— ACSL 规约校对 + Frama-C 静态证明调用方法(C)references/eacsl-runtime.md— E-ACSL 运行时验证调用方法(C)references/python-contracts.md— icontract 契约校对 + CrossHair 符号执行调用方法(Python)references/rust-kani.md— Kani 有界模型检验调用方法(Rust)references/java-openjml.md— JML 规约校对 + OpenJML-esc调用方法(Java)references/cpp-cbmc.md— CBMC 有界模型检验调用方法(C++)references/doc-proofreading.md— 多语言文档校对方法论
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 67 lines · 181 tokens per session scan A ad230cd79f27
proofreader-skill is a skill published in the GitHub repository easyzoom/proofreader-skill (1 stars, last pushed 1mo ago), licensed MIT. It adds 181 tokens to every session and 1,771 once invoked, about $0.0009 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
frama-c-proofreader
Verify and proofread C code with ACSL using this repository's Frama-C MCP workflow, Frama-C WP static proof, EVA alarms, and optional E-ACSL runtime checks. Use when asked to run Frama-C, check ACSL contracts, explain WP goals, inspect EVA alarms, validate C annotations, or state what a C proof does and does not…
systematic-debugging
Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.
next-cache-components-adoption
Turn on Cache Components in a Next.js app and resolve the blocking routes it surfaces. Use when the user wants to enable, adopt, or migrate to Cache Components, flip the cacheComponents flag, work through a flood of blocking-prerender / instant validation errors, run the cache-components-instant-false codemod, or…
babysit-pr
Babysit a GitHub pull request after creation by continuously polling review comments, CI checks/workflow runs, and mergeability state until the PR is merged/closed or user help is required. Diagnose failures, retry likely flaky failures up to 3 times, auto-fix/push branch-related issues when appropriate, and keep…
imagegen
Generate or edit raster images when the task benefits from AI-created bitmap visuals such as photos, illustrations, textures, sprites, mockups, or transparent-background cutouts. Use when Codex should create a brand-new image, transform an existing image, or derive visual variants from references, and the output…
cpu-profile-analysis
Analyze V8/Chrome CPU profiles (.cpuprofile) and DevTools trace files (Trace-.json). Use when: profiling performance, investigating slow functions, comparing code paths, finding bottlenecks, analyzing timeToRequest, understanding call trees from sampling profiler data, analyzing layout/paint/rendering, investigating…