What is skill-optimizer?

A Chinese-language audit and optimization guide for existing coding-agent skills. It examines how a skill is sourced, packaged, installed, loaded, and used in a real task.

Use it to audit or improve one skill, including links, versions, package contents, unused files, structure, dependencies, platform compatibility, and whether the installed skill actually runs.

It helps separate real problems from harmless complexity and prevents changes that break required behavior, ownership, permissions, or delivery paths.

skill-optimizer — Skill for Codex by WiseWong6/wise-skills

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add WiseWong6/wise-skills --skill skill-optimizer

Clone the repo

git clone --depth 1 https://github.com/WiseWong6/wise-skills

Made for: Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/wisewong6/wise-skills/skill-optimizer/github.svg)](https://agentmods.dev/skills/wisewong6/wise-skills/skill-optimizer)

Your own site

<a href="https://agentmods.dev/skills/wisewong6/wise-skills/skill-optimizer"><img src="https://agentmods.dev/badge/skills/wisewong6/wise-skills/skill-optimizer/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/wisewong6/wise-skills/skill-optimizer"><img src="https://agentmods.dev/badge/skills/wisewong6/wise-skills/skill-optimizer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 154 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 3,130 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits

NVIDIA SkillSpector pass 7 Sept 2026

How audits are shown

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00154	$0.03130
Opus 5.5	$0.00062	$0.01252
Sonnet 5.5	$0.00031	$0.00626
Haiku 4.5	$0.00015	$0.00313

Measured 1mo ago against content hash 6fdb0e4dff75, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

skill-optimizer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.

The scan reads SKILL.md. This mod also ships 9 executable files (scripts/audit_skill.py, scripts/skill_audit/__init__.py, scripts/skill_audit/core.py, …), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skill-optimizer/SKILL.md · 146 lines

How it starts

The opening of the file, as written. The whole thing — 146 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Skill Optimizer

目标与边界

把 Skill 当成可执行产品，以一条可复核证据链完成诊断和优化：

权威源码 → 发行载荷 → Agent 安装入口/软链 → Agent 实际加载 → 真实任务

一个规则、资源和版本坐标只有一个主人；开发、发行、安装和运行职责分离。依赖允许存在，但必须说明用途、阶段、体积、引入路径和替代边界。优化不能删除必要的正确性、安全、权限、许可证、来源或用户入口。

每次只处理一个目标 Skill。范围外问题记录证据和建议，不擅自扩大修改面。

选择模式

用户说“审计、诊断、评估”时保持只读，只交付问题、影响、证据和建议。
用户说“优化、精简、修复”时先用通俗中文说明处理方向。已有明确授权且范围未变时直接实施，不重复确认；只有范围不清或新增高风险操作尚未获准时才询问。
只读审计不写文件；修改不得超出已授权范围，不自动删除候选文件或猜测软链目标。
目标用户、核心任务或输出合同需要改变时，说明这已是新 Skill，改用 skill-creator，不静默重建。

按改动范围选择流程

说明文字、排版、已明确的调用偏好：确认权威文件和受影响的安装入口，检查改动差异、引用及元数据格式；无需例行运行全量审计、重新打包或启动新 Agent。
提示词或工作流行为：检查规则冲突，用代表性输入推演预期分支；改动依赖模型实际表现时，再做真实调用验证。文字推演不能当作实际运行证据。
脚本、依赖、文件删除、安装或发行变化：读取相关判据，检查受影响的链路，运行相应测试；删除候选仍须满足生命周期判据中的完整确认链。
用户要求完整生命周期审计或全链路验收时，覆盖源码、发行、安装和真实调用；不要把这套流程强加给局部修改。

先读哪份规则

审计软链、发行 manifest、版本、死重或结构时，必须按需读取生命周期审计判据。它定义证据图、引用入边、候选分类、结构矩阵、阻断级别和死重确认流程。

检查 Codex 或 RedSkill 的 frontmatter/目录政策时，再读取平台 Schema Profile。平台推荐结构与通用正确性分开报告；RedSkill 的上传白名单、identifier、审核阈值和线上版本仍归 redskill-pack，不迁入本 Skill。

审计测试脚本膨胀、case-by-case、重复 runner 或测试结构时，必须读取测试体系审计合同。测试语义归目标 Skill 的权威源码仓所有；本 Skill 只校验仓内声明、执行边界与文件覆盖，不靠通用正则替源仓决定哪些测试应该合并。

建立问题合同

先明确本次要解决的问题、权威修改位置、预期结果和验证方式。涉及发行或安装时，再核对谁维护、谁发布、谁安装、谁执行；故障诊断补充实际行为、最小复现和失败信号。

完整生命周期审计需分开核对以下项目；局部修改只检查受影响的项目：

权威源码及 Git HEAD/dirty；本地 upstream 不是实时远端，需要当前远端事实时才只读查询。
发行目录或压缩包、发行 manifest、source_commit 与文件哈希。
每个 Agent 的入口原路径、readlink 每一跳和最终 realpath。
安装副本是否为软链、共享目录或独立副本，内容是否漂移。
Agent 是否真的加载该 Skill 并完成代表任务；静态解析成功不能冒充真实运行成功。

不通过目录名猜开发仓或发行仓。只有目标本身是显式 source、显式 --source，或发行 manifest 的可信关系能确立权威边。发现无关未提交改动时保留；与目标重叠且无法安全区分时暂停确认。

按需运行只读审计

结构、入口、发行、依赖或测试体系审计使用下列工具；纯文字调整不要求运行。

python3 <本 Skill 目录>/scripts/audit_skill.py <目标 Skill 目录> \
  --surface <auto|source|release|installed> \
  --profile <auto|general|review> \
  --schema-profile <auto|codex|redskill> \
  --source <权威源码 Skill 目录> \
  --release-manifest <发行 manifest 路径> \
  --agent-entry codex=<Codex 安装入口> \
  --agent-entry agents=<Agents 安装入口> \
  --supported-node-majors 22,24 \
  --metafile <esbuild metafile 路径> \
  --test-system-contract <源仓 test-system.json> \
  --format json

Read the full file on GitHub · 146 lines

Files

What ships with it

15 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

1mo ago Changed · -3 lines · +6 tokens per session 6fdb0e4dff75
2mo ago Changed · +8 lines · +15 tokens per session d76a98804ca5
2mo ago First seen · 141 lines · 133 tokens per session scan A 60276b871092

Subscribe to this mod's changes

skill-optimizer is a skill published in the GitHub repository WiseWong6/wise-skills (11 stars, last pushed 23d ago), licensed MIT. It adds 154 tokens to every session and 3,130 once invoked, about $0.0006 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Building agents

skill-optimizer next to 6 skills from other repositories
Mod	Type	Stars	Last push	Licence	Scan	Tokens	Works with
skill-optimizerWiseWong6/wise-skills	Skill	11	23d ago	MIT	A	154	Codex
imagegenopenai/codex	Skill	133k	yesterday	Apache-2.0	A	113	Codex
playwright-climicrosoft/playwright	Skill	99k	yesterday	Apache-2.0	A	19	Claude Code
local-ai-agentsmicrosoft/ai-agents-for-beginners	Skill	79k	4d ago	MIT	A	200	Claude Code, Codex
systematic-debuggingobra/superpowers	Skill	313k	3d ago	MIT	A	21	Claude Code
next-cache-components-adoptionvercel/next.js	Skill	143k	yesterday	MIT	A	95	Claude Code
next-partial-prefetching-adoptionvercel/next.js	Skill	143k	yesterday	MIT	A	103	Claude Code