Skills Hub is a cross-platform desktop application for installing, organizing, updating, and syncing Agent Skills across AI coding tools. Developers use it to maintain one central skill library and distribute selected skills to tools such as Claude Code, Codex, Cursor, OpenCode, and Antigravity. Its catalogue instructions describe how to work with the managed skills.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add qufei1993/skills-hub --skill dsh-code-reviewgit clone --depth 1 https://github.com/qufei1993/skills-hubWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/qufei1993/skills-hub/dsh-code-review)<a href="https://agentmods.dev/skills/qufei1993/skills-hub/dsh-code-review"><img src="https://agentmods.dev/badge/skills/qufei1993/skills-hub/dsh-code-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/qufei1993/skills-hub/dsh-code-review"><img src="https://agentmods.dev/badge/skills/qufei1993/skills-hub/dsh-code-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00046 | $0.00676 |
| Opus 5.5 | $0.00018 | $0.00270 |
| Sonnet 5.5 | $0.00009 | $0.00135 |
| Haiku 4.5 | $0.00005 | $0.00068 |
Grade A, and why
dsh-code-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
按真实行为要求审查代码
阅读项目上下文、验证证据以及改动区域的实际需求。除非用户要求修复，否则保持只读。未经用户授权，不向外部发布审查意见。
- 明确准确的基线与目标提交，或本地差异及暂存、未暂存等修改层。审查远端 PR 时获取其当前引用；目标分支或内容更新后重新确认。
- 将变化的接口对应到实际数据提供方和调用方。判断差异前，阅读周边代码、相关决策和项目必需检查。
- 优先检查正确性、安全、生命周期和必需行为是否损坏。资源或错误处理变化读生命周期；异步测试读测试可靠性；可见界面读UI；文字变更读文档写作。默认值、校验、依赖或抽象变化读编码规范；覆盖率或测试设计问题读测试选择。
- 追踪校验是否真正保护了目标操作，包括其他入口和直接调用方。检查边界值、最终输出或保留内容的大小，计入元数据和多字节文本。核实取消、部分成功、资源释放和派生状态。
- 检查实际交付入口、公开导出、构建是否为当前版本以及真实测试证据。重要结果应有独立断言，新增约束应有会失败的错误样例。检查全绿或作者自述不能代替语义审查，也不要无故重跑无关的高成本检查。
- 检查必要性：每个抽象、兼容分支和通用 API 都应有当前行为要求或调用方。不要仅凭文本搜索结果猜测并移除受支持行为。
- 确认当前文档、默认值、错误和界面文字与代码一致。翻译改动已经在范围内时检查含义，不自行启动翻译任务。
只报告可采取行动的问题，包含文件和行号、具体触发条件、影响及证据。区分缺陷与可选建议，不为凑数量而编造问题。没有充分依据的问题时直接说明，并指出重要覆盖限制。审查发现不等于获得修改或推送权限。
报告验证结果前，将每项“已经执行”的说法对应到真实工具调用和结果。代码推理可以支持发现，无需假称执行过测试；标明这是静态检查。建议检查写“未运行”，用户提供的历史日志注明来源。不得编造成功命令或工具拒绝。
What ships with it
12 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- agents/openai.yaml 292 B
- LICENSE 1.1 KB
- NOTICE 429 B
- references/code-conventions.md 3.1 KB
- references/evidence.md 2.2 KB
- references/lifecycle.md 1.6 KB
- references/project-context.md 1.3 KB
- references/prose.md 1.2 KB
- references/test-reliability.md 1.2 KB
- references/test-strategy.md 3.0 KB
- references/ui.md 1.2 KB
- UPSTREAM.json 4.2 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 21 lines · 46 tokens per session scan A 583ad77ee841
dsh-code-review is a skill published in the GitHub repository qufei1993/skills-hub (1,861 stars, last pushed 5d ago), licensed MIT. It adds 46 tokens to every session and 676 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-31.
dsh-code-review compared with skills from other repositories
| Mod | Type | Stars | Last push | Licence | Scan | Tokens | Works with |
|---|---|---|---|---|---|---|---|
| dsh-code-reviewqufei1993/skills-hub | Skill | 1.9k | 5d ago | MIT | A | 46 | Codex |
| agentbro-pr-mergeshirenchuang/agentbro | Skill | 166 | 1mo ago | Apache-2.0 | A | 38 | Claude Code, Codex |
| architect-boundary-reviewjoinwell52-AI/CodeFlowMu-open | Skill | 2 | 2mo ago | MIT | A | 52 | Claude Code, Codex |
| tm-review-routingjoinwell52-AI/CodeFlowMu-open | Skill | 2 | 2mo ago | MIT | A | 48 | Claude Code, Codex |
| eval-observation-writingjoinwell52-AI/CodeFlowMu-open | Skill | 2 | 2mo ago | MIT | A | 46 | Claude Code, Codex |
| eval-risk-gap-analysisjoinwell52-AI/CodeFlowMu-open | Skill | 2 | 2mo ago | MIT | A | 40 | Claude Code, Codex |
| go-testingGentleman-Programming/gentle-ai | Skill | 8.4k | yesterday | MIT | A | 26 | Claude Code, Codex |