Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/Grinv/steam-games-mcpnpx agentmods add skills/grinv/steam-games-mcp/prompt-checkWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/grinv/steam-games-mcp/prompt-check)<a href="https://agentmods.dev/skills/grinv/steam-games-mcp/prompt-check"><img src="https://agentmods.dev/badge/skills/grinv/steam-games-mcp/prompt-check/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/grinv/steam-games-mcp/prompt-check"><img src="https://agentmods.dev/badge/skills/grinv/steam-games-mcp/prompt-check.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00054 | $0.00712 |
| Opus 5.5 | $0.00022 | $0.00285 |
| Sonnet 5.5 | $0.00011 | $0.00142 |
| Haiku 4.5 | $0.00005 | $0.00071 |
Grade A, and why
prompt-check scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 25d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Prompt check — live-test every MCP Prompt argument combination
A static read comparing prompt text against tool names/params misses argument-handling bugs. Actually render every prompt through the real MCP protocol:
npx @modelcontextprotocol/inspector --cli node dist/index.js --method prompts/list
npx @modelcontextprotocol/inspector --cli node dist/index.js --method prompts/get \
--prompt-name <name> --prompt-args key=value key2=value2
--prompt-args takes space-separated key=value pairs, not a JSON blob
— the CLI rejects JSON with "Invalid parameter format".
Run each prompt with no args, with only one of several optional args set at
a time, and with all of them set — an argument that's individually optional
can still have a bug that only shows up when given alone. Also try "" and a
whitespace-only value (" ") for every optional string arg, not just
omitted-vs-present — both must mean "not given", never a validation error
(client forms send "" for an untouched field; what_should_i_play rejected
it for budget/steamid): it's truthy in JS, so a missing .trim() on
prompts.ts's own argsSchema (separate from tools/*.ts's, and not
automatically covered by a tool-schema trim fix like 61fe40a) slips past a
field ? ... : .../field ?? "default" check the same way an actually-set
value would.
Validate every tool call the rendered text instructs against that tool's
actual inputSchema and documented caps — reading the prompt for plausible
tool/param names isn't enough. Both live-confirmed here: deals_digest
rendered min_discount values outside discover_games' own 1-100 range, and
what_should_i_play told the agent to read ownership off get_owned_games'
games list, which is capped at the top 50 by playtime and whose own source
comment says it is not reliable for ownership (check_appids is).
Watch out for a SteamID64 argument specifically: the inspector CLI's own
--prompt-args key=value parsing silently coerces a numeric-looking value
through a JS number, and a 17-digit SteamID64 exceeds
Number.MAX_SAFE_INTEGER — it comes out the other side with its last couple
of digits corrupted (e.g. ...930 → ...940), even though the prompt's own
z.string() schema never asked for that. Confirmed this is the inspector's
bug, not this server's, by sending the identical prompts/get call as raw
JSON-RPC over stdio (a JSON string round-trips exactly) — don't spend time
chasing this as a steam-games-mcp finding if it recurs; just verify any
SteamID64-argument prompt test that way instead of trusting the inspector
CLI's rendering of the digits.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 25d ago Changed · +2 lines 58f2bb001f89
- 1mo ago First seen · 50 lines · 54 tokens per session scan A 2e0d9d21a58e
prompt-check is a skill published in the GitHub repository Grinv/steam-games-mcp (5 stars, last pushed 7d ago), licensed MIT. It adds 54 tokens to every session and 712 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
lain-verify
Use to verify a change through Lain — "run the tests", "does it build", "what is untested", "what changed", "which branch am I on". Covers the verify package (build/test/lint/coverage/git state).
audit-prd
Audit a multi-section PRD with deterministic Hard Output Rules and cross-section consistency checks. Use when reviewing a complete product requirements document, checking FR-to-AC coverage, acceptance-criteria numbering, story-point arithmetic, or test traceability.
allure-testops
Use when the user asks to find, create or update test cases in Allure TestOps, add steps and expected results, tag or link test cases, run a manual launch, or triage failed test results and defects. Triggers include "create a test case in Allure", "find test cases for this feature", "update the expected result", "what…
lounge-tool-best-practice
Rules that stop the common failures: guessed slugs, missing arguments, repeated searches and rate limits.
check-lounge-access
Work out whether a specific credit card, membership, airline status or day pass gets you into a given lounge.
manage-lounge-history
Review, correct or delete a signed-in user's logged visits and reviews. Requires OAuth with the write scope.