Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add skilld-dev/skilld --skill review-skillgit clone --depth 1 https://github.com/skilld-dev/skilldWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/skilld-dev/skilld/review-skill)<a href="https://agentmods.dev/skills/skilld-dev/skilld/review-skill"><img src="https://agentmods.dev/badge/skills/skilld-dev/skilld/review-skill/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/skilld-dev/skilld/review-skill"><img src="https://agentmods.dev/badge/skills/skilld-dev/skilld/review-skill.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00027 | $0.00583 |
| Opus 5.5 | $0.00011 | $0.00233 |
| Sonnet 5.5 | $0.00005 | $0.00117 |
| Haiku 4.5 | $0.00003 | $0.00058 |
Grade A, and why
review-skill scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 44 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Review a Skill
Review the supplied Skill as an Agent would use it.
Checks
- Confirm
SKILL.mdexists and its parent directory matches its name. - Confirm frontmatter uses supported fields and valid values.
- Confirm the description says what the Skill does and when to use it, in the third person, with the terms a user types.
- Follow every linked reference and script.
- Report missing or broken links.
- Reject symbolic links, special files, and paths that leave the Skill directory.
- Check instructions for missing inputs, unclear outcomes, and silent failure paths.
- Check commands for destructive scope, credential exposure, and unverified downloads.
- Check examples against the cited API or project source. If a runtime is available, run them and report each result that differs from the claim.
An example is each code block and each checkable prose claim: a default, a list, a count, error text, an exit code, or "X happens when Y".
Test the exact version the Skill names, never the repository head. Use the toolchain its users run, in each mode the claim covers, such as SSR, dev, and build.
Install it in an empty scratch directory with its own
pnpm-workspace.yaml. Prefer a local fixture to a live site. Never use personal credentials. For cloud-bound code, typecheck it and run it against in-memory stand-ins. Confirm a failing claim with a second probe before you report it. Mark each example executed, read from source, or unverified. - Find repeated prose and material that belongs in a reference.
- Find text the reader already knows: domain or framework explanations, generic debug advice, changelog paraphrase, and internals the reader cannot act on.
- For a package Skill, confirm the body names the package version it was tested against, once, in the first paragraph. Flag other version literals.
- Confirm the body covers each export, option, or symptom the description promises.
Rank each finding:
error: following the Skill gives a wrong result, a failure, or a security gap.warning: an Agent would act wrongly on the claim, a failure stays silent, or a needed input is missing.note: precision, repetition, structure, or token cost.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago Changed · +2 lines 6e3c1e47ced3
- 12d ago Changed · +11 lines 59ae2f0b8474
- 20d ago Changed · +2 lines 0333f3dd7ea1
- 1mo ago First seen · 29 lines · 27 tokens per session scan A 164c25f7cbdf
review-skill is a skill published in the GitHub repository skilld-dev/skilld (327 stars, last pushed 10d ago), licensed MIT. It adds 27 tokens to every session and 583 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
use-agent-supagents
Compile shared role instructions into native subagent profiles for Antigravity, Claude Code, Codex, Copilot, Cursor, Gemini CLI, Grok, Kilo, and OpenCode.
harness-config-cli
Use when working in the harness-config repository and Codex needs to validate, preview, activate, or explain Harness config dogfooding with the local @harnessconfig/cli package.
harness-config-patterns
Use when working in the harness-config repository on implementation structure, projection architecture, resource and dir composition, target override precedence, profile and ignore integration, or code placement.
harness-config-specs
Use when working in the harness-config repository on the Harness config v1 standard, conformance rules, specification wording, manifest/resource/dir/profile/ignore semantics, or docs ownership.
harness-config-testing
Use when working in the harness-config repository on test strategy, regression coverage, fixtures, docs/TESTING.md, CLI end-to-end checks, projection edge cases, profile and ignore scenarios, or focused quality commands.
.claude
Review changes for correctness, tests, and generated-output drift. When Claude specific behavior is relevant, call out the generated .claude surface.