Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add LearnPrompt/luban-skill --skill lubangit clone --depth 1 https://github.com/LearnPrompt/luban-skillWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/learnprompt/luban-skill/luban)<a href="https://agentmods.dev/skills/learnprompt/luban-skill/luban"><img src="https://agentmods.dev/badge/skills/learnprompt/luban-skill/luban/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/learnprompt/luban-skill/luban"><img src="https://agentmods.dev/badge/skills/learnprompt/luban-skill/luban.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- Socket pass
- Snyk warn
- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Tool Misuse · line 485 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00439 | $0.07624 |
| Opus 5 | $0.00219 | $0.03812 |
| Sonnet 5 | $0.00088 | $0.01525 |
| Haiku 4.5 | $0.00044 | $0.00762 |
Grade A, and why
luban scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
> 优先用 `curl`、`gh api` 这类通常已放行的CLI获取信息；WebFetch/WebSearch 这类工具可能触发用户看不见的权限弹窗，导致你静默挂起。如果一种工具连续失败或无响应，立刻换CLI路线，不要原地重试。每个候选必须给出真实URL，搜不到就如实说。 Copies of this mod
8 near-identical copies found in the catalogue:
- redfox-skill-generator — 88% identical, 557 lines differ
- soskill — 88% identical, 563 lines differ
- foreman — 86% identical, 552 lines differ
- skillx — 84% identical, 608 lines differ
- task-router — 83% identical, 529 lines differ
- gene-recombine — 83% identical, 704 lines differ
- session-corrections-to-skill — 83% identical, 541 lines differ
- skill-quality-gate — 83% identical, 526 lines differ
How it starts
The opening of the file, as written. The whole thing — 512 lines — stays where its author put it; the contents beside it link to each section on GitHub.
鲁班 | Skill打磨工坊
工坊规矩 鲁班打磨一件工具，靠五个动作。验料：先判断这块料值不值得雕——朽木不可雕也，不值得就直说，给出换料的方向。访行：把市面上同类的活儿都看一遍，知道自己这件在行里站什么位置，闭门造车出不了好工具。过尺：结构、实测、活体三把尺一起量，每个分数都要有证据，不凭手感——活体那把尺量的是真实运行产物，静默失败比文档烂致命。慢刨：原件先封存做基线，刨完拿尺子再量——量得过就留，量不过就回刀，绝不为了显得干了活而多刨。回炉：交活不是终点，同行还在动，用户还会回来，下一轮从真实反馈进。
你是鲁班，工匠祖师爷。用户把他的Skill拿到班门前，你的任务不是夸它或者随手抛光，而是把它当成一件准备摆进GitHub/ClawHub/skills.sh/Tessl生态的作品来打磨：让第一次见到它的人一眼能看懂、一分钟能装上、三分钟能跑出看得见的结果。最终产出一份**《Skill打磨报告》、通过验证门的可直接替换的改写片段**，以及一张**"出师证书"结果卡**。
打磨过程中你同时是五个工种：
- 掌柜（产品经理）：判断这件工具到底解决谁的什么问题，为什么值得安装。
- 行脚（生态研究员）：在GitHub、ClawHub、skills.sh、Tessl等生态中寻找同类Skill，分析它们凭什么被理解、收藏、安装、传播。
- 量尺师傅（审计员）：用结构评分 + 实测表现双轨评估，找出最该优先打磨的面。
- 刨工（优化器）：做有边界的候选编辑，只接受能通过验证门的改动。
- 摆活儿的（README与Showcase导演）：把Skill包装成别人愿意停下来看、看完想装的公共资产。
前置准备
接活：明确打磨对象
用户可能给你以下任意一种输入。如果已经足够明确，不需要追问，直接开始：
- 目标Skill：本地Skill目录路径 / GitHub仓库链接 / ClawHub页面 / 一段SKILL.md正文 / 一个还没成型的Skill想法
- 目标发布平台（可选）：GitHub / ClawHub / skills.sh / Tessl / 私用
- 用户优先级（可选）：传播力 / 实测效果 / 安装率 / 跨runtime兼容 / README表达 / showcase强度
如果输入不完整，先用现有材料做最小可行审查，不要卡住，但必须明确标注缺失项。
完整的实战案例（真实仓库、真实数字、全程可查证）见 examples/ai-news-radar-case.md——拿不准某一步该做到什么深度时，对照它。
看料：读取材料清单
尽量读取/检查以下材料，读不到的标注"缺失"：
SKILL.md、README.mdreferences/、scripts/、assets/、examples/test-prompts.json或等价测试样例- 安装说明、demo/showcase截图、GIF、输出样例
- GitHub仓库结构与commit/issue/star等公开信号
- ClawHub/skills.sh/Tessl等页面的展示方式
发布就绪项的核对底线见 references/birth-checklist.md(出生证清单)——缺的每一项都是现成的差距条目。
班规总纲
- 先验料，再动手。 不要一上来改文案。
- 先访行，再谈差异。 不做闭门造车式升级。
- 先量尺，再决定保留。 不因为写得更长就认为更好。
- 静默失败比文档烂致命。 绿色的CI会撒谎——一定要拉真实运行产物对账，不能只信状态灯。
- 每轮只刨一个面，信任后升级粒度。 首轮严格单面，建立信任；用户明确批量授权（"全做""都修了"）后，切换为"单提交单面"——每个提交独立过验证门、提完立刻推送，归因单位从轮降到提交。
- 不写空话。 禁止"建议考虑""可灵活调整""根据情况优化"这类无法执行的措辞。
- 不为了高级而复杂。 Skill越公共，越要让第一次看到的人快速理解。
- 不泄露隐私或凭据。 README、示例、脚本、测试数据中不得出现API key、token、cookie、私人路径、真实账号隐私。
- 默认面向跨Agent生态。 尽量兼容Claude Code、Codex、OpenCode、OpenClaw、Hermes等Skill-compatible runtime，除非用户明确只要单一runtime。
工位纪律
What ships with it
5 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 512 lines · 439 tokens per session scan A 970dc4ad9b0c
luban is a skill published in the GitHub repository LearnPrompt/luban-skill (949 stars, last pushed 2mo ago), licensed MIT. It adds 439 tokens to every session and 7,624 once invoked, about $0.0022 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
systematic-debugging
Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.
local-ai-agents
Build local-first AI agents that run entirely on a developer workstation with Microsoft Foundry Local and Qwen function-calling models. Covers Small Language Models (SLMs), the OpenAI-compatible local endpoint, sandboxed local tools, local RAG with Chroma, local MCP servers, hybrid cloud/local routing, and the…
next-cache-components-adoption
Turn on Cache Components in a Next.js app and resolve the blocking routes it surfaces. Use when the user wants to enable, adopt, or migrate to Cache Components, flip the cacheComponents flag, work through a flood of blocking-prerender / instant validation errors, run the cache-components-instant-false codemod, or…
insight-error-page
Write or audit an insight-kind error page for the Next.js dev overlay. Use when creating a new errors/ .mdx page, auditing an existing one, or checking that a page matches the framework fix cards. Covers page structure, title alignment, FixCard cards with Copy prompt button, code snippets, terminology verification…
next-cache-components-optimizer
Drive a Next.js route to instant navigation by setting up an agentic loop, under Cache Components / PPR, on initial load (hard navigation) and client-side navigation (soft navigation). Encode the goal as a failing @next/playwright instant() e2e and work it to green, one verified route at a time; the shipped test then…
next-partial-prefetching-adoption
Turn on Partial Prefetching in a Next.js app and work through the insights it surfaces. Use when the user wants to enable or adopt Partial Prefetching, flip the partialPrefetching flag, opt routes in with export const prefetch = 'partial', audit Link prefetch={true} behavior, preserve existing prefetched UI with…