Borrowing it
Nothing to install: this file belongs to monarch-initiative/dismech. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/monarch-initiative/dismech/main/.claude/skills/review-hypothesis-exploration/SKILL.mdgit clone --depth 1 https://github.com/monarch-initiative/dismechWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/monarch-initiative/dismech/review-hypothesis-exploration)<a href="https://agentmods.dev/skills/monarch-initiative/dismech/review-hypothesis-exploration"><img src="https://agentmods.dev/badge/skills/monarch-initiative/dismech/review-hypothesis-exploration/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/monarch-initiative/dismech/review-hypothesis-exploration"><img src="https://agentmods.dev/badge/skills/monarch-initiative/dismech/review-hypothesis-exploration.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Output Handling · line 64 Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.Fix: Validate and sanitize all model output before using it in downstream contexts. Use parameterized queries for SQL, shell quoting for commands, and HTML encoding for web output.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00066 | $0.01950 |
| Opus 5 | $0.00033 | $0.00975 |
| Sonnet 5 | $0.00013 | $0.00390 |
| Haiku 4.5 | $0.00007 | $0.00195 |
Grade A, and why
review-hypothesis-exploration scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 139 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Review Hypothesis Exploration
Treat a provider report as a research lead, not as a source of truth. Assess the report's reasoning and claims without automatically promoting its claims into a disorder YAML.
Assess one report
- Locate the raw report at
kb/hypotheses/<Disease>/<hypothesis_id>/<provider>.mdand identify the hypothesis directory, provider slug, and any provider artifact bundle. Read the report and inventory before judging the run. - Inventory every material data source in
data_sources, including databases searched with no result. DistinguishCITED_NOT_ACCESSED,ACCESSED,SEARCHED_NO_RESULT, andUNVERIFIABLE; a proposed future dataset is not an accessed input. Preserve a committed query/response or search-log artifact forACCESSEDandSEARCHED_NO_RESULT. Verify each accession withjust verify-datasets --accession <CURIE>where supported, then separately check disease, tissue, cohort, organism, and assay relevance. Resolution does not establish relevance. - Inventory every claimed computation in
analyses. Trace input data-source IDs through method, software/version, parameters, code/environment, and outputs to the assessment claims the report attributes to that analysis; status and auditability determine whether execution actually supports them. UseSUCCEEDEDonly when inspectable artifacts substantiate execution; otherwise usePARTIAL,REPORTED_ONLY,FAILED, orSKIPPEDas appropriate. - Treat tool availability and fallback as evidence-quality facts. If retrieval,
a data lake, or a scientific tool failed, record the failure and any fallback;
do not silently treat a literature-only or model-knowledge fallback as a
provider analysis or independent result. Biomni is disabled at repository
entry points unless
DISMECH_ENABLE_BIOMNI=1; do not bypass that opt-in. Without it, Biomni must also remain unavailable to automatic provider fallback. The hypothesis runner's dry-run command inspection is safe without the opt-in. - Check the report's consequential claims against the cited primary literature. Distinguish direct support, external plausibility, qualification, and contradiction. Check taxonomic level, disease/model context, directionality, and causal versus correlational language.
- Create one authoritative YAML sidecar per provider and assessor at
assessments/<provider>-assessment-by-<assessor>.yaml. Use a lowercase, hyphenated assessor slug (for example,openai-5-pro). - Include the relative
source_report,hypothesis_id, an overall verdict, and claim-level dispositions. For every assessment claim, use a shortreport_quotecopied verbatim from the provider report and explain the assessment inrationale; attachanalysis_idsonly to claims the report attributes to those analyses, and use status/auditability to state whether execution supports them. - Add an optional Markdown narrative and/or PDF using the same stem when it
helps human review. The YAML remains authoritative; the rendered artifacts
must be listed in
artifacts. - Apply the hypothesis artifact policy in
docs/hypothesis-report-assessments.md: commit manifests, code, environment specifications, and small derived outputs; keep large/raw, controlled, or credential-bearing data outside Git and record whether each artifact is committed, external, local-only, missing, or not produced. Structured paths must be non-empty files beneathartifact_root: ../<provider>_artifacts. For a computational bundle, require canonicalMANIFEST.yaml, runjust validate-hypothesis-analysis-run <report> <artifact_dir>, and replay the saved code separately; the validator does not execute generated code. Confirm that report frontmatter has anartifact_manifest_sha256binding to the exact current manifest bytes; a manifest edit makes an older report stale. If you correct provider code or results after its response, record the exact correction and before/after hashes in the manifest, replay it independently, and keep the provider analysis at mostPARTIALuntil the provider reruns or attests the corrected bytes. Never stamp a stale provider report onto an assessor-corrected bundle merely to make the gate pass. - Keep a report-review citation as context only. Promote a paper-derived claim
to the disease YAML only after normal reference-cache and evidence validation.
Never hand-edit
references_cache/*.md; usejust fetch-reference <ID>. - Validate the sidecar:
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago Changed · +97 lines · +16 tokens per session d0899912f215
- 12d ago First seen · 42 lines · 50 tokens per session scan A 4a83a8794d4e
review-hypothesis-exploration is a skill published in the GitHub repository monarch-initiative/dismech (61 stars, last pushed today), licensed BSD-3-Clause. It adds 66 tokens to every session and 1,950 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
robot-obo-tool
Skills for using ROBOT, the OBO ontology command-line toolkit for reasoning, template-based term creation, quality control, format conversion, and ontology manipulation. Use this when working with OWL/OBO ontologies that need automated processing.
dosdp-design-patterns
Skills for understanding and applying DOSDP (Dead Simple Ontology Design Patterns) to ensure consistent ontology term creation and maintenance. This skill is about recognizing patterns and ensuring consistency, not using dosdp-tools directly.
editing-obo-ontologies
Skills and tools for editing OBO format ontologies, including querying terms, checking out/checking in individual terms, and following OBO format conventions. Do not use this if the source for the ontology you are editing is not in obo format (e.g. ofn).
ontology-access-kit
Skills for querying ontologies using the Ontology Access Kit (OAK). This should only be used for complex ontology operations, for basic external ontology searching use the OLS MCP.
cuopt-numerical-optimization-formulation
LP, MILP, QP — concepts, problem-text parsing, and formulation patterns (parameters, constraints, decisions, objective). Concepts only; no API.
nemo-mbridge-perf-expert-parallel-overlap
Validate and use MoE expert-parallel communication overlap in Megatron-Bridge, including overlapmoeexpertparallelcomm, delaywgradcompute, and flex dispatcher backends such as DeepEP and HybridEP.