Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add huajielong/skill-evaluator --skill skill-evaluatorgit clone --depth 1 https://github.com/huajielong/skill-evaluatorWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/huajielong/skill-evaluator/skill-evaluator)<a href="https://agentmods.dev/skills/huajielong/skill-evaluator/skill-evaluator"><img src="https://agentmods.dev/badge/skills/huajielong/skill-evaluator/skill-evaluator/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/huajielong/skill-evaluator/skill-evaluator"><img src="https://agentmods.dev/badge/skills/huajielong/skill-evaluator/skill-evaluator.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00076 | $0.01745 |
| Opus 5.5 | $0.00030 | $0.00698 |
| Sonnet 5.5 | $0.00015 | $0.00349 |
| Haiku 4.5 | $0.00008 | $0.00175 |
Grade A, and why
skill-evaluator scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
| 2 | 网络外呼 | 全文搜索 curl/wget/fetch 等函数调用 | How it starts
The opening of the file, as written. The whole thing — 151 lines — stays where its author put it; the contents beside it link to each section on GitHub.
技能评估器
评估一个技能是否值得安装。两步走：安全门禁 → 类型评分。
铁律
- 安全门禁不通过，不得评分。 直接否决。
- 得分 ≤ 50，建议"不安装"。 除非用户明确说"我知道、我接受"。
- 不确定技能类型，先问用户。 不替用户做假设。
流程
步骤 0：确定技能位置
用户没给路径 → 问文件路径或 .skill 文件位置。
步骤 1：安全门禁
使用 scripts/evaluate.sh --security <path> 自动扫描。如果 Bash 不可用（如 Claude.ai），逐项手动检查：
| # | 检查项 | 手动方法 |
|---|---|---|
| 1 | 脚本可读 | 打开 scripts/ 下所有文件看是否可读 |
| 2 | 网络外呼 | 全文搜索 curl/wget/fetch 等函数调用 |
| 3 | 凭证采集 | 搜索 api.key/token/secret/password |
| 4 | 远程代码 | 搜索 curl/wget 管道到 bash/sh |
| 5 | 安全绕过 | 搜索"自动批准/关掉权限" |
输出格式统一： ✅ 或 ❌ 逐项列出，任意 ❌ 则终止，输出"高风险"。
步骤 2：确定技能类型
问用户：
"这是 普通技能（日常用）还是 元技能（用来创建/评估其他技能的）？"
用户不确定 → 看描述和目录结构辅助判断。
步骤 3：评分
自动检查优先，主观项问用户。
每个维度的评分流程：
- 先运行自动化检查（脚本/行数/grep）
- 能确定的直接打分
- 需要主观判断的（如触发精确度），简洁问 1-2 个问题后打分
- 记录每个维度的得分和理由
普通技能 → 读 references/consumer-card.md（v3.0），5 维度
元技能 → 读 references/meta-skill-card.md（v3.0），6 维度
重要评分原则：
- 来源权重最高 — 官方/可信来源的技能，自动获得可信高分（来源可靠本身就是最大的质量信号）
- 价值 > 合规 — 不要求"铁律表/验证步骤/Good-Bad示例"等格式；只看实际产出质量
- 脚本为王 — 有真实可执行脚本的技能价值远高于纯描述技能（实证：有脚本平均高出 19 分）
- 精炼加分 — ≤150 行的精炼技能获得经济性附加分；短而精确优于长而全
- 密度决定经济分 — 超过 50% 泛化内容的长技能(>500行)应受到信息密度扣分
步骤 4：输出最终报告
═══════════════════════════════════════════
技能评估报告
═══════════════════════════════════════════
技能：xxx.skill
类型：普通技能
安全：✅ 通过
┌─ 维度 得分 理由
├ 触发精确度 20/25 描述清晰无负例
├ 执行-完整 12/15 指令有少量缺口
├ 执行-知识 9/12 scripts/ 提供自动化
├ 执行-可靠 6/8 无已知问题
├ 经济性 16/20 450行, 中密度
├ 可信度 8/12 社区来源+脚本完整
├ 理解成本 8/8 结构清晰有示例
└───────────────────────────
总分：79/100
评定：✅ 推荐安装
一句话：触发精准、有脚本支撑，值得试用。
同类对比：无现存同类
如果用户提到同类对比，末尾追加：
同类对比：
┌ 此技能 79/100 优势：有脚本 劣势：无负例
├ 对比项A 82/100 优势：有benchmark 劣势：偏长
└ 对比项B 65/100 优势：免费 劣势：触发模糊
建议：选此技能，但如果需要 benchmarks 可考虑 A
平台适配
Claude Code（完整能力）：
- 使用
scripts/evaluate.sh --all全自动 - 可 Launch Agent 并行评分
Claude.ai（受限能力）：
- 无 Bash 环境，无需运行 evaluate.sh
- 纯手动按评分卡逐项检查
- 用 Read 工具读文件，Grep 不能用时手动扫描关键词
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2mo ago First seen · 151 lines · 76 tokens per session scan A 6a3b7156e1c3
skill-evaluator is a skill published in the GitHub repository huajielong/skill-evaluator (6 stars, last pushed 4mo ago), licensed MIT. It adds 76 tokens to every session and 1,745 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
review-finished-ad
Final QC gate for a rendered 9:16 video ad, run before it is published. One script checks what a machine can decide — exact 1080x1920 size, a hook that moves and speaks in the first second, no frozen stretches, no dead air, no black frames, the brand's real logo on the end card (never a favicon, never a redrawn or…
render-mosaic-grid-reveal
Render a 'mosaic-grid-reveal' video from a config — a real-DOM FULL-BLEED N×N mosaic of real product tiles that pops in one tile at a time (scatter order, ease-out-back overshoot), the grid clears, then the brand wordmark builds line-by-line followed by a sub-label, tagline, and CTA; frame-stepped via Playwright and…
research-competitors-category-pass
Step of the research-competitors playbook: the worker brief covering the whole category, including searches, AI answers, community threads and category ad winners. Run research-competitors instead; not for direct use.
run-organic-social-account-audit
Reviews a brand's own social accounts: what each is for, the last 30 posts ranked against the account's own median with the likely reason for top and bottom posts, cadence actually kept, best posting times, and bio and pinned-post fixes. Use alone when you already know which accounts to review and can read their…
review-work
Post-implementation gate review: run manual QA on the real surface yourself, then launch ONE gate reviewer (never a panel) to audit goal, constraints, code quality, security, missed context, and QA evidence. Use before a PR handoff or when the user explicitly asks to review completed work.
remove-deadcode
Remove unused code from this project with ultrawork mode, LSP-verified safety, atomic commits. Triggers: remove dead code, dead code, cleanup, remove unused.