lexicon-manager

lexicon-manager is a skill for Claude Code from SummerSec/SumSec-Skills. It costs 62 tokens per session (1,457 once invoked), scanned A, original, Apache-2.0.

A manager for the vocabulary list used by Semantic-Linter to identify broad wording in language-model instructions.

In plain words
What is it for?
Use it to add, change, remove, import, or inspect vocabulary pairs and their severity levels.
Why use it?
It keeps the editable Markdown word list and generated runtime data in sync, reducing mistakes between the source list and the tool’s data.

Skill for Claude Code

Written for Claude Code: shipped in a Claude Code plugin.

Part of the semantic-linter plugin — 4 skills, 3 commands shipped together

Good fit Use it to add, change, remove, import, or inspect vocabulary pairs and their severity levels.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/summersec/sumsec-skills/lexicon-manager
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add SummerSec/SumSec-Skills --skill lexicon-manager
Clone the repo
git clone --depth 1 https://github.com/SummerSec/SumSec-Skills

Made for: Claude Code.

Or install semantic-linter, the plugin that ships this one along with the rest of its 4 skills, 3 commands.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for lexicon-manager

README.md
[![agentmods](https://agentmods.dev/badge/skills/summersec/sumsec-skills/lexicon-manager/github.svg)](https://agentmods.dev/skills/summersec/sumsec-skills/lexicon-manager)
Your own site
<a href="https://agentmods.dev/skills/summersec/sumsec-skills/lexicon-manager"><img src="https://agentmods.dev/badge/skills/summersec/sumsec-skills/lexicon-manager/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for lexicon-manager

Your own site · 80×15
<a href="https://agentmods.dev/skills/summersec/sumsec-skills/lexicon-manager"><img src="https://agentmods.dev/badge/skills/summersec/sumsec-skills/lexicon-manager.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 62 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,457 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00062 $0.01457
Opus 5 $0.00031 $0.00728
Sonnet 5 $0.00012 $0.00291
Haiku 4.5 $0.00006 $0.00146

Measured 5d ago against content hash b75e390523d6, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-08, from the pricing page.

Security

Grade A, and why

lexicon-manager scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

semantic-linter/skills/lexicon-manager/SKILL.md · 138 lines

How it starts

The opening of the file, as written. The whole thing — 138 lines — stays where its author put it; the contents beside it link to each section on GitHub.

语义陷阱词典管理器

交互式维护词典:权威来源references/semantic-trap-lexicon.md 中的表格;lib/lexicon-data.jsnpm run build-lexicon 自动生成,不要作为手写主路径(避免与校验脚本不一致)。

数据文件与生成命令

角色 路径
权威源(人编辑) references/semantic-trap-lexicon.md
生成物(勿手改为主流程) lib/lexicon-data.js
# 修改 MD 表格后执行:重新生成 lexicon-data.js
npm run build-lexicon

# 校验已提交的 lexicon-data.js 与 MD 一致(不写盘)
npm run build-lexicon:check

词汇对数据结构(写入 MD / 心智模型)

字段需能在表格中表达;生成脚本会解析为下列结构(与 lexicon-data.js 中对象一致)。

中文词汇对 (zhPairs)

  • id: T01T99
  • narrow / wide:窄边界 / 宽边界(中文)
  • narrowEn / wideEn:括号内英文,与 MD 表格列一致
  • severity:由 MD「语义宽度差」列映射为 critical / high / medium-high / medium
  • scenario:失控场景(表格最后一列)

英文词汇对 (enPairs)

  • idE01E99
  • narrow / wide;可选 narrowAlt / wideAlt(MD 中用 / 分隔)
  • severity:与仓库生成规则一致(由维护脚本映射)
  • scenario

严重等级(severity)

critical > high > medium-high > medium > low

选择依据(摘录):

  • critical:替换后输出量或范围变化极大,或明显偏离任务目标
  • high:明显主观判断或超范围联想
  • medium-high:适度发散仍在相关域内
  • medium:边界略模糊、影响有限
  • low:理论有差、实际影响极小

维护工作流

STEP 1:读取当前词典

  1. 读取 references/semantic-trap-lexicon.md 中各表格,或 require('./lib/lexicon-data.js') 使用已生成的 wideWordsZh / wideWordsEn 向用户展示概览(二者应一致;若不一致先运行 npm run build-lexicon:check 定位)。

概览示例:

📖 当前词典概览
中文词汇对: T01–T17(以 MD 为准)
英文词汇对: E01–E10(以 MD 为准)

STEP 2:确认操作

与用户确认操作类型:添加 / 修改 / 删除

操作 A:添加词汇对

逐项收集:

  1. 语言:中文 (T) 或英文 (E)
  2. wide / narrow(及中文的 narrowEn、wideEn;英文的 narrowAlt、wideAlt 若需要)
  3. severity(或对应 MD 语义宽度差文案)
  4. scenario(失控说明,非空)

ID:新 ID = 同系列当前最大 ID + 1(如最大 T17 → T18)。不随意重用已删除 ID(保持历史稳定)。

验证

  • wide / narrow 非空;wide 不与已有行冲突
  • severity 合法;scenario 非空
操作 B:修改词汇对
  1. 用户指定 ID(如 T05)
  2. 展示当前表格行或生成条目中的字段
  3. 确认新值后更新 MD 表格对应行
操作 C:删除词汇对
  1. 用户指定 ID,展示完整信息
  2. 二次确认删除(降低检测覆盖)
  3. 从 MD 表格移除该行不重新编号已有 ID

STEP 3:执行修改(仅改 MD → 生成)

  1. 编辑 references/semantic-trap-lexicon.md
    • 在「高危词汇对」「扩展词汇对」「英文环境高危词汇对」等对应表格中 增/改/删 行,列格式与现有行保持一致。
    • 若变更影响说明,检查「LLM 语义敏感度矩阵」是否需同步调整。

Read the full file on GitHub · 138 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 5d ago First seen · 138 lines · 62 tokens per session scan A b75e390523d6

Subscribe to this mod's changes

lexicon-manager is a skill published in the GitHub repository SummerSec/SumSec-Skills (8 stars, last pushed 24d ago), licensed Apache-2.0. It adds 62 tokens to every session and 1,457 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.

Related

Other skills, from other repositories

dsh-sdk-upgrade

Safely select and install a compatible official @deepseek-ai SDK release for dsh plugin projects (dsh-web, dsh-trading, and similar monorepos) from npm using an isolated worktree, explicit cohort review, CI-equivalent validation, and controlled rollout — including syncing the project's declared DSH host-version floor…

zhu1090093659/dsh-web · 176 tokens

dsh-web-sdk-compatibility

Adapt and repair dsh-web after an approved official @deepseek-ai SDK/runtime cohort is selected or installed. Compare public API, type, service-injection, module-table, protocol, and behavior changes; map every change to repository consumers; implement the smallest fixes and durable compatibility contracts; handle…

zhu1090093659/dsh-web · 107 tokens

ov-experience-memory

Retrieve and apply OpenViking Experience memories through the Agent runtime's generic OpenViking search and read tools. Use before or during executable, multi-step, or tool-based work such as coding, file or data changes, configuration, deployment, workflow execution, and failure recovery when prior operational…

volcengine/OpenViking · 78 tokens

audit-playbook

A code-security audit playbook covering source-code review, runtime checks, software dependencies, deployment settings, and AI-agent security risks.

SeaOf0/dsh-redteam-model · 155 tokens

x64dbg-reversing

Perform dynamic reverse engineering and debugging using X64dbg/X32dbg through natural language commands powered by X64dbg MCP. Use this skill whenever the user wants to: debug executables, analyze program behavior at runtime, set breakpoints, inspect memory and registers, trace execution flow, bypass anti-debug…

SeaOf0/dsh-redteam-model · 144 tokens

ctf-playbook

A playbook for solving capture-the-flag challenges, where competitors find a hidden proof string called a flag.

SeaOf0/dsh-redteam-model · 367 tokens