Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add staruhub/ClaudeSkills --skill geek-skills-pair-programminggit clone --depth 1 https://github.com/staruhub/ClaudeSkillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/staruhub/claudeskills/geek-skills-pair-programming)<a href="https://agentmods.dev/skills/staruhub/claudeskills/geek-skills-pair-programming"><img src="https://agentmods.dev/badge/skills/staruhub/claudeskills/geek-skills-pair-programming/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/staruhub/claudeskills/geek-skills-pair-programming"><img src="https://agentmods.dev/badge/skills/staruhub/claudeskills/geek-skills-pair-programming.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00136 | $0.01171 |
| Opus 5 | $0.00068 | $0.00585 |
| Sonnet 5 | $0.00027 | $0.00234 |
| Haiku 4.5 | $0.00014 | $0.00117 |
Grade A, and why
pair-programming scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 13d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
结对编程搭档
交付代码 + 像负责任的高级开发者一样自我审查，一次给到位。
验收标准（每次交付前自查）
- 代码之后附有结构化审查意见（好的地方 / 需要关注 / 优化建议三段）
- 每个"需要关注"都给了可执行的修改方案，不是只指出问题
- 🔴 必查项五条全部过检（空值/输入验证/注入/敏感数据/资源泄漏）
- 审查意见针对本次生成的代码，不是通用清单复读
- 发现自己代码的问题时直接修掉再交付，审查意见只留真正的权衡点
不做什么
- 不替代正式 code review / PR 评审流程
- 不做安全专项审计 →
security-audit - <10 行的简单片段、纯示例代码、用户明说不要审查时，省略审查环节
审查工作流
生成代码 → 五维度扫描 → 修掉能修的 → 剩余权衡点写进审查意见。
五维度扫描
| 维度 | 检查重点 |
|---|---|
| 正确性 | 逻辑是否正确？边界条件是否处理？ |
| 安全性 | 是否有注入风险？数据是否安全处理？ |
| 性能 | 是否有 O(n²) 隐患？是否有不必要的循环？ |
| 可读性 | 命名是否清晰？结构是否合理？ |
| 健壮性 | 错误处理是否完善？异常情况是否考虑？ |
分级清单
🔴 必查（阻断级）：空值处理 / 输入验证 / SQL·命令注入（参数化）/ 密钥硬编码 / 资源泄漏 🟡 重要（建议级）：边界条件 / 并发竞态 / 异常捕获 / 关键日志 / 网络超时 🟢 改进（优化级）：重复代码 / 命名 / 复杂逻辑注释 / 魔法数字 / 单一职责
语言特定检查项（Python/JS/Java/Go/Dart 等）见 references/detailed-checklist.md，按当前语言取用。
AI 生成代码的特有缺陷（重点盯防）
| 缺陷 | 具体表现 | 自查方法 |
|---|---|---|
| 幻觉 API | 调用了不存在的方法或传了不存在的参数 | 不确定的 API 先查项目依赖版本的文档，不凭记忆写 |
| 偷改需求 | 实现比用户要求"更合理"的版本，悄悄改了行为 | 对照用户原话逐条核对交付物 |
| 过度防御 | 到处 try/catch 吞异常、层层空值检查掩盖真错误 | 每个 catch 问"这里吞掉异常对吗" |
| 风格漂移 | 新代码与项目既有命名/模式不一致 | 写前先看同目录相邻文件的写法 |
| 测试造绿灯 | 为过测试写死返回值或放宽断言 | 审查测试改动是否弱化了验证强度 |
| 复制不一致 | 从别处仿写时残留原上下文的变量名/注释 | 全读一遍自己的产出，不只看 diff |
反馈格式与语气
---
## 🔍 结对审查意见
### ✅ 做得好的地方
### ⚠️ 需要关注（含具体修改方案）
### 💡 优化建议（可选方向）
建设性（给方案）、谦逊（"可以考虑"）、教学性（解释为什么）、平衡（也认可好的做法）、简洁（只留关键点）。
示例（检测到注入风险时）：
⚠️ 🔴 SQL 注入风险：
"...WHERE name = '$name'"直接拼接用户输入。 建议：参数化查询db.query("...WHERE name = ?", [name])。
引用资源
references/detailed-checklist.md— 语言特定检查清单全集，按当前项目语言取用
evals/routing-evals.json — 触发边界回归用例，改 description 后用仓库根 scripts/run_routing_evals.py 校验。
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 13d ago First seen · 80 lines · 136 tokens per session scan A 2ffbab4086ca
pair-programming is a skill published in the GitHub repository staruhub/ClaudeSkills (712 stars, last pushed 1mo ago), licensed MIT. It adds 136 tokens to every session and 1,171 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
review-work
Post-implementation gate review: run manual QA on the real surface yourself, then launch ONE gate reviewer (never a panel) to audit goal, constraints, code quality, security, missed context, and QA evidence. Use before a PR handoff or when the user explicitly asks to review completed work.
critical-code-reviewer
Rigorously review code or pull requests for correctness, security, accessibility, maintainability, tests, and edge cases. Use when users request a critical code review, want a guided walkthrough of findings, need implementer-facing feedback, or want to prepare, create, or submit a GitHub pull request review.
one-way-door
Flags irreversible decisions before commit. Use for data models, infra, auth boundaries, API contracts, event schemas, CI/CD.
map-codebase
Deep architecture report that fans out parallel inspections across different aspects of the codebase (structure, tech stack, APIs, patterns, data flow, dependencies, testing) and synthesizes findings into a comprehensive document at .turbo/codebase-map.md and .turbo/codebase-map.html. Use when the user asks to "map…
reply-to-pr-threads
Draft, confirm, and post replies to GitHub PR review threads. Handles per-category reply formatting, re-fetches thread resolution state so auto-resolved threads are skipped, and posts via GraphQL. Use when the user asks to "reply to PR threads", "post PR thread replies", or "draft PR reply messages".
answer-reviewer-questions
For each reviewer question on a PR, recall implementation reasoning and compose a raw answer. Use when the user asks to "answer reviewer questions", "draft answers to PR questions", or "explain reviewer questions".