Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/summersec/sumsec-skills/skill-optimizernpx skills add SummerSec/SumSec-Skills --skill skill-optimizergit clone --depth 1 https://github.com/SummerSec/SumSec-SkillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/summersec/sumsec-skills/skill-optimizer)<a href="https://agentmods.dev/skills/summersec/sumsec-skills/skill-optimizer"><img src="https://agentmods.dev/badge/skills/summersec/sumsec-skills/skill-optimizer.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00051 | $0.03261 |
| Opus 5 | $0.00026 | $0.01631 |
| Sonnet 5 | $0.00010 | $0.00652 |
| Haiku 4.5 | $0.00005 | $0.00326 |
Grade A, and why
skill-optimizer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 118 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Skill Optimizer
路径选择
| 路径 | 行为 | 典型触发 |
|---|---|---|
| A — 结构化改写 | 读目标 skill → 诊断与计划 → 用户确认后才改 SKILL.md / references / scripts |
用户附着或指定路径、说「改 description」「拆 references」「加确认步骤」 |
| B — 会话审计 | 扫描本机 skill 目录与历史会话 jsonl,只输出报告,绝不写 skill 文件 | /optimize-skill、/skill-audit、「分析我所有 skills」「skill 从不触发」「只审计不要改」 |
判定: 用户明确「只分析 / 只出报告 / 不要改」→ B。用户点名要改某 skill 且未禁止写文件 → A(无确认仍不得改)。「先看全局再改」→ 先做 B,再在用户要求下对单项切 A。
共用规则
- 官方规范优先(双轨):每次启动先执行下方 Step 0 — Fetch Spec(三级降级:代理 → 直连 → 本地缓存),未完成前禁止进入诊断、计划或改写阶段。
- 路径 B:只读。 不得修改任何 skill 文件,只交付报告(Step 0 对缓存文件的覆盖是允许的例外,因为它属于 skill 自身的资产更新而非被审计 skill 的修改)。
- 路径 A:确认门槛。 不得把「审查结论」与「直接改文件」混为一步;未确认不得改目标 skill。
- 路径 B:八维齐全。 不得跳过 references/session-audit-dimensions.md 中的 4.2、4.3、4.5b、4.8;缺数据写
N/A — insufficient session data。 - 量化与证据: 报告用次数、比例、日期范围;欠触发须引用真实用户原句;description 改写用建议语气并点明依据(静态表条目、官方规范条款或研究结论)。
- 范围克制: 用户只要某一方向(如只改 description)时,围绕该方向计划,不擅自整 skill 重写;不要为了「全面」把无关 reference 全读进上下文。
- 路径统一用
${CLAUDE_SKILL_DIR}: 任何「读 / 写 / 引用本 skill 资源」的动作(含脚本、Bash、Read、Write、WebFetch后落盘)都使用${CLAUDE_SKILL_DIR}/...形式,不写死绝对路径,不写仓库相对路径。
Pipeline 类 skill 的特别处理
当目标 skill 在 Step 2 Review 中被判定为 Pipeline(主模式或次模式),或满足 ≥3 个 workflow-skill-creator 适用信号(≥3 顺序步骤 / 跨步骤状态传递 / 需脚本辅助 / 需进度文件 / 强制顺序、跳步导致失败),按以下规则叠加评审基准:
- 必读资产:
${CLAUDE_SKILL_DIR}/../workflow-skill-creator/references/architecture_patterns.md(六大架构模式)与quality_checklist.md(七维自检) - 基准合并:Step 5 Verify 须在
review-checklist.md之上叠加 workflow-skill-creator 的 quality_checklist;针对编排专门规范遇冲突时以 workflow-skill-creator 为准 - Plan 输出义务:Step 3 Plan 必须在末段写明「目标 skill 已识别为 Pipeline,对照 workflow-skill-creator 六大模式逐项核对」并列出未达标项
- 跨 skill 路径:两 skill 同属
agents-devplugin,故用${CLAUDE_SKILL_DIR}/../workflow-skill-creator/...引用;若日后被拆到不同 plugin,需改为目标 plugin 的解析路径
路径 B 工作流(概要)
- Step 0 — Fetch Spec:执行下方「Step 0 详细流程」;本轮基准来自最新抓取或
${CLAUDE_SKILL_DIR}/references/official-spec-fetch.md缓存。 - 锁定范围:
/optimize-skill全量,或/optimize-skill a b指定多个 name。 - 发现 skill:按 session-audit-dimensions.md 中的目录顺序扫描并去重,读 frontmatter 与步骤结构。
- 采集会话:Claude Code / Codex jsonl 字段差异见该文档;Codex 注意「加载 ≠ 已按 skill 执行」。
- 跑满八维 + 综合分:表格、权重、报告骨架均见该文档;遇到与官方规范不一致处,须在报告中以「依据:官方规范 §X」标注。
- 输出:使用该文档中的 Report Format;P0 / P1 / P2 分级;报告首段写明「本轮使用的官方规范来源(live / cache)+ fetched_at」。
What ships with it
5 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 118 lines · 51 tokens per session scan A 4979b2be4a6b
skill-optimizer is a skill published in the GitHub repository SummerSec/SumSec-Skills (8 stars, last pushed 20d ago), licensed Apache-2.0. It adds 51 tokens to every session and 3,261 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
dsh-web-pre-push-checks
Use before pushing, opening or updating a pull request, or claiming dsh-web checks pass. Selects the required repository gates and diff-specific generation, build, and GUI evidence.
dsh-web-documentation
Use when adding or editing dsh-web README files, docs, AGENTS.md instructions, user-facing configuration text, or bilingual documentation pairs.
dsh-sdk-upgrade
Safely select and install a compatible official @deepseek-ai SDK release for dsh plugin projects (dsh-web, dsh-trading, and similar monorepos) from npm using an isolated worktree, explicit cohort review, CI-equivalent validation, and controlled rollout — including syncing the project's declared DSH host-version floor…
dsh-web-sdk-compatibility
Adapt and repair dsh-web after an approved official @deepseek-ai SDK/runtime cohort is selected or installed. Compare public API, type, service-injection, module-table, protocol, and behavior changes; map every change to repository consumers; implement the smallest fixes and durable compatibility contracts; handle…
ov-experience-memory
Retrieve and apply OpenViking Experience memories through the Agent runtime's generic OpenViking search and read tools. Use before or during executable, multi-step, or tool-based work such as coding, file or data changes, configuration, deployment, workflow execution, and failure recovery when prior operational…
dsh-doc-site-sync
Use when publishing, updating, moving, or removing DeepSeek Harness documentation website pages; editing website/docs.ts mappings or navigation; diagnosing a page missing from the VitePress site; fixing projected documentation links; or running the docs:dev, docs:check, and doc-sync workflow after website-content…