SGLang is a framework for running inference for large language models and multimodal models, meaning it processes inputs to produce model outputs such as text or other media. It is used to serve and accelerate open AI models and related workloads.
Borrowing it
Nothing to install: this file belongs to sgl-project/sglang. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/sgl-project/sglang/main/.claude/skills/cookbook-review-pr/SKILL.mdgit clone --depth 1 https://github.com/sgl-project/sglangWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/sgl-project/sglang/cookbook-review-pr)<a href="https://agentmods.dev/skills/sgl-project/sglang/cookbook-review-pr"><img src="https://agentmods.dev/badge/skills/sgl-project/sglang/cookbook-review-pr/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/sgl-project/sglang/cookbook-review-pr"><img src="https://agentmods.dev/badge/skills/sgl-project/sglang/cookbook-review-pr.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- Snyk warn
- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 73 Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.Fix: Pin the image: image:tag or image@sha256:abc123
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00060 | $0.04371 |
| Opus 5 | $0.00030 | $0.02185 |
| Sonnet 5 | $0.00012 | $0.00874 |
| Haiku 4.5 | $0.00006 | $0.00437 |
Grade A, and why
cookbook-review-pr scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- `placeholders` declares every `{{KEY}}` used in `curl` or any cell. How it starts
The opening of the file, as written. The whole thing — 257 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Cookbook Review PR
Fetch the diff, run the checklist, report what you find. The cookbook is config-driven:
shared engines (_deployment.jsx, _playground.jsx) with NO model-specific code; each
model is a data config (+ optional benchmarks) under src/snippets/configs/<vendor>/
plus an MDX page. This checklist targets that layout. Field-schema detail lives in
.claude/skills/cookbook-add-model/references/authoring-reference.md — defer to it rather
than restating.
Usage
/cookbook-review-pr <PR number>
Steps
gh pr view <N> --repo sgl-project/sglang --json title,body,files,author,baseRefName,headRefName,commits,reviewsgh pr diff <N> --repo sgl-project/sglanggh pr list --repo sgl-project/sglang --state open --search "<model name>"(duplicate check)- Run every checklist item against the diff.
- Output per-file verdicts + overall recommendation.
Checklist
1. File hygiene
- A cookbook PR should only touch:
docs/src/snippets/configs/<vendor>/*.jsx(config + benchmarks),docs/cookbook/**/*.mdx,docs/docs.json,docs/cookbook/<category>/intro.mdx(vendor card),docs/cards/logos/<vendor>.png(new vendor only). Flag stray files (settings.local.json, lockfiles, IDE configs). - Pages must be
.mdx, not.md. Files end with a trailing newline. Check commit history for unrelated commits accidentally included. - Engines untouched:
_deployment.jsx/_playground.jsxshould NOT change in a model-add PR (adding a model is data-only). Engine edits = a separate axis/feature PR (seecookbook-add-model/references/engine-axis.md); review them against that checklist.
2. Config quality (the per-model config)
- Single
export const config = { ... }literal — no function calls, spreads, fragment refs, or IIFE (Mintlify re-evals at hydration →ReferenceError). - No
!(x in y)anywhere (Mintlify AST walker crashes) — useobj.key === undefined. supportedHardware⊆HARDWARE_CATALOG(in_deployment.jsx) ∪config.hardware. A model-specific GPU the shared catalog lacks must be declared inconfig.hardware({id,label,vram,vendor}), not added to the engine catalog — unless the platform is genuinely shared, which is an engine change the PR body has to argue (and thecookbook-add-modelhardware table moves with it). A new catalog entry is inert for other pages: each filters the catalog by its ownsupportedHardware.placeholdersdeclares every{{KEY}}used incurlor any cell.modelNamescovers every cell (byhw|variant|quanttriple orvariant|quantpair).strategiescount matches the page's operating points — 1 recipe → a singlebalanced; 2 →low-latency+high-throughput; 3 → the full trio. Tiers apply per (hw × variant × quant) combination: a single-recipe combination must park under its semantically honest tier (clear slant → that tier, e.g. a workstation card underlow-latency; no slant →balanced, e.g. a CPU platform) — flag a no-slant recipe parked under low-latency/high-throughput. Mixed unions like [low-latency, balanced, high-throughput] with per-selection greying are fine. Also flag model-specific ids (e.g.mtp), and flag an INVERTED speculative mapping — the deterministic default is MTP/spec-decoding ON →low-latency, OFF →high-throughput(at saturation the draft+verify overhead outweighs the speedup); the reverse needs an explicit maintainer-confirmed justification in the PR. The MDX strategy bullets describe serving semantics in the DSv4 style (single-user chat / typical multi-user / batch jobs), not internal toggles.dockerImagescovers the hw ids that have cells (else users hit the:devfallback); ahw|quantkey (resolved before the plainhw) is valid when one quant on a shared GPU needs a different image (e.g. an FP4 dev build) — don't flag those.multiNodeHintspresent ONLY for hw whose fabric needs manual NIC env (e.g.gb200NVL72) — NOT everymulti-Nhw (standard-IB DeepEP / Marlin multi-node don't need it). Hints render above BOTH run modes, so flag one that reads as docker-only ("add these docker run flags") —docker runflags belong in the hardware entry'smultiNodeDockerFlags, which the engine emits into the Docker command itself.github.cookbookModelis set to the model's HF id (<hf-org>/<model-slug>). The issue template'smodelfield is a free-form input prefilled from this value; if the config omits thegithubblock, the engine falls back todeepseek-ai/deepseek-v4and the page's submissions get mislabeled.playgroundFeaturesis opt-OUT: the general axes ship on every cookbook by default (attentionTP/CP/DP-Attn,moebackend+EP for MoE models,parsers,speculative,pdDisagg,hicache) — flag a missing general axis unless the model genuinely cannot use it. Model-specific axes only where applicable (MegaMoE backend +megamoeQuantonly on Blackwell MoE, gated byrequiresHw;hisparseonly DSA-style). Knobs that are meaningless for a subset of variants/hw aredisabled with a reason, not silently live (e.g. MoE knobs greyed on dense variants). No empty/stub axes.- No leftover
__TOKEN__— the config was stamped from the template and every placeholder is filled (grep -rn '__[A-Z_]*__'on the new config/benchmarks/MDX returns nothing). - All-hardware considered: every
supportedHardwareid (from the catalog orconfig.hardware) has ≥1 cell OR is a deliberate greyed "coming soon"; AMD was pruned or kept on purpose (not a leftover template family).
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 257 lines · 60 tokens per session scan A 4dcd6f75a369
cookbook-review-pr is a skill published in the GitHub repository sgl-project/sglang (35,749 stars, last pushed today), licensed Apache-2.0. It adds 60 tokens to every session and 4,371 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
llama-factory
Expert guidance for fine-tuning LLMs with LLaMA-Factory - WebUI no-code, 100+ models, 2/3/4/5/6/8-bit QLoRA, multimodal support.
continual-learning
Nightly refinement of an existing per-repo review-style prompt using this reviewer's own finding outcomes. Read confirmed (resolved-by-commit / thumbs-up) and dismissed (thumbs-down) findings, promote the bug patterns the team actually fixes, demote the false-positive patterns, reconcile against the current prompt…
meta-codereview-current-diff
Read the current uncommitted diff, run three independent reviewers (safety + tests-coverage + style) in parallel, then arbitrate a single BLOCK / BLOCKWITHOVERRIDE / PASSWITHNOTES verdict. Use before commit when you want a multi-perspective second-opinion instead of a single-reviewer agent loop.
prs-awaiting-maintainer
List open pull requests where the ball is in the maintainer's court: CI is green and the PR is ready for a maintainer to review, re-review, or merge. Use when the user wants to see PRs awaiting maintainer action.
compliance-checker
Check affiliate content for FTC compliance and platform rules. Triggers on: "check my content for compliance", "FTC disclosure check", "is this legal", "review for compliance", "check affiliate disclosure", "am I FTC compliant", "audit my content", "compliance review", "legal check", "platform rules check", "check…
security-audit
Security audit expert for OWASP Top 10, CVE analysis, code review, and penetration testing methodology.