Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Liuziyu77/gene-skill --skill taleb-risk-toolgit clone --depth 1 https://github.com/Liuziyu77/gene-skillWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/liuziyu77/gene-skill/taleb-risk-tool)<a href="https://agentmods.dev/skills/liuziyu77/gene-skill/taleb-risk-tool"><img src="https://agentmods.dev/badge/skills/liuziyu77/gene-skill/taleb-risk-tool/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/liuziyu77/gene-skill/taleb-risk-tool"><img src="https://agentmods.dev/badge/skills/liuziyu77/gene-skill/taleb-risk-tool.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00149 | $0.01912 |
| Opus 5 | $0.00075 | $0.00956 |
| Sonnet 5 | $0.00030 | $0.00382 |
| Haiku 4.5 | $0.00015 | $0.00191 |
Grade A, and why
taleb-risk-tool scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 163 lines — stays where its author put it; the contents beside it link to each section on GitHub.
塔勒布式风险审查
大多数风险分析工具问:「发生的概率是多少?」
这个 Skill 优先问:「如果最坏情况发生,谁会真正受到伤害?」——然后才讨论概率。
触发条件
- 评估一项决策、投资、产品发布或策略的风险
- 需要从「标准风险清单」之外找到被忽视的真实威胁
- 用户怀疑某个「稳健的计划」可能有隐藏的尾部风险
- 需要给投资人/管理层写一份「诚实的风险报告」
核心工作流(T1)
Phase 0:凸性初筛(塔勒布先行)
在任何系统性分析之前,先做三个快速判断:
Q1:这个决策是「凹性」还是「凸性」的?
凹性(危险):出现好的结果时收益有限,出现坏的结果时损失灾难性
→ 例:以全部身家做单笔投注
凸性(安全):坏的结果损失有限,好的结果收益无限
→ 例:小额多次探索性投资
如果是凹性决策 → 立刻标记高风险,Phase 1 重点分析极端情景。 如果是凸性决策 → 正常推进,关注上行潜力。
Q2:谁有「皮肤在场」?(突变基因 M1 预激活) 做这个决策的人,是否会承担失败的后果? 如果决策者和后果承担者不是同一批人 → 这是最大的隐藏风险来源,优先分析。
Q3:这是罕见事件域还是中等波动域? 影响钱包的事(正态分布)vs 影响生存的事(幂律分布)。 生存性事件没有「平均情景」,只有「能活下去」和「不能活下去」。
Phase 1:系统性风险维度扫描(工具纪律)
按以下维度逐一检查(来自 risk-analyzer,确保不遗漏):
| 维度 | 检查问题 |
|---|---|
| 市场风险 | 极端市场条件下(2008/2020级别)这个决策如何? |
| 流动性风险 | 最需要现金的时候,这个资产能立刻变现吗? |
| 对手风险 | 依赖的关键第三方(供应商/合作方/平台)如果消失怎么办? |
| 监管风险 | 政策最坏情景是什么?有没有「被追溯」的可能? |
| 操作风险 | 人的失误 + 系统故障 + 流程漏洞 |
| 相关性风险 | 看起来分散的风险,在极端情景下是否会同时爆发? |
| 尾部风险 | 概率 < 5% 但发生了就是灾难性的,有哪些? |
Phase 2:塔勒布式深度审查(4 个核心问题)
问题 1:专家都不担心什么?(来自塔勒布的「专家怀疑」) 如果所有分析师都说「这个风险可控」,那就是最需要警惕的时候。共识本身是风险信号。
问题 2:这个系统上次在极端情景下的表现如何? 没有被极端事件测试过的系统,是脆弱的。找到历史上最接近的极端情景,复盘。
问题 3:谁在这个风险中获益? 总有人从风险实现中获益。找到他们,理解他们的激励,评估他们是否有动机让风险实现。
问题 4:如果这个判断错了,在哪里会最先看到信号? 定义「早期预警指标」——当这些指标出现,立刻重新评估,不要等到灾难发生。
Phase 3:输出报告
报告结构(结构化输出,来自 risk-analyzer):
## 风险审查报告:[决策名称]
### 凸性初筛结论
[凹性/凸性判断] + [皮肤在场情况] + [事件域类型]
### 关键风险(按严重性排序)
1. [最严重风险]:[描述] | 发生概率 [低/中/高] | 后果 [可控/严重/灾难性]
→ 缓解措施:____
2. ...
### 尾部风险专项
[概率低但后果灾难性的风险列表,重点!]
### 被忽视的风险(专家共识中没有的)
[来自 Phase 2 问题 1 的发现]
### 早期预警指标
- [信号 1]:出现时意味着 [风险 X] 正在实现
- [信号 2]:...
### 总体判断
[凸性/凹性] + [建议:继续/修改结构/暂停]
突变基因(M1):皮肤在场检验
来自:逆向突变(将「谁在承担后果」从隐性假设变为显性第一步)
原则:「没有皮肤在场的人的建议,是免费的期权——他们赚了就夸你,亏了算你自己的事。」——塔勒布
操作: 在开始任何风险分析之前,先建立「皮肤在场矩阵」:
| 决策参与者 | 决策权重 | 若成功:获益? | 若失败:受损? | 皮肤在场? |
|---|---|---|---|---|
| 决策A | 高 | 是 | 是 | ✅ |
| 顾问B | 中 | 否(只收咨询费) | 否 | ❌ 高风险意见来源 |
| 投资人C | 低 | 是(上行无限) | 有限(有限责任) | ⚠️ 不对称 |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 163 lines · 149 tokens per session scan A e25b7d6cb00b
taleb-risk-tool is a skill published in the GitHub repository Liuziyu77/gene-skill (56 stars, last pushed 4mo ago), licensed MIT. It adds 149 tokens to every session and 1,912 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
systematic-debugging
Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.
local-ai-agents
Build local-first AI agents that run entirely on a developer workstation with Microsoft Foundry Local and Qwen function-calling models. Covers Small Language Models (SLMs), the OpenAI-compatible local endpoint, sandboxed local tools, local RAG with Chroma, local MCP servers, hybrid cloud/local routing, and the…
next-cache-components-adoption
Turn on Cache Components in a Next.js app and resolve the blocking routes it surfaces. Use when the user wants to enable, adopt, or migrate to Cache Components, flip the cacheComponents flag, work through a flood of blocking-prerender / instant validation errors, run the cache-components-instant-false codemod, or…
chat-pet-sprite-creation
Use when creating or changing VS Code chat pet sprite art, sprite sheets, state animations, eye treatments, Stable/Insiders variants, or pet transitions under src/vs/workbench/contrib/chat/browser/widget/media/chatPet.
cpu-profile-analysis
Analyze V8/Chrome CPU profiles (.cpuprofile) and DevTools trace files (Trace-.json). Use when: profiling performance, investigating slow functions, comparing code paths, finding bottlenecks, analyzing timeToRequest, understanding call trees from sampling profiler data, analyzing layout/paint/rendering, investigating…
insight-error-page
Write or audit an insight-kind error page for the Next.js dev overlay. Use when creating a new errors/ .mdx page, auditing an existing one, or checking that a page matches the framework fix cards. Covers page structure, title alignment, FixCard cards with Copy prompt button, code snippets, terminology verification…