Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/macintog/codex-spine/skill-authoring-qualitynpx skills add macintog/codex-spine --skill skill-authoring-qualitygit clone --depth 1 https://github.com/macintog/codex-spineWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/macintog/codex-spine/skill-authoring-quality)<a href="https://agentmods.dev/skills/macintog/codex-spine/skill-authoring-quality"><img src="https://agentmods.dev/badge/skills/macintog/codex-spine/skill-authoring-quality.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00077 | $0.01934 |
| Opus 5 | $0.00039 | $0.00967 |
| Sonnet 5 | $0.00015 | $0.00387 |
| Haiku 4.5 | $0.00008 | $0.00193 |
Grade A, and why
skill-authoring-quality scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 171 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Skill Authoring Quality
Read the platform's current skill-creation guidance completely before creating or revising a skill. Use it for the authoring mechanics, then apply this governance and audit workflow.
Take these inputs:
- the complete candidate packet and, for external intake, its pinned source URL plus commit or digest
- realistic prompts that should and should not activate the skill
- the intended canonical source, discovery scope, distribution path, and private/public posture
- the observable completion criterion for each step or review claim
Produce either a review decision or the smallest owned revision, plus exact validation evidence and residual risks.
Audit The Packet
- Classify the request as review, create/revise, or external intake. For a
review, report findings without editing. For external intake, decide
adopt,adapt-pattern-only,reject, ornot_provenbefore installation or redistribution. - Read the whole packet and any directly routed resources. Classify it as repo-owned, plugin-owned, third-party, private-only, public-safe, or pattern-only. Preserve source and license provenance.
- Keep one skill focused on one workflow family. Start with instructions; introduce a script only when repeated code, deterministic behavior, or an external tool makes it worthwhile.
- Write imperative steps with explicit inputs, outputs, proof, stop conditions, and checkable completion criteria. Make exhaustive criteria name the full set that must be accounted for instead of inviting premature completion.
- Remove generic autonomy prose, repeated examples, and background that Codex already knows. Treat the repository, command help, and generated config as the source of truth; do not cache cheap lookups in instructions.
Check Metadata And Routing
- Use a lowercase hyphen-case name containing only letters, digits, and hyphens, no longer than 64 characters. Match the skill directory name exactly; namespace the name when that prevents ambiguity.
- Keep
SKILL.mdfrontmatter tonameanddescription. Front-load the description with the job and realistic trigger words, then state clear positive and negative boundaries. Put every activation rule in the description because the body loads only after activation. - Treat every always-loaded description or
AGENTS.mdpointer as a routing contract. Name the job and each genuinely distinct trigger branch once; collapse synonyms that spend context without adding a branch. - Budget context load separately from human cognitive load. Keep only the routing pointer always visible, then disclose branch-specific detail behind a direct reference when that detail is not needed for every invocation.
- Put UI-facing
display_name,short_description, anddefault_promptinagents/openai.yaml. Keep them aligned withSKILL.md; make the default prompt mention$skill-name. Add icons, brand color, invocation policy, or dependencies only when the task supplies them. - Test the description with realistic positive and negative prompts. Confirm the positive prompts select the skill for a governance need and the negative prompts route generic mechanics to the platform authoring guidance or leave unrelated work alone.
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 171 lines · 77 tokens per session scan A fff01b13100f
skill-authoring-quality is a skill published in the GitHub repository macintog/codex-spine (9 stars, last pushed 5d ago), licensed MIT. It adds 77 tokens to every session and 1,934 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
bensz-rmd-rules
规范 AI 开发 R Markdown 分析脚本的行为准则。当用户要求"写 Rmd 分析"、"开发 R 脚本"、"做数据分析"时触发。核心原则:遵循主业与副业分离架构(.R 保留完整数据,.Rmd 应用业务阈值),优先使用用户已有 R 包资源;图表默认按 Nature 级别可读性与出版质量生成;专家级解读兼顾弱背景读者,提供四层框架、指标导读与不常用指标首次解释协议;路径验证确保跨平台兼容性。前提:luckyBase 为硬依赖。.
auto-test-project
当用户明确要求"测试项目"、"运行 auto-test-project"或"进行项目级测试"时使用。对完整项目进行多轮 A 轮批判性测试 + B 轮质量检查,系统化发现、记录、修复问题。⚠️ 不适用:用户只是想优化功能(应直接修改)、只是询问项目问题(应直接回答)、没有明确"测试"意图。.
auto-test-skill
当用户明确要求"测试技能"、"运行 auto-test"或"进行批判性测试"时使用。通过多轮 A 轮批判性测试 + B 轮质量原则检查,系统化发现、记录、修复问题,并沉淀可追溯的 .bensz-api/task-{yyyymmdd-hhmm}-{简短描述}/auto-test-skill/output/plans/ 与 .bensz-api/task-{yyyymmdd-hhmm}-{简短描述}/auto-test-skill/output/tests/ 文档。⚠️ 不适用:用户只是想优化功能(应直接修改)、只是询问技能问题(应直接回答)、没有明确"测试"意图。.
git-commit
当用户明确要求"提交 Git 改动"、"生成 commit 信息"或"创建 git commit"时使用。仅用 Git 分析改动并自动生成 conventional commit 信息(可选 emoji);必要时建议拆分提交,默认运行本地 Git 钩子(可 --no-verify 跳过),提交后默认自动 push(可 --no-push 跳过)。.
git-pr-review
当用户明确要求“review 某个 GitHub PR”“评估某个 pull request 是否值得 merge”“帮我判断这个 PR 怎么处理”时使用。基于用户提供的 GitHub 仓库地址、PR 编号/链接和补充说明,进行只读、证据驱动的 PR 审查:理解 PR 解决的问题、评估方案优劣与局限、默认优先使用内置“好 PR”标准并在必要时联网补充、识别恶意或高风险改动,并输出是否建议 merge 的 Markdown 决策报告。⚠️ 不适用:用户要你直接修改 PR 代码、直接 merge PR、或在本地执行 PR 分支中的不可信代码。.
download-fulltext-pdf
当用户明确要求"下载文献全文"或"获取论文PDF"时使用。通过 DOI 号下载学术论文全文 PDF,支持 arXiv、Sci-Hub、Unpaywall、期刊官网等多源策略。⚠️ 不适用:用户只是想解析或处理已有的 PDF 文件(应使用 pdf skill)、只是想搜索论文信息而无需下载全文、没有提供 DOI/标题/BibTeX 任何标识符。.