Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Orkas-AI/Orkas-Awesome-AgentSkills --skill skill-static-reviewgit clone --depth 1 https://github.com/Orkas-AI/Orkas-Awesome-AgentSkillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/orkas-ai/orkas-awesome-agentskills/skill-static-review)<a href="https://agentmods.dev/skills/orkas-ai/orkas-awesome-agentskills/skill-static-review"><img src="https://agentmods.dev/badge/skills/orkas-ai/orkas-awesome-agentskills/skill-static-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/orkas-ai/orkas-awesome-agentskills/skill-static-review"><img src="https://agentmods.dev/badge/skills/orkas-ai/orkas-awesome-agentskills/skill-static-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00003 | $0.01541 |
| Opus 5 | $0.00002 | $0.00771 |
| Sonnet 5 | $0.00001 | $0.00308 |
| Haiku 4.5 | $0.00000 | $0.00154 |
Grade A, and why
skill-static-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 142 lines — stays where its author put it; the contents beside it link to each section on GitHub.
skill-static-review
何时使用
- 用户提供一个 skill 的说明文件、目录结构、脚本清单或完整包内容,希望判断它是否适合发布或进入动态评估。
- 用户要求检查 skill 是否存在结构混乱、边界不清、步骤不可执行、依赖不明、输出不可验证等问题。
- 用户希望得到一份可操作的质量评审报告,而不是泛泛评价。
不要用于:
- 实际运行 skill、执行动态 benchmark 或调用外部 verifier。
- 评审普通提示词、Agent 工作流或产品 PRD,除非用户明确要求按 skill 包标准做静态检查。
- 替用户直接重写整个 skill;本技能只输出审核结论和修改建议。
如何调用
- 收集待评审材料:至少需要 skill 的主说明文件;若有脚本、资源文件、目录树、示例输入输出,也一并读取。
- 识别 skill 的单一职责:判断它的目标领域、任务族、适用边界和反例边界是否清楚。
- 检查结构与规模:统计模块 / 文件数量,判断是否过度集中或过度拆分;确认是否包含使用条件、操作步骤、边界、示例、依赖说明。
- 检查程序化质量:逐步判断每个步骤是否原子化、可执行、具备前置 / 后置条件、失败路径和观察 → 决策准则;标记退化为事实性知识或宣传文案的部分。
- 检查验证器对齐:确认是否声明面向的 verifier 类型、输出格式是否能被稳定比对、是否暴露中间检查点。
- 检查来源与可信度:确认来源标签、版本 / 作者 / 更新时间、底层工具或 API 兼容说明是否存在;对 self-generated 或来源不明的内容提高风险等级。
- 检查 Agent 兼容性:按常见调用风格评估兼容性,例如 ReAct、代码生成型 Agent、CLI 型 Agent;说明最小模型能力和运行时依赖。
- 输出分级结论:给出通过 / 有条件通过 / 不建议发布,并按严重程度列出问题和改进动作。
返回格式
向用户返回一份结构化评审报告,包含:
{
"overall_result": "通过 | 有条件通过 | 不建议发布",
"score": {
"structure_and_size": "0-5",
"coverage_boundary": "0-5",
"procedural_quality": "0-5",
"verifier_alignment": "0-5",
"source_credibility": "0-5",
"agent_compatibility": "0-5"
},
"summary": "一句话总结主要质量状态",
"blocking_issues": [
{
"area": "问题所属维度",
"evidence": "来自材料的证据",
"impact": "为什么会影响使用或动态评估",
"fix": "必须修改的动作"
}
],
"improvement_suggestions": [
{
"priority": "高 | 中 | 低",
"suggestion": "具体建议",
"expected_effect": "修改后的收益"
}
],
"compatibility_matrix": [
{
"agent_type": "ReAct | code-gen | CLI | other",
"compatibility": "兼容 | 需改写 | 不兼容",
"notes": "原因"
}
],
"release_gate": {
"can_enter_dynamic_eval": true,
"required_before_release": ["发布前必须补齐的事项"]
}
}
如果材料不足,应明确列出缺失项,并只基于已提供材料给出临时结论。
外部依赖
- 无必需外部依赖。
- 若用户提供的是文件路径或目录,需要当前会话具备读取这些文件的权限。
- 若用户要求核查远程仓库、论文或网页来源,需要网络访问;网络不可用时只做本地材料评审。
限制与已知问题
- 静态评审不能证明 skill 真实有效,只能判断其是否具备进入动态测试的基本质量。
- 无法替代 deterministic verifier、单元测试、状态差异测试或真实任务轨迹评估。
- 对脚本正确性只能做结构与接口层面的审查;除非用户另行要求运行测试,否则不执行代码。
- 当材料只有摘要、截图或片段时,结论必须标注为低置信度。
- 对来源不明或自生成的 skill,应默认提示需要更强的测试证据。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 142 lines · 0 tokens per session scan A d4152ee700b7
skill-static-review is a skill published in the GitHub repository Orkas-AI/Orkas-Awesome-AgentSkills (13 stars, last pushed 2mo ago), licensed MIT. It adds 3 tokens to every session and 1,541 once invoked, about $0.0000 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
auto-review
A code-review skill that examines changed code using the TRUST 5 criteria and automated checks. It can review files, commit ranges, or changes assigned a risk level, with optional review strategies and providers.
check-mcp-json
Safely review, triage, repair, and merge ToolSDK MCP Registry package JSON pull requests. Use when an agent needs to validate files under packages/, detect duplicate registry keys, classify community PRs, make authorized fixes on contributor branches, close invalid or duplicate PRs, or squash-merge approved PRs.
ax-annotation
@AX code annotation workflow skill for agent-driven tag application.
ddd
A development method for improving existing code while preserving its current behavior. It follows an analyze, preserve, and improve cycle, using tests and small changes to reduce unintended effects.
contribute
Complete contribution workflow using git-town. Create branch → commit → PR → ship. Preflight at every step.
pre-ship-review
Run a structured quality review before shipping code at any checkpoint such as PRs, releases, or milestones. Use whenever the user says.