Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Orkas-AI/Orkas-Awesome-AgentSkills --skill skill-static-reviewgit clone --depth 1 https://github.com/Orkas-AI/Orkas-Awesome-AgentSkillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/orkas-ai/orkas-awesome-agentskills/skill-static-review)<a href="https://agentmods.dev/skills/orkas-ai/orkas-awesome-agentskills/skill-static-review"><img src="https://agentmods.dev/badge/skills/orkas-ai/orkas-awesome-agentskills/skill-static-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/orkas-ai/orkas-awesome-agentskills/skill-static-review"><img src="https://agentmods.dev/badge/skills/orkas-ai/orkas-awesome-agentskills/skill-static-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00003 | $0.01541 |
| Opus 5.5 | $0.00001 | $0.00616 |
| Sonnet 5.5 | $0.00001 | $0.00308 |
| Haiku 4.5 | $0.00000 | $0.00154 |
Grade A, and why
skill-static-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 142 lines — stays where its author put it; the contents beside it link to each section on GitHub.
skill-static-review
何时使用
- 用户提供一个 skill 的说明文件、目录结构、脚本清单或完整包内容,希望判断它是否适合发布或进入动态评估。
- 用户要求检查 skill 是否存在结构混乱、边界不清、步骤不可执行、依赖不明、输出不可验证等问题。
- 用户希望得到一份可操作的质量评审报告,而不是泛泛评价。
不要用于:
- 实际运行 skill、执行动态 benchmark 或调用外部 verifier。
- 评审普通提示词、Agent 工作流或产品 PRD,除非用户明确要求按 skill 包标准做静态检查。
- 替用户直接重写整个 skill;本技能只输出审核结论和修改建议。
如何调用
- 收集待评审材料:至少需要 skill 的主说明文件;若有脚本、资源文件、目录树、示例输入输出,也一并读取。
- 识别 skill 的单一职责:判断它的目标领域、任务族、适用边界和反例边界是否清楚。
- 检查结构与规模:统计模块 / 文件数量,判断是否过度集中或过度拆分;确认是否包含使用条件、操作步骤、边界、示例、依赖说明。
- 检查程序化质量:逐步判断每个步骤是否原子化、可执行、具备前置 / 后置条件、失败路径和观察 → 决策准则;标记退化为事实性知识或宣传文案的部分。
- 检查验证器对齐:确认是否声明面向的 verifier 类型、输出格式是否能被稳定比对、是否暴露中间检查点。
- 检查来源与可信度:确认来源标签、版本 / 作者 / 更新时间、底层工具或 API 兼容说明是否存在;对 self-generated 或来源不明的内容提高风险等级。
- 检查 Agent 兼容性:按常见调用风格评估兼容性,例如 ReAct、代码生成型 Agent、CLI 型 Agent;说明最小模型能力和运行时依赖。
- 输出分级结论:给出通过 / 有条件通过 / 不建议发布,并按严重程度列出问题和改进动作。
返回格式
向用户返回一份结构化评审报告,包含:
{
"overall_result": "通过 | 有条件通过 | 不建议发布",
"score": {
"structure_and_size": "0-5",
"coverage_boundary": "0-5",
"procedural_quality": "0-5",
"verifier_alignment": "0-5",
"source_credibility": "0-5",
"agent_compatibility": "0-5"
},
"summary": "一句话总结主要质量状态",
"blocking_issues": [
{
"area": "问题所属维度",
"evidence": "来自材料的证据",
"impact": "为什么会影响使用或动态评估",
"fix": "必须修改的动作"
}
],
"improvement_suggestions": [
{
"priority": "高 | 中 | 低",
"suggestion": "具体建议",
"expected_effect": "修改后的收益"
}
],
"compatibility_matrix": [
{
"agent_type": "ReAct | code-gen | CLI | other",
"compatibility": "兼容 | 需改写 | 不兼容",
"notes": "原因"
}
],
"release_gate": {
"can_enter_dynamic_eval": true,
"required_before_release": ["发布前必须补齐的事项"]
}
}
如果材料不足,应明确列出缺失项,并只基于已提供材料给出临时结论。
外部依赖
- 无必需外部依赖。
- 若用户提供的是文件路径或目录,需要当前会话具备读取这些文件的权限。
- 若用户要求核查远程仓库、论文或网页来源,需要网络访问;网络不可用时只做本地材料评审。
限制与已知问题
- 静态评审不能证明 skill 真实有效,只能判断其是否具备进入动态测试的基本质量。
- 无法替代 deterministic verifier、单元测试、状态差异测试或真实任务轨迹评估。
- 对脚本正确性只能做结构与接口层面的审查;除非用户另行要求运行测试,否则不执行代码。
- 当材料只有摘要、截图或片段时,结论必须标注为低置信度。
- 对来源不明或自生成的 skill,应默认提示需要更强的测试证据。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 142 lines · 0 tokens per session scan A d4152ee700b7
skill-static-review is a skill published in the GitHub repository Orkas-AI/Orkas-Awesome-AgentSkills (13 stars, last pushed 3mo ago), licensed MIT. It adds 3 tokens to every session and 1,541 once invoked, about $0.0000 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
check-mcp-json
Safely review, triage, repair, and merge ToolSDK MCP Registry package JSON pull requests. Use when an agent needs to validate files under packages/, detect duplicate registry keys, classify community PRs, make authorized fixes on contributor branches, close invalid or duplicate PRs, or squash-merge approved PRs.
code-reviewer
Activates CodeReviewer for systematic, multi-dimensional code review. Use when you need a pull request reviewed for correctness, security vulnerabilities, performance bottlenecks, architectural quality, test coverage gaps, or maintainability issues. Produces a structured review with severity-labeled findings and…
github-intelligence
Activates GitHubIntelligence for repository analysis, contributor intelligence, and open source strategy. Use when you need to analyze a GitHub repository for code quality and activity health, identify key contributors and bus factor risk, build a competitive open source landscape analysis, design a contributor…
team-qa
QA/QC agent. Reads ALL pipeline artifacts (BA + TechLead + PM + BE + FE + Tester) and produces quality-report.md, compliance-check.md, and sign-off.md. Declares Gate 3: Release Sign-off (advisory only — operator has final authority). Part of the Virtual Team Skill pipeline.
ck:quality
Independent senior-engineering quality auditor — architecture, ownership, domain integrity, abstraction, and maintainability. Use as --gate inside the ck:cook pipeline (blocks a phase on BLOCKER/HIGH/current-change MEDIUM findings) or call directly with --audit, --diff, --changed on any repository, directory, or file.…
code-review
Always use this skill before claiming any work is done, fixed, passing, or complete — even if it seems obvious. Also use when receiving code review feedback from any source (human or automated), when finishing a task or major feature, before committing or creating a PR, or when about to express satisfaction with work.…