Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add s977043/river-review --skill closure-scope-retentiongit clone --depth 1 https://github.com/s977043/river-reviewWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/s977043/river-review/closure-scope-retention)<a href="https://agentmods.dev/skills/s977043/river-review/closure-scope-retention"><img src="https://agentmods.dev/badge/skills/s977043/river-review/closure-scope-retention/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/s977043/river-review/closure-scope-retention"><img src="https://agentmods.dev/badge/skills/s977043/river-review/closure-scope-retention.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00046 | $0.01856 |
| Opus 5.5 | $0.00018 | $0.00742 |
| Sonnet 5.5 | $0.00009 | $0.00371 |
| Haiku 4.5 | $0.00005 | $0.00186 |
Grade A, and why
Closure Scope Retention Guard scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 98 lines — stays where its author put it; the contents beside it link to each section on GitHub.
由来: Claude Code の
/simplify（Efficiency 観点の closure 保持）に由来（inspired by）。Issue #1452 P3 で、skills/agent-skills/river-review-code/references/SIMPLIFY.mdから closure スコープ保持の詳細検出を本 registry skill へ委譲した。
Pattern declaration
Primary pattern: Reviewer Secondary patterns: Inversion Why: 長寿命オブジェクトの closure 保持をチェックリストで評価するが、保持の証拠が差分に無い変更では実行しない。
Goal / 目的
- 長寿命オブジェクト（キャッシュ・リスナー・シングルトン・戻り値として保存されるオブジェクト）が、closure/環境キャプチャで enclosing scope 全体（大きな配列・一時バッファ等）を生存させ続けるメモリ保持を防ぐ。
- 必要なフィールドだけをコピーする形（class / 明示フィールド化 / 縮約済み構造）を促す。
Non-goals / 扱わないこと
- correctness bug・セキュリティ欠陥は対象外（bug 系・security 系観点の責務）。
- 短命な関数スコープ内で完結し、戻り後に到達不能になる一時変数は対象外。
- 一般的なパフォーマンス最適化論（ホットパスの計算量など）は SIMPLIFY 側 Efficiency の残余に委ねる。
applyTo に scripts/** と runners/** を含める理由
applyTo の各 glob は拡張子で境界付けした midstream ソース限定（scoping ガイド「midstream (application source)」の範囲内）である。長寿命 singleton / キャッシュは src/ に限らず scripts/・runners/ の常駐プロセス・起動パスにも生じ得るため、SIMPLIFY の applyTo 経路差を解消する目的で実行コードを持つ3ルートを対象にする。tests/**・docs/**・dist/** は含めない。
Pre-execution Gate / 実行前ゲート
このスキルは以下の条件がすべて満たされない限り NO_REVIEW を返す。dispatcher 経路では Gate が強制されないため、実行時に本文の Gate を必ず自己適用する。
- 差分にリポジトリ内で実行されるコード（
src//scripts//runners/配下の.ts/.tsx/.js/.jsx/.mjs/.cjs）の変更が含まれている。 - 差分に長寿命オブジェクト（module-level singleton・キャッシュ・登録されるリスナー・戻り値として保存されるオブジェクト）を closure/環境キャプチャで構築する証拠が含まれている。
- その closure が enclosing scope の大きなデータ（ファイル全文・大配列・一時バッファ・パース済みドキュメント群）を到達可能に保っている証拠がある。
-
inputContextにdiffが含まれている。
ゲート不成立時の出力: NO_REVIEW: closure-scope-retention — 長寿命オブジェクトによる大きな scope の closure 保持が差分に検出されない
False-positive guards / 抑制条件
Gate を通過した上で、以下は指摘しない（黙る）。
- 即時縮約して解放されるケース: 大きなデータを読み込んでも、その場で必要フィールドだけを小さな構造（Map・plain object・プリミティブ）へコピーし、関数リターン後に元データが到達不能（GC 可能）になる場合。closure が元データを掴んでいないなら保持は起きない。
- 短命なオブジェクト（同一 tick / 同一リクエスト内で破棄される）に対する保持は対象外。
- 保持しているデータが小さい（数十 KB 未満が明らかな）場合。
- 指摘行（finding の
file:line）が差分内に無い場合。
Rule / ルール
- 長寿命オブジェクトを組み立てる closure が、必要な小さいフィールドだけでなく enclosing scope の大きな変数（
rawText・documents・allEntries等）を参照し続けていないか。 - アクセサ（メソッド）が閉じ込めた大きな配列を毎回線形探索する等、縮約すれば済む構造を大きいまま抱えていないか。
- 修正案は「必要なフィールドだけをコピーする」形を具体的に示す（例:
id -> severityのMapを事前構築し、closure は大きな元データを掴まない）。
What ships with it
9 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- eval/promptfoo.yaml 1.3 KB
- fixtures/01-singleton-closure-happy.diff 1.3 KB
- fixtures/01-singleton-closure-happy.md 2.2 KB
- fixtures/02-immediate-reduce-false-positive.diff 839 B
- fixtures/02-immediate-reduce-false-positive.md 1.4 KB
- golden/01-singleton-closure-happy.md 646 B
- golden/02-immediate-reduce-false-positive.md 345 B
- prompt/system.md 4.0 KB
- prompt/user.md 2.2 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 98 lines · 46 tokens per session scan A b4de95c44186
Closure Scope Retention Guard is a skill published in the GitHub repository s977043/river-review (7 stars, last pushed 2d ago), licensed MIT. It adds 46 tokens to every session and 1,856 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
review-all
Multi-agent code review for diffs (project-agnostic). Covers standards, bugs, security, DRY, smells, perf, tests, API contracts, a11y/i18n. Verifies each finding to eliminate false positives. Use for /review-all, pre-PR/pre-commit review, or auditing uncommitted/staged changes.
logic-review
Find logic bugs in a single file or function via semi-formal execution tracing (Premises → Trace → Divergence → Trigger → Remedy). Trigger when a user shares code and suspects something is wrong without naming a concrete failure — phrases like "review this", "does this look right", "check this function", "audit this…
logic-fix-all
Autonomous repository-wide audit-and-fix pipeline: health → review → locate/explain → fix → diff-verify → iterate until clean. Starts with a mandatory consent prompt (token-intensive); after consent runs hands-free. Trigger when the user wants ALL logic issues found and fixed — "fix everything", "fix all logic…
logic-health
Sweep a directory, module, or full codebase for logic correctness and produce a scored health dashboard with systemic patterns. Trigger when the user requests a health view — "audit the whole codebase", "health check", "health overview", "logic health overview", "audit src/", "audit auth and payments modules", "where…
logic-locate
Locate the root cause of a CONFIRMED failure via backward-then-forward semi-formal tracing. Trigger when the user provides a stack trace, failing assertion, error message, or specific wrong-value observation — "find the bug", "this test is failing", "track down this crash", "why is this test failing", "KeyError at…
logic-explain
Explain what a specific piece of code actually does for a given input by producing a step-by-step execution trace (interprocedural, with name resolution and type transitions). Trigger when the user is confused about behavior or asks why code produces X instead of Y — "walk me through this", "trace through X with input…