Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/Grinv/steam-games-mcpnpx agentmods add skills/grinv/steam-games-mcp/prompt-checkWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/grinv/steam-games-mcp/prompt-check)<a href="https://agentmods.dev/skills/grinv/steam-games-mcp/prompt-check"><img src="https://agentmods.dev/badge/skills/grinv/steam-games-mcp/prompt-check/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/grinv/steam-games-mcp/prompt-check"><img src="https://agentmods.dev/badge/skills/grinv/steam-games-mcp/prompt-check.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00054 | $0.00666 |
| Opus 5 | $0.00027 | $0.00333 |
| Sonnet 5 | $0.00011 | $0.00133 |
| Haiku 4.5 | $0.00005 | $0.00067 |
Grade A, and why
prompt-check scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Prompt check — live-test every MCP Prompt argument combination
A static read comparing prompt text against tool names/params misses argument-handling bugs. Actually render every prompt through the real MCP protocol:
npx @modelcontextprotocol/inspector --cli node dist/index.js --method prompts/list
npx @modelcontextprotocol/inspector --cli node dist/index.js --method prompts/get \
--prompt-name <name> --prompt-args key=value key2=value2
--prompt-args takes space-separated key=value pairs, not a JSON blob
— the CLI rejects JSON with "Invalid parameter format".
Run each prompt with no args, with only one of several optional args set at
a time, and with all of them set — an argument that's individually optional
can still have a bug that only shows up when given alone. Also try a
whitespace-only value (" ") for every optional string arg, not just
omitted-vs-present: it's truthy in JS, so a missing .trim() on
prompts.ts's own argsSchema (separate from tools/*.ts's, and not
automatically covered by a tool-schema trim fix like 61fe40a) slips past a
field ? ... : .../field ?? "default" check the same way an actually-set
value would.
Validate every tool call the rendered text instructs against that tool's
actual inputSchema and documented caps — reading the prompt for plausible
tool/param names isn't enough. Both live-confirmed here: deals_digest
rendered min_discount values outside discover_games' own 1-100 range, and
what_should_i_play told the agent to read ownership off get_owned_games'
games list, which is capped at the top 50 by playtime and whose own source
comment says it is not reliable for ownership (check_appids is).
Watch out for a SteamID64 argument specifically: the inspector CLI's own
--prompt-args key=value parsing silently coerces a numeric-looking value
through a JS number, and a 17-digit SteamID64 exceeds
Number.MAX_SAFE_INTEGER — it comes out the other side with its last couple
of digits corrupted (e.g. ...930 → ...940), even though the prompt's own
z.string() schema never asked for that. Confirmed this is the inspector's
bug, not this server's, by sending the identical prompts/get call as raw
JSON-RPC over stdio (a JSON string round-trips exactly) — don't spend time
chasing this as a steam-games-mcp finding if it recurs; just verify any
SteamID64-argument prompt test that way instead of trusting the inspector
CLI's rendering of the digits.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 50 lines · 54 tokens per session scan A 2e0d9d21a58e
prompt-check is a skill published in the GitHub repository Grinv/steam-games-mcp (4 stars, last pushed 17d ago), licensed MIT. It adds 54 tokens to every session and 666 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
audit-prd
Audit a multi-section PRD with deterministic Hard Output Rules and cross-section consistency checks. Use when reviewing a complete product requirements document, checking FR-to-AC coverage, acceptance-criteria numbering, story-point arithmetic, or test traceability.
api-testing
Testing patterns for MCP tool/resource handlers using createMockContext and Vitest. Covers mock context options, handler testing, McpError assertions, format testing, Vitest config setup, and test isolation conventions.
add-test
Scaffold a test file for an existing tool, resource, or service. Use when the user asks to add tests, improve coverage, or when a definition exists without a matching test file.
add-test
Use when adding unit or integration tests. Provides test patterns, naming conventions, and fixtures for Python (pytest), TypeScript (vitest), Java (JUnit/Mockito), and Rust.
run-integration
Use when running integration tests against a real Metadata instance. Guides setup of environment variables (AISDKHOST, AISDKTOKEN) and runs tests that make actual API calls.
lore-onboard
First-time setup wizard for LoreConvo. Verifies the MCP server is connected, the database is accessible, hooks are configured, and runs a test save/load cycle. Use when the user says "set up loreconvo", "onboard", "/lore-onboard", "verify loreconvo", "test loreconvo setup", or after first installing the plugin.