Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add FFmorange/QDeskWatch --skill skill-sync-reviewgit clone --depth 1 https://github.com/FFmorange/QDeskWatchWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ffmorange/qdeskwatch/skill-sync-review)<a href="https://agentmods.dev/skills/ffmorange/qdeskwatch/skill-sync-review"><img src="https://agentmods.dev/badge/skills/ffmorange/qdeskwatch/skill-sync-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/ffmorange/qdeskwatch/skill-sync-review"><img src="https://agentmods.dev/badge/skills/ffmorange/qdeskwatch/skill-sync-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00135 | $0.02009 |
| Opus 5 | $0.00068 | $0.01005 |
| Sonnet 5 | $0.00027 | $0.00402 |
| Haiku 4.5 | $0.00014 | $0.00201 |
Grade A, and why
skill-sync-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 110 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Skill 同步审查
先判断问题是否属于 skill，再决定 skill 是否要更新。
核心逻辑
- 把 skill 视为“可复用执行契约”，不要把它当成项目事实说明书。
- 评估 skill 是否该更新时，关注的不是“项目有没有变化”，而是“另一个 Codex 现在还能不能正确触发、正确理解并正确执行这个 skill”。
- 只在变化已经影响 skill 的可触发性、可执行性、可维护性或可复用性时，才把它视为 skill 更新需求。
- 如果变化只涉及项目事实、模块位置、规则口径或一次性任务，优先考虑更新项目文档、
AGENTS.md或具体实现，不要习惯性改 skill。
五层归属判断
先判断问题落在哪一层：
- 触发层：
SKILL.mdfrontmatter 里的name、description是否还能正确覆盖实际触发语义。 - 展示层：
agents/openai.yaml的display_name、short_description、default_prompt是否仍与 skill 当前能力一致。 - 方法层：
SKILL.md正文中的步骤、判断顺序、输出要求是否还能稳定指导执行。 - 资源层：
scripts/、references/、assets/、被引用的项目文档或路径是否仍可用、仍值得依赖。 - 边界层：内容究竟该写在 skill、项目文档、
AGENTS.md，还是应拆给其他 skill。
只有当上述某一层出现真实失配时，才认为“这个 skill 需要同步”。
什么时候应更新 skill
- skill 的
description已经无法准确触发，导致该触发时没触发，或误覆盖了不该匹配的任务。 agents/openai.yaml的展示文案、默认提示和SKILL.md实际能力已经不一致，容易误导使用者。- skill 被调用后，经常还要额外补解释、改步骤、纠正顺序，说明正文流程已经失去指导价值。
- skill 依赖的脚本、参考文档、路径、命令或外部约束已经失效，导致执行链条断裂。
- skill 与项目文档、
AGENTS.md、其他 skill 出现明显重复、冲突、职责越界或遗漏。 - 同类任务反复暴露出同一种缺口，说明当前 skill 已不足以支撑稳定复用。
- 现有 skill 写入了过多项目专属事实，已经需要瘦身、拆分或把事实迁回文档。
什么时候通常不应更新 skill
- 只是项目结构变了，但 skill 依赖的项目文档仍能承接这些事实，且 skill 的方法本身没有失效。
- 只是一次性的分支实验、临时目录、阶段性约定或短期 workaround。
- 只是某次任务的输出偏好变化，没有沉淀成长期可复用的方法。
- 只是发现事实缺口，而这些内容本来就应该补到
docs/或项目级AGENTS.md。 - 只是想顺手统一措辞，但不会影响触发、执行或边界判断。
审查顺序
- 读取目标 skill 的
SKILL.mdfrontmatter 与正文，再读取agents/openai.yaml。 - 如 skill 含
scripts/、references/、assets/，检查这些资源是否仍然有效。 - 阅读与该 skill 相关的项目文档、项目级
AGENTS.md、缓存目录AGENTS.md、其他关联 skill，以及必要的当前仓库内容。 - 先做归属判断：这是 skill 问题，还是文档、规则、实现、资源或边界问题。
- 再做有效性判断：
- 现在的用户请求还能正确触发这个 skill 吗。
- 另一个 Codex 在不额外猜测的前提下，还能照此完成任务吗。
- skill 引用的资源、路径、命令和依赖关系还成立吗。
- 这部分内容继续留在 skill 里，是否仍然比放在文档或
AGENTS.md更合理。
- 只有在上述判断出现明确问题时，才整理差异并提出最小改动方案。
- 当失配范围较大、牵涉多项能力或资源变化较多时，可查看当前分支与目标 skill 或其依赖对象相关的 Git 提交，辅助理解变化来源。
- 在用户明确同意前，不直接改写 skill。
- 用户确认后，只修改已确认的层和范围；若改到 frontmatter 或用途说明，同步检查
agents/openai.yaml是否也要调整。 - 修改后运行模板校验，并说明本次是改了触发层、展示层、方法层、资源层还是边界层。
自我评审机制
- 在向用户展示差异前，先完成自我评审，不要把未经筛选的初步判断直接抛给用户。
- 简单任务至少做 1 轮自审：确认这是不是 skill 本身的问题。
- 中等任务至少做 2 轮自审：
- 归属审查：问题究竟应落在 skill、文档、
AGENTS.md、其他 skill 还是具体实现。 - 改动面审查：是否可以只改
description、openai.yaml或局部流程，而不是重写整个 skill。
- 归属审查：问题究竟应落在 skill、文档、
- 复杂任务至少做 3 轮自审：
- 归属审查。
- 改动面审查。
- 触发与复用审查：修改后会不会让 skill 过宽、过窄，或继续承载不该放进来的项目事实。
- 如自审后仍存在冲突、归属不清或范围不稳，继续审查，不要急着展示结论。
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 110 lines · 135 tokens per session scan A a44b3f34a440
skill-sync-review is a skill published in the GitHub repository FFmorange/QDeskWatch (2 stars, last pushed 4mo ago), licensed MIT. It adds 135 tokens to every session and 2,009 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
systematic-debugging
Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.
local-ai-agents
Build local-first AI agents that run entirely on a developer workstation with Microsoft Foundry Local and Qwen function-calling models. Covers Small Language Models (SLMs), the OpenAI-compatible local endpoint, sandboxed local tools, local RAG with Chroma, local MCP servers, hybrid cloud/local routing, and the…
next-cache-components-adoption
Turn on Cache Components in a Next.js app and resolve the blocking routes it surfaces. Use when the user wants to enable, adopt, or migrate to Cache Components, flip the cacheComponents flag, work through a flood of blocking-prerender / instant validation errors, run the cache-components-instant-false codemod, or…
insight-error-page
Write or audit an insight-kind error page for the Next.js dev overlay. Use when creating a new errors/ .mdx page, auditing an existing one, or checking that a page matches the framework fix cards. Covers page structure, title alignment, FixCard cards with Copy prompt button, code snippets, terminology verification…
next-cache-components-optimizer
Drive a Next.js route to instant navigation by setting up an agentic loop, under Cache Components / PPR, on initial load (hard navigation) and client-side navigation (soft navigation). Encode the goal as a failing @next/playwright instant() e2e and work it to green, one verified route at a time; the shipped test then…
next-partial-prefetching-adoption
Turn on Partial Prefetching in a Next.js app and work through the insights it surfaces. Use when the user wants to enable or adopt Partial Prefetching, flip the partialPrefetching flag, opt routes in with export const prefetch = 'partial', audit Link prefetch={true} behavior, preserve existing prefetched UI with…