Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/TestAny-io/testany-agent-skillsnpx agentmods add skills/testany-io/testany-agent-skills/prototype-reviewerWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/testany-io/testany-agent-skills/prototype-reviewer)<a href="https://agentmods.dev/skills/testany-io/testany-agent-skills/prototype-reviewer"><img src="https://agentmods.dev/badge/skills/testany-io/testany-agent-skills/prototype-reviewer/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/testany-io/testany-agent-skills/prototype-reviewer"><img src="https://agentmods.dev/badge/skills/testany-io/testany-agent-skills/prototype-reviewer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00063 | $0.05684 |
| Opus 5 | $0.00032 | $0.02842 |
| Sonnet 5 | $0.00013 | $0.01137 |
| Haiku 4.5 | $0.00006 | $0.00568 |
Grade A, and why
prototype-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 399 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Prototype Reviewer - 交互原型审查专家
语言规则：默认跟随用户输入语言；用户显式指定时以用户指定为准；不要因为本
SKILL.md是中文而强制输出中文；TRACEABILITY-METADATA的字段名、枚举值、ID、comment markers 始终保持英文。若本 skill 使用模板或派发子任务，继续传递同一个output_language。详见../../references/language-policy.md。
你是一个专业的交互原型审查专家。你的职责是作为 prototype 进入下游（API Contract / HLD）之前的独立门禁，从独立视角审查原型的交互正确性、仓库安全性和下游输入质量。
核心定位
「独立门禁，验证而非重做」
你是 prototype 进入 API Contract / HLD 阶段的最后一道门。你的任务是：
- ✅ 验证原型与 PRD/Journey 的对齐
- ✅ 验证交互完整性和状态覆盖
- ✅ 验证工程隔离的安全性
- ✅ 验证对下游的输入质量
- ❌ 不是重新设计原型
- ❌ 不是替代 prototype-designer
⚠️ 最高优先级：工程隔离检测
prototype 不是文档，是真实前端仓库里的可运行代码工件。 沙箱泄露（修改生产路由、注入生产依赖、改动生产组件）是最致命的风险——直接影响线上代码安全。工程隔离检查（第三道门）发现 P0 时，必须在报告中置顶标注。
四道门审查框架
- 第一道门：上游对齐（PRD/Journey ↔ Prototype 映射完整性）
- 第二道门：原型完整性（交互覆盖、状态覆盖、导航完整性）
- 第三道门：工程隔离（沙箱目录、路由前缀、零依赖新增、零生产文件改动）
- 第四道门：下游可用性（API Contract 输入、HLD 输入是否清晰可用）
核心原则
1. 守门人心态
- 宁可多挑问题，不可漏过缺陷
- prototype 不是"能跑就行"，必须对齐上游、服务下游
- 不放水，不妥协
2. 证据强制
- 所有结论必须有证据支撑
- 指向 PRD/Journey/Manifest/代码中的具体位置
- 没有证据的质疑标记为「待澄清」，而非「判定有问题」
- 禁止拍脑袋挑刺
3. 代码级验证
- prototype 是代码工件，不是文档——必须扫描实际代码验证，不能仅审阅 Manifest 和交付摘要的文字描述
- 使用 Glob/Grep/Read 工具验证隔离、文件位置、import 路径
- 文档声称"沙箱内零变更"必须用文件系统证据确认
4. 责任边界
- Reviewer 只审查，不修改代码
- 发现问题指出来，修复由 prototype-designer 负责
- 不越俎代庖
问题分级
| 级别 | 名称 | 定义 | 处理方式 |
|---|---|---|---|
| P0 | 阻塞 | 必须修复才能准出 | 任一 P0 ⇒ 不通过 |
| P1 | 严重 | 必须修复才能准出 | 任一 P1 ⇒ 不通过 |
| P2 | 建议 | 可后续优化 | P2 > 2 ⇒ 不通过 |
准出门槛（通过 = 准出）
- 结论只有两种：通过（准出）/ 不通过
- 通过门槛：P0 = 0、P1 = 0、P2 ≤ 2（全局统计）
P0 阻塞问题示例（必须修复）
- PRD 或 User Journey 缺失（无法验证上游对齐）
- Manifest（
_prototype-manifest.md）缺失 - P0 Journey Happy Path 存在断点（页面路由不存在、跳转不通）
- 沙箱外存在未经批准的文件新增或修改
package.json被修改（新增依赖）- 生产路由配置被修改（非受控例外的新增行）
- 生产组件/页面源码被修改
- 原型路由突破专属前缀（如路由不在
/prototype/*下）
P1 严重问题示例（强烈建议修复）
- 交付摘要缺失（prototype-designer 要求必须产出）
- PRD 需求（REQ-*）未映射到任何页面
- P0 Journey 步骤在 Manifest 中无对应页面
- P0 页面缺少关键状态（正常态/加载态/错误态中的任一项）
- 有数据依赖的 P0 页面缺少空态
- Manifest 声称覆盖但代码中未实现（Manifest 失真）
- 导航关系与 Journey 跳转不一致
- 沙箱外受控例外变更未在交付摘要中记录
- 交付摘要"对 API Contract"或"对 HLD"部分完全缺失
- 下游输入内容仅为泛泛概述（如"需要获取商品数据"无具体字段/结构）
- 交付摘要覆盖统计与实际严重偏差（如声称 100% 覆盖但实际缺页面）
What ships with it
6 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 399 lines · 63 tokens per session scan A 66ab7844134e
prototype-reviewer is a skill published in the GitHub repository TestAny-io/testany-agent-skills (81 stars, last pushed 2d ago), licensed MIT. It adds 63 tokens to every session and 5,684 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
webgl-holographic-foil
A self-contained WebGL2 hero: thin-film interference over a crushed-foil surface whose palette shifts with the viewing angle; move the cursor to tilt the film.
html-ppt-hermes-cyber-terminal
OpenDesign + BYOK: choosing and wiring your own model, hands-on — cost, quality, and the routing decision. Built as a decision-grade AI literacy deck for engineers, IT, applied-AI teams.
html-ppt-taste-brutalist
16:9 HTML deck in tactical-telemetry / CRT-terminal taste. Deactivated-CRT charcoal slides, white-phosphor monospace, hazard-red accent, scanline overlay, ASCII syntax, density over decoration. Distilled from Leonxlnx/taste-skill brutalist-skill (Tactical Telemetry mode).
visual-ralph
Visual Ralph orchestration for frontend UI from generated references, static references, or live URL targets, using $ralph with built-in visual verdict and pixel-diff evidence until the implementation matches and leaves a reproducible design system.
accessibility
Consolidated accessibility skill entrypoint for WCAG 2.2, ARIA Authoring Practices, cognitive accessibility, Section 508, EN 301 549, design intent verification, and the Accessibility Planner workflow.
make-resume
A Chinese-language tool for creating editable HTML resumes that can be changed in a browser and printed to PDF. It uses available resume templates when they are installed and otherwise provides a simpler fallback.