skillopt-setup

skillopt-setup is a skill for Codex from stark-ai-de/agent-skills. It costs 74 tokens per session (2,842 once invoked), scanned A, original, Apache-2.0.

A setup and operating workflow for Microsoft SkillOpt, a tool that tests and improves agent skills. It prepares evaluation data, runs SkillOpt on SKILL.md files, and supports reviewing or importing suggested changes.

In plain words
What is it for?
Use it to install or check SkillOpt, prepare training, validation, and test cases, configure execution providers, run evaluations, or review best_skill.md results. It is not for routine skill writing.
Why use it?
It provides a repeatable way to compare skill instructions against test cases before changing them. This helps separate optimization work from ordinary manual editing and repository validation.

Skill for Codex

Written for Codex: runs codex exec. Also seen: mentions AGENTS.md; mentions Codex.

Good fit Use it to install or check SkillOpt, prepare training, validation, and test cases, configure execution providers, run evaluations, or review best_skill.md results. It is not for routine skill writing.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/stark-ai-de/agent-skills/skillopt-setup
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add stark-ai-de/agent-skills --skill skillopt-setup
Clone the repo
git clone --depth 1 https://github.com/stark-ai-de/agent-skills

Made for: Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for skillopt-setup

README.md
[![agentmods](https://agentmods.dev/badge/skills/stark-ai-de/agent-skills/skillopt-setup.svg)](https://agentmods.dev/skills/stark-ai-de/agent-skills/skillopt-setup)
Your own site
<a href="https://agentmods.dev/skills/stark-ai-de/agent-skills/skillopt-setup"><img src="https://agentmods.dev/badge/skills/stark-ai-de/agent-skills/skillopt-setup.svg" alt="Measured on agentmods" height="20"></a>
Per session 74 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 2,842 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00074 $0.02842
Opus 5 $0.00037 $0.01421
Sonnet 5 $0.00015 $0.00568
Haiku 4.5 $0.00007 $0.00284

Measured 8d ago against content hash 347cd233aea0, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-08, from the pricing page.

Security

Grade A, and why

skillopt-setup scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.

The scan reads SKILL.md. This mod also ships 11 executable files (scripts/apply-skillopt-best.mjs, scripts/audit-skillopt-local-artifacts.mjs, scripts/check-skillopt-readiness.mjs, …), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

incubator/skills/skill-maintenance/skillopt-setup/SKILL.md · 153 lines

How it starts

The opening of the file, as written. The whole thing — 153 lines — stays where its author put it; the contents beside it link to each section on GitHub.

SkillOpt Setup

Goal

Set up and operate a local SkillOpt workflow that improves one Agent Skill at a time while preserving frontmatter, validation, and public-proof boundaries.

When to use

  • Installing or checking Microsoft SkillOpt for this repo.
  • Preparing SkillOpt train/val/test data from skill-evals/.
  • Configuring provider-backed, hybrid Codex CLI, or exploratory all-Codex CLI execution.
  • Running SkillOpt for a target SKILL.md.
  • Reviewing, summarizing, or importing best_skill.md.
  • Creating public run evidence without committing raw transcripts.

When not to use

  • Ordinary skill authoring or manual SKILL.md review.
  • Trigger-description tuning only.
  • Repo validation without SkillOpt.
  • Directly implementing an optimized skill before review.

Inputs to inspect

  • Target skill path under skills/ or incubator/skills/.
  • skill-evals/<skill>/README.md, cases/, fixtures/, expected/, rubric.md, and runs/.
  • Current SKILL.md frontmatter and body.
  • .gitignore and AGENTS.md safety rules.
  • Local .agents/tools/SkillOpt state, if present.
  • Local .agents/ artifact audit when mining prior setup work or troubleshooting stale workspaces.
  • Local uv availability and local Python 3.10+ compatibility.
  • Local Codex CLI availability and login state if Codex mode is requested.
  • Visual assertion cases, render-capable requirements, and draw.io Desktop CLI availability when target evals need PNG/SVG artifacts.

Workflow

Guide the user through setup as a short wizard. Ask one decision at a time unless the user already supplied the answer; do not dump every command or option before the relevant step.

  1. Wizard step: target. Identify exactly one target skill and whether it is incubator or promoted. If missing or ambiguous, ask which skill should be optimized.
  2. Wizard step: existing setup. Immediately inspect .agents/tools/SkillOpt, .agents/tools/SkillOpt.commit, and .agents/skillopt-work. If any exist, ask whether to remove the current local setup or reuse/update it before dry-run or production setup. Cleanup is global to the local SkillOpt setup and must not remove .agents/skills/.
  3. If the user chooses cleanup, run setup-skillopt-local.mjs --cleanup-only --approved yourself before setup. Do not present cleanup as a copy-paste command.
  4. When the user asks to move prior .agents/ learnings into the skill, run audit-skillopt-local-artifacts.mjs first. Promote only sanitized scripts, references, templates, eval cases, or curated summaries; never promote raw clones, installed skill copies, data splits, run outputs, transcripts, or readiness diagnostics.
  5. Wizard step: setup goal. Explain the recommended branches:
  • easiest no-provider path: codex-cli-all, exploratory, uses Codex CLI login for rollouts, semantic judging, and adapter-managed reflection; keep slow update and meta skill disabled in this mode because those upstream epoch-boundary mechanisms call the provider-backed optimizer path,
  • best official-parity path: hybrid-codex-target or native-provider, provider-backed optimizer/reflection, requires credentials and model pins.
  1. Wizard step: Python. Prefer uv. If uv is missing, ask whether to install uv or explicitly use compatible local Python 3.10+.
  2. Wizard step: data quality. Run readiness or split preparation early enough to report positive, validation, and test counts. Official-parity proof needs at least 20 positive cases, 5 validation cases, and 5 test cases; otherwise classify the run as exploratory or blocked for proof.
  3. Wizard step: execution and visual readiness. Require the bounded strict-config capability probe for every active Codex target, judge, or reflection role, including text-only cases. If any cases declare visual_assertions, also check visualArtifactReadiness, generated tool_rollout_for_visual_assertions, and visual_eval_policy. Visual Codex cases may use bounded file edits and shell commands only under the enforced read-isolated rollout permission profile, for copied helper scripts, draw.io XML, validation, and requested PNG/SVG exports; non-visual Codex rollouts remain text-only with no workspace read or write grant. If draw.io CLI is missing, use the generated data-text-only split and report that full visual proof still requires the renderer. Native-provider auto mode must also select data-text-only because provider chat targets cannot create local artifacts.
  4. Wizard step: best-practice configuration. For official-parity, require provider credential presence plus SKILLOPT_OPTIMIZER_MODEL, SKILLOPT_TARGET_MODEL, and judge model pins. For codex-cli-all, preserve exploratory defaults, require slow update/meta skill to stay disabled, and report which upstream provider-backed behavior is bypassed.
  5. Wizard step: dry-run. Ask whether the user wants a dry-run first unless already answered. If yes, run setup without --approved, report the dry-run result only, and ask whether to continue. Do not show production setup commands or SkillOpt training commands after dry-run.
  6. Wizard step: production setup. If the user skips dry-run or approves continuation, run production-grade setup with --approved, using .agents/ as the persistent workspace and passing --existing-setup-choice reuse when reuse was chosen.
  7. Prepare or update the ignored SkillOpt workspace, split JSON, local adapter, target manifest, and mode/profile config.
  8. When the user wants a guaranteed training-ready setup, use --strict-training-ready; block rather than hand off a training command if credentials, model pins, Codex probe, visual artifact readiness, adapter patches, or refreshed target manifest checks are missing.
  9. After successful production setup, recommend the paste-ready new-terminal SkillOpt command. It must stream logs, print explicit success/failure, run artifact verification, show a compact summary, and run best_skill.md dry-run adoption preview.
  10. Include manual rerun commands with short descriptions for artifact verification, run summary, dry-run adoption preview, eval-only evaluation, and optional WebUI.
  11. Offer current-session execution only as an explicit option: Should I run SkillOpt training for <target-skill> in this agent session anyway?
  12. Inspect best_skill.md, diff it against the original skill body, validate adoption gates, ask before tracked writes, and save only curated public evidence under skill-evals/<target>/runs/.

Read the full file on GitHub · 153 lines

Files

What ships with it

38 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 8d ago First seen · 153 lines · 74 tokens per session scan A 347cd233aea0

Subscribe to this mod's changes

skillopt-setup is a skill published in the GitHub repository stark-ai-de/agent-skills (5 stars, last pushed today), licensed Apache-2.0. It adds 74 tokens to every session and 2,842 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.