Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add s977043/river-review --skill closure-scope-retentiongit clone --depth 1 https://github.com/s977043/river-reviewWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/s977043/river-review/closure-scope-retention)<a href="https://agentmods.dev/skills/s977043/river-review/closure-scope-retention"><img src="https://agentmods.dev/badge/skills/s977043/river-review/closure-scope-retention/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/s977043/river-review/closure-scope-retention"><img src="https://agentmods.dev/badge/skills/s977043/river-review/closure-scope-retention.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00046 | $0.01856 |
| Opus 5 | $0.00023 | $0.00928 |
| Sonnet 5 | $0.00009 | $0.00371 |
| Haiku 4.5 | $0.00005 | $0.00186 |
Grade A, and why
Closure Scope Retention Guard scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 98 lines — stays where its author put it; the contents beside it link to each section on GitHub.
由来: Claude Code の
/simplify（Efficiency 観点の closure 保持）に由来（inspired by）。Issue #1452 P3 で、skills/agent-skills/river-review-code/references/SIMPLIFY.mdから closure スコープ保持の詳細検出を本 registry skill へ委譲した。
Pattern declaration
Primary pattern: Reviewer Secondary patterns: Inversion Why: 長寿命オブジェクトの closure 保持をチェックリストで評価するが、保持の証拠が差分に無い変更では実行しない。
Goal / 目的
- 長寿命オブジェクト（キャッシュ・リスナー・シングルトン・戻り値として保存されるオブジェクト）が、closure/環境キャプチャで enclosing scope 全体（大きな配列・一時バッファ等）を生存させ続けるメモリ保持を防ぐ。
- 必要なフィールドだけをコピーする形（class / 明示フィールド化 / 縮約済み構造）を促す。
Non-goals / 扱わないこと
- correctness bug・セキュリティ欠陥は対象外（bug 系・security 系観点の責務）。
- 短命な関数スコープ内で完結し、戻り後に到達不能になる一時変数は対象外。
- 一般的なパフォーマンス最適化論（ホットパスの計算量など）は SIMPLIFY 側 Efficiency の残余に委ねる。
applyTo に scripts/** と runners/** を含める理由
applyTo の各 glob は拡張子で境界付けした midstream ソース限定（scoping ガイド「midstream (application source)」の範囲内）である。長寿命 singleton / キャッシュは src/ に限らず scripts/・runners/ の常駐プロセス・起動パスにも生じ得るため、SIMPLIFY の applyTo 経路差を解消する目的で実行コードを持つ3ルートを対象にする。tests/**・docs/**・dist/** は含めない。
Pre-execution Gate / 実行前ゲート
このスキルは以下の条件がすべて満たされない限り NO_REVIEW を返す。dispatcher 経路では Gate が強制されないため、実行時に本文の Gate を必ず自己適用する。
- 差分にリポジトリ内で実行されるコード（
src//scripts//runners/配下の.ts/.tsx/.js/.jsx/.mjs/.cjs）の変更が含まれている。 - 差分に長寿命オブジェクト（module-level singleton・キャッシュ・登録されるリスナー・戻り値として保存されるオブジェクト）を closure/環境キャプチャで構築する証拠が含まれている。
- その closure が enclosing scope の大きなデータ（ファイル全文・大配列・一時バッファ・パース済みドキュメント群）を到達可能に保っている証拠がある。
-
inputContextにdiffが含まれている。
ゲート不成立時の出力: NO_REVIEW: closure-scope-retention — 長寿命オブジェクトによる大きな scope の closure 保持が差分に検出されない
False-positive guards / 抑制条件
Gate を通過した上で、以下は指摘しない（黙る）。
- 即時縮約して解放されるケース: 大きなデータを読み込んでも、その場で必要フィールドだけを小さな構造（Map・plain object・プリミティブ）へコピーし、関数リターン後に元データが到達不能（GC 可能）になる場合。closure が元データを掴んでいないなら保持は起きない。
- 短命なオブジェクト（同一 tick / 同一リクエスト内で破棄される）に対する保持は対象外。
- 保持しているデータが小さい（数十 KB 未満が明らかな）場合。
- 指摘行（finding の
file:line）が差分内に無い場合。
Rule / ルール
- 長寿命オブジェクトを組み立てる closure が、必要な小さいフィールドだけでなく enclosing scope の大きな変数（
rawText・documents・allEntries等）を参照し続けていないか。 - アクセサ（メソッド）が閉じ込めた大きな配列を毎回線形探索する等、縮約すれば済む構造を大きいまま抱えていないか。
- 修正案は「必要なフィールドだけをコピーする」形を具体的に示す（例:
id -> severityのMapを事前構築し、closure は大きな元データを掴まない）。
What ships with it
9 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- eval/promptfoo.yaml 1.3 KB
- fixtures/01-singleton-closure-happy.diff 1.3 KB
- fixtures/01-singleton-closure-happy.md 2.2 KB
- fixtures/02-immediate-reduce-false-positive.diff 839 B
- fixtures/02-immediate-reduce-false-positive.md 1.4 KB
- golden/01-singleton-closure-happy.md 646 B
- golden/02-immediate-reduce-false-positive.md 345 B
- prompt/system.md 4.0 KB
- prompt/user.md 2.2 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 98 lines · 46 tokens per session scan A b4de95c44186
Closure Scope Retention Guard is a skill published in the GitHub repository s977043/river-review (3 stars, last pushed today), licensed MIT. It adds 46 tokens to every session and 1,856 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
review-all
Multi-agent code review for diffs (project-agnostic). Covers standards, bugs, security, DRY, smells, perf, tests, API contracts, a11y/i18n. Verifies each finding to eliminate false positives. Use for /review-all, pre-PR/pre-commit review, or auditing uncommitted/staged changes.
logic-health
Sweep a directory, module, or full codebase for logic correctness and produce a scored health dashboard with systemic patterns. Trigger when the user requests a health view — "audit the whole codebase", "health check", "health overview", "logic health overview", "audit src/", "audit auth and payments modules", "where…
esp32-expert
This skill should be used for ESP32-specific hardware and runtime work in ESP-IDF, Arduino-ESP32, or PlatformIO projects: target/build detection, FreeRTOS tasks and ISRs, memory/DMA, peripherals, power, networking/security, OTA, crash diagnosis, and unattended reliability. Trigger on "debug this ESP32 crash", "review…
compound-docs
Searchable Elixir/Phoenix/Ecto solution documentation system with YAML frontmatter. Builds institutional knowledge from solved problems. Use when consulting past solutions before investigating new issues.
skeptic
Adversarial code reviewer for Bug Hunter. Rigorously challenges each reported bug to determine if it's real or a false positive. Uses doc-lookup (Context Hub + Context7) to verify framework claims before disproval. The immune system that kills false positives.
skeptical-triage
Reusable 3-round self-challenge + arbiter pattern for filtering false positives from findings/verdicts. Use when the cost of a false-positive gate block exceeds the cost of 4 extra LLM turns.