sglang: Skill for Claude Code

.claude/skills/cookbook-review-pr/SKILL.md

cookbook-review-pr is a skill for Claude Code from sgl-project/sglang. It costs 60 tokens per session (4,371 once invoked), scanned A, original, Apache-2.0.

A checklist for reviewing a pull request that changes the SGLang Cookbook, a documentation site with model deployment examples. It checks whether the change follows the Cookbook’s configuration-based page format and contribution rules.

In plain words
What is it for?
Reviewing Cookbook pull requests, checking changed files against the contribution checklist, and deciding whether a change is ready to merge.
Why use it?
It catches missing files, incorrect navigation, and changes that put model-specific logic into shared code. This makes review more systematic.

Skill for Claude Code

Written for Claude Code: installed under .claude/. Also seen: reads .claude/ paths.

This is sgl-project/sglang's own configuration. It tells Claude Code how to work on sglang itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything sglang configures →

About the project

SGLang is a framework for running inference for large language models and multimodal models, meaning it processes inputs to produce model outputs such as text or other media. It is used to serve and accelerate open AI models and related workloads.

sgl-project/sglang · 35,749 stars · on GitHub · sglang.io

Reuse

Borrowing it

Nothing to install: this file belongs to sgl-project/sglang. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/sgl-project/sglang/main/.claude/skills/cookbook-review-pr/SKILL.md
Clone the repo
git clone --depth 1 https://github.com/sgl-project/sglang

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for cookbook-review-pr

README.md
[![agentmods](https://agentmods.dev/badge/skills/sgl-project/sglang/cookbook-review-pr/github.svg)](https://agentmods.dev/skills/sgl-project/sglang/cookbook-review-pr)
Your own site
<a href="https://agentmods.dev/skills/sgl-project/sglang/cookbook-review-pr"><img src="https://agentmods.dev/badge/skills/sgl-project/sglang/cookbook-review-pr/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for cookbook-review-pr

Your own site · 80×15
<a href="https://agentmods.dev/skills/sgl-project/sglang/cookbook-review-pr"><img src="https://agentmods.dev/badge/skills/sgl-project/sglang/cookbook-review-pr.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 60 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 4,371 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 1 finding. A grade says what 26 rules found in the file — not that it is safe. Third-party audits
  • Snyk warn 7 Sept 2026
  • NVIDIA SkillSpector warn 7 Sept 2026
SkillSpector: 1 finding, up to medium

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

  • medium MCP Rug Pull · line 73
    Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
    Fix: Pin the image: image:tag or image@sha256:abc123
How audits are shown
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00060 $0.04371
Opus 5 $0.00030 $0.02185
Sonnet 5 $0.00012 $0.00874
Haiku 4.5 $0.00006 $0.00437

Measured 11d ago against content hash 4dcd6f75a369, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-11, from the pricing page.

Security

Grade A, and why

cookbook-review-pr scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

- `placeholders` declares every `{{KEY}}` used in `curl` or any cell.
.claude/skills/cookbook-review-pr/SKILL.md · 257 lines

How it starts

The opening of the file, as written. The whole thing — 257 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Cookbook Review PR

Fetch the diff, run the checklist, report what you find. The cookbook is config-driven: shared engines (_deployment.jsx, _playground.jsx) with NO model-specific code; each model is a data config (+ optional benchmarks) under src/snippets/configs/<vendor>/ plus an MDX page. This checklist targets that layout. Field-schema detail lives in .claude/skills/cookbook-add-model/references/authoring-reference.md — defer to it rather than restating.

Usage

/cookbook-review-pr <PR number>

Steps

  1. gh pr view <N> --repo sgl-project/sglang --json title,body,files,author,baseRefName,headRefName,commits,reviews
  2. gh pr diff <N> --repo sgl-project/sglang
  3. gh pr list --repo sgl-project/sglang --state open --search "<model name>" (duplicate check)
  4. Run every checklist item against the diff.
  5. Output per-file verdicts + overall recommendation.

Checklist

1. File hygiene

  • A cookbook PR should only touch: docs/src/snippets/configs/<vendor>/*.jsx (config + benchmarks), docs/cookbook/**/*.mdx, docs/docs.json, docs/cookbook/<category>/intro.mdx (vendor card), docs/cards/logos/<vendor>.png (new vendor only). Flag stray files (settings.local.json, lockfiles, IDE configs).
  • Pages must be .mdx, not .md. Files end with a trailing newline. Check commit history for unrelated commits accidentally included.
  • Engines untouched: _deployment.jsx / _playground.jsx should NOT change in a model-add PR (adding a model is data-only). Engine edits = a separate axis/feature PR (see cookbook-add-model/references/engine-axis.md); review them against that checklist.

2. Config quality (the per-model config)

  • Single export const config = { ... } literal — no function calls, spreads, fragment refs, or IIFE (Mintlify re-evals at hydration → ReferenceError).
  • No !(x in y) anywhere (Mintlify AST walker crashes) — use obj.key === undefined.
  • supportedHardwareHARDWARE_CATALOG (in _deployment.jsx) ∪ config.hardware. A model-specific GPU the shared catalog lacks must be declared in config.hardware ({id,label,vram,vendor}), not added to the engine catalog — unless the platform is genuinely shared, which is an engine change the PR body has to argue (and the cookbook-add-model hardware table moves with it). A new catalog entry is inert for other pages: each filters the catalog by its own supportedHardware.
  • placeholders declares every {{KEY}} used in curl or any cell.
  • modelNames covers every cell (by hw|variant|quant triple or variant|quant pair).
  • strategies count matches the page's operating points — 1 recipe → a single balanced; 2 → low-latency + high-throughput; 3 → the full trio. Tiers apply per (hw × variant × quant) combination: a single-recipe combination must park under its semantically honest tier (clear slant → that tier, e.g. a workstation card under low-latency; no slant → balanced, e.g. a CPU platform) — flag a no-slant recipe parked under low-latency/high-throughput. Mixed unions like [low-latency, balanced, high-throughput] with per-selection greying are fine. Also flag model-specific ids (e.g. mtp), and flag an INVERTED speculative mapping — the deterministic default is MTP/spec-decoding ON → low-latency, OFF → high-throughput (at saturation the draft+verify overhead outweighs the speedup); the reverse needs an explicit maintainer-confirmed justification in the PR. The MDX strategy bullets describe serving semantics in the DSv4 style (single-user chat / typical multi-user / batch jobs), not internal toggles.
  • dockerImages covers the hw ids that have cells (else users hit the :dev fallback); a hw|quant key (resolved before the plain hw) is valid when one quant on a shared GPU needs a different image (e.g. an FP4 dev build) — don't flag those.
  • multiNodeHints present ONLY for hw whose fabric needs manual NIC env (e.g. gb200 NVL72) — NOT every multi-N hw (standard-IB DeepEP / Marlin multi-node don't need it). Hints render above BOTH run modes, so flag one that reads as docker-only ("add these docker run flags") — docker run flags belong in the hardware entry's multiNodeDockerFlags, which the engine emits into the Docker command itself.
  • github.cookbookModel is set to the model's HF id (<hf-org>/<model-slug>). The issue template's model field is a free-form input prefilled from this value; if the config omits the github block, the engine falls back to deepseek-ai/deepseek-v4 and the page's submissions get mislabeled.
  • playgroundFeatures is opt-OUT: the general axes ship on every cookbook by default (attention TP/CP/DP-Attn, moe backend+EP for MoE models, parsers, speculative, pdDisagg, hicache) — flag a missing general axis unless the model genuinely cannot use it. Model-specific axes only where applicable (MegaMoE backend + megamoeQuant only on Blackwell MoE, gated by requiresHw; hisparse only DSA-style). Knobs that are meaningless for a subset of variants/hw are disabled with a reason, not silently live (e.g. MoE knobs greyed on dense variants). No empty/stub axes.
  • No leftover __TOKEN__ — the config was stamped from the template and every placeholder is filled (grep -rn '__[A-Z_]*__' on the new config/benchmarks/MDX returns nothing).
  • All-hardware considered: every supportedHardware id (from the catalog or config.hardware) has ≥1 cell OR is a deliberate greyed "coming soon"; AMD was pruned or kept on purpose (not a leftover template family).

Read the full file on GitHub · 257 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 11d ago First seen · 257 lines · 60 tokens per session scan A 4dcd6f75a369

Subscribe to this mod's changes

cookbook-review-pr is a skill published in the GitHub repository sgl-project/sglang (35,749 stars, last pushed today), licensed Apache-2.0. It adds 60 tokens to every session and 4,371 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

llama-factory

Expert guidance for fine-tuning LLMs with LLaMA-Factory - WebUI no-code, 100+ models, 2/3/4/5/6/8-bit QLoRA, multimodal support.

davila7/claude-code-templates · 51 tokens

continual-learning

Nightly refinement of an existing per-repo review-style prompt using this reviewer's own finding outcomes. Read confirmed (resolved-by-commit / thumbs-up) and dismissed (thumbs-down) findings, promote the bug patterns the team actually fixes, demote the false-positive patterns, reconcile against the current prompt…

langchain-ai/open-swe · 89 tokens

meta-codereview-current-diff

Read the current uncommitted diff, run three independent reviewers (safety + tests-coverage + style) in parallel, then arbitrate a single BLOCK / BLOCKWITHOVERRIDE / PASSWITHNOTES verdict. Use before commit when you want a multi-perspective second-opinion instead of a single-reviewer agent loop.

opensquilla/opensquilla · 73 tokens

prs-awaiting-maintainer

List open pull requests where the ball is in the maintainer's court: CI is green and the PR is ready for a maintainer to review, re-review, or merge. Use when the user wants to see PRs awaiting maintainer action.

dyoshikawa/rulesync · 56 tokens

compliance-checker

Check affiliate content for FTC compliance and platform rules. Triggers on: "check my content for compliance", "FTC disclosure check", "is this legal", "review for compliance", "check affiliate disclosure", "am I FTC compliant", "audit my content", "compliance review", "legal check", "platform rules check", "check…

Affitor/affiliate-skills · 87 tokens

security-audit

Security audit expert for OWASP Top 10, CVE analysis, code review, and penetration testing methodology.

RightNow-AI/openfang · 25 tokens