Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add s977043/river-review --skill refactor-claim-auditgit clone --depth 1 https://github.com/s977043/river-reviewWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/s977043/river-review/refactor-claim-audit)<a href="https://agentmods.dev/skills/s977043/river-review/refactor-claim-audit"><img src="https://agentmods.dev/badge/skills/s977043/river-review/refactor-claim-audit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/s977043/river-review/refactor-claim-audit"><img src="https://agentmods.dev/badge/skills/s977043/river-review/refactor-claim-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00120 | $0.03471 |
| Opus 5.5 | $0.00048 | $0.01388 |
| Sonnet 5.5 | $0.00024 | $0.00694 |
| Haiku 4.5 | $0.00012 | $0.00347 |
Grade A, and why
Refactor-Claim Audit リファクタ完了主張の検証 scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 165 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Pattern declaration
Primary pattern: Reviewer Secondary patterns: Inversion Why: 完了主張の反証は grep 検索による決定論的突合が主だが、主張がない変更では実行を止めるゲートが必要
Goal / 目的
- 「全部置換した」「すべて移行済み」「-83% 削減」のような 完了主張(commit message / PR description / コメント)に対し、grep で簡単に反証できる残骸や、過大な数値主張を検証する。
- 抽出(extract function/module)・集約リファクタが伴う 暗黙の挙動不変主張(「動作は変えていない」「テストは通る」)に対し、戻り値の byte 不変では守られない性能特性の退行やキー集約の衝突を検証する。
- 「やったと書いてあること」と「実際にやれていること」のギャップを可視化する。
Non-goals / 扱わないこと
- リファクタの設計妥当性の判断(それ自体が良い変更かは問わない)。
- 残骸が1件もない正当な完了主張への難癖(反証できなければ指摘しない)。
- パフォーマンス計測の代替(数値は主張の論理的整合性のみ検証し、実測はしない)。
Pre-execution Gate / 実行前ゲート
このスキルは以下の条件がすべて満たされない限り NO_REVIEW を返す。
- 差分・commit message・PR description に完了主張(「全」「すべて」「all」「完了」「移行済」「置換」「-N%」「削減」等)、または抽出・集約リファクタの挙動不変主張(「抽出」「切り出し」「集約」「リファクタ」「挙動不変」「動作は変えていない」「テストは通る」「extract」「refactor」「aggregate」「consolidate」「no behavioral change(s)」「behavior unchanged」「tests pass」等)が含まれている
- inputContext に diff が含まれている
ゲート不成立時の出力: NO_REVIEW: refactor-claim-audit — 完了主張・リファクタ挙動不変主張が検出されない
False-positive guards / 抑制条件
- 主張の対象を grep しても残骸が見つからない場合は指摘しない(反証できない主張は正しいとみなす)。
- 残骸が意図的に残されたもの(後方互換のための alias、deprecation 期間中の旧 API 等)で、差分内にその旨が明記されている場合は抑制。
- 数値主張が範囲表記(「-47%〜-55%」)で既に幅を持っている場合は抑制。
- 性能特性の退行は、抽出前に並列(
Promise.all)・fast-path・遅延評価が存在したことを差分または元コードで確認できる場合のみ指摘する。元から直列・同一評価順のコードを「直列だ」と指摘しない(新規の非効率提案は本スキルの対象外)。 - キー集約の衝突は、集約対象が単一 kind のみ、または集約キーが元から複合キーで衝突し得ない場合は指摘しない(衝突の現実的な可能性を示せないなら抑制)。
Rule / ルール
検出ロジック
- 主張の抽出: 完了主張を抽出し、検証可能な命題に変換する。
- 置換主張: 「A を B に全置換」→ 「repo 全体に A が残っていないはず」
- 完了主張: 「移行完了」→ 「旧構造への参照が残っていないはず」
- 数値主張: 「-N%」→ 「best/typical/worst のどのケースの値か」
- 反証検索: 主張の対象パターン(旧 API 名・旧参照形式・旧記法)を repo 全体に grep し、残骸を探す。
- 数値の独立試算:
-N%等の定量主張は、best-case / typical-case / worst-case を独立に算出し、主張値がどのケースか・過大表示でないかを併記要求する。 - ギャップの報告: 主張と、それを反証する残骸 or 試算を
<file>:<line>で示す。
抽出・集約リファクタの退行観点
抽出・集約リファクタは「動作は変えていない」「テストは通る」という暗黙の挙動不変主張を伴う。だがこの主張が守るのは戻り値・出力(byte 不変)までで、次の非機能的な特性は検証範囲外に落ちやすい。主張に挙動不変が含まれるとき、抽出前後のコードを対比して以下を追加監査する(grep 単独では判定できない意味論的観点)。
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 165 lines · 120 tokens per session scan A d0402e05304e
Refactor-Claim Audit リファクタ完了主張の検証 is a skill published in the GitHub repository s977043/river-review (7 stars, last pushed today), licensed MIT. It adds 120 tokens to every session and 3,471 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
review-all
Multi-agent code review for diffs (project-agnostic). Covers standards, bugs, security, DRY, smells, perf, tests, API contracts, a11y/i18n. Verifies each finding to eliminate false positives. Use for /review-all, pre-PR/pre-commit review, or auditing uncommitted/staged changes.
logic-review
Find logic bugs in a single file or function via semi-formal execution tracing (Premises → Trace → Divergence → Trigger → Remedy). Trigger when a user shares code and suspects something is wrong without naming a concrete failure — phrases like "review this", "does this look right", "check this function", "audit this…
logic-fix-all
Autonomous repository-wide audit-and-fix pipeline: health → review → locate/explain → fix → diff-verify → iterate until clean. Starts with a mandatory consent prompt (token-intensive); after consent runs hands-free. Trigger when the user wants ALL logic issues found and fixed — "fix everything", "fix all logic…
logic-health
Sweep a directory, module, or full codebase for logic correctness and produce a scored health dashboard with systemic patterns. Trigger when the user requests a health view — "audit the whole codebase", "health check", "health overview", "logic health overview", "audit src/", "audit auth and payments modules", "where…
logic-locate
Locate the root cause of a CONFIRMED failure via backward-then-forward semi-formal tracing. Trigger when the user provides a stack trace, failing assertion, error message, or specific wrong-value observation — "find the bug", "this test is failing", "track down this crash", "why is this test failing", "KeyError at…
logic-explain
Explain what a specific piece of code actually does for a given input by producing a step-by-step execution trace (interprocedural, with name resolution and type transitions). Trigger when the user is confused about behavior or asks why code produces X instead of Y — "walk me through this", "trace through X with input…