Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add zhuanggenhua/BoardGame --skill config-review-workflowgit clone --depth 1 https://github.com/zhuanggenhua/BoardGameWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/zhuanggenhua/boardgame/config-review-workflow)<a href="https://agentmods.dev/skills/zhuanggenhua/boardgame/config-review-workflow"><img src="https://agentmods.dev/badge/skills/zhuanggenhua/boardgame/config-review-workflow/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/zhuanggenhua/boardgame/config-review-workflow"><img src="https://agentmods.dev/badge/skills/zhuanggenhua/boardgame/config-review-workflow.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00102 | $0.03079 |
| Opus 5 | $0.00051 | $0.01540 |
| Sonnet 5 | $0.00020 | $0.00616 |
| Haiku 4.5 | $0.00010 | $0.00308 |
Grade A, and why
config-review-workflow scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 112 lines — stays where its author put it; the contents beside it link to each section on GitHub.
配置审查工作流
适用边界
把“配置表”当作由正式配置物化出来的审查视图,而不是另造一份数据。这个工作流覆盖新游戏严格 JSON 配置、已有 TypeScript 配置、注册表、构筑器、manifest 和只读审查 adapter;不把某个游戏的字段名、目录、素材别名或路由复制成系统规则。
遇到图片、规则书、PDF、截图、图集或卡面/房间图文字时,同时走项目的数据录入 workflow 和安全图片读取入口;本 skill 负责配置字段与配置入口,不替代图片取证流程。
入口路由
按以下顺序找文档和实现,不凭文件名猜入口:
- 先读当前项目的文档索引,找到“配置表 / 配置审查 / 数据录入 / 该游戏专项 workflow”入口。
- 读取配置包规范,确认严格 JSON、旧游戏 adapter、玩家可见字段、结构化修正提案和表格验收口径。
- 若字段来自图片或规则源,读取数据录入 workflow 和安全图片读取 workflow,先形成可复查合同。
- 读取目标游戏专项 workflow、配置注册表/构筑器/manifest、现有审查 adapter、表格页面和相关测试。
- 将专项路径、字段和样例留在项目文档;通用层只保留可复用审查方法。
审查 UI 复用边界
配置审查 UI 的职责是承载同一类“表格审查、字段编辑、待提交修正、错误提示、分页、横向滚动和反馈提案”流程。只要项目中已经存在配置审查表或同等工作台,新游戏或新对象接入时默认复用同一套审查工作台;游戏侧只提供 adapter、字段定义、显示 formatter、解析器、筛选项、素材预览或音频试听等扩展点。
- 新增配置表页面前,必须先对比已有配置表页面 / 工作台,判断能否通过 props、slot、adapter 或 formatter 扩展;不得为每个游戏复制一套表格状态、可编辑单元格、提案构建、分页和滚动逻辑。
- 共享工作台不得承载某个游戏的真相源规则、区域连通、牌组构筑、素材别名、场景逻辑或字段取值;这些仍留在游戏 adapter、运行时配置和专项 workflow。
- 如果确实不能复用,必须说明阻止复用的现实差异、已有工作台缺口、最小扩展成本,以及为什么新建页面不会形成第二套流程真相。
- 页面验收不能停在隐藏路由可打开;必须从用户真实入口进入配置表,证明入口、筛选、分页、编辑、提案 payload 和游戏特有扩展都仍指向同一正式源。
素材字段可见性
配置表用于人工核对时,凡字段真相依赖图片、图集、PDF 页面、卡面、房间图、地图格、音频或其它素材本体,主表必须展示可直接核对的素材结果,或提供同屏可发现的预览 / 放大 / 试听入口。素材 ID、路径、图集名、帧号、索引、裁切坐标和 debug key 只能作为定位信息、隐藏上下文或维护者辅助列;不得把它们当作素材本体展示,也不得用“素材定位字段已存在”宣称配置表可核对。
- 如果核对目标是空间、方向、邻接、文字 OCR、卡面数值、图标、门位、地图格或类似视觉事实,验收图必须让用户能看到对应源图或放大入口,并能把源图与待核字段关联起来。
- 如果正式源已有素材解析器、图集样式函数、卡图组件、音频试听组件或其它可复用渲染入口,配置表必须优先复用这些入口;不得在表格页面手写第二套素材真相。
- 如果素材不可读、缺失、冲突或当前工作台还不能展示,相关字段标为
blocked/disputed,并把缺口写进差异清单;禁止只显示 ID / 帧号后把表格判为PASS。
配置字段交互性
配置表不是只读索引,也不是给维护者猜路径的文本框。凡字段值来自有限合法集合,必须先设计并验收可选候选交互,再把自由文本输入当作补充能力。
- 有限合法集合包括素材 manifest、图片目录、token 目录、角色 / 卡牌 / 房间 / 派系对象全集、枚举、规则对象列表、音频注册表和其它正式索引。
- 这类字段默认交互是:
点击当前值或素材预览 -> 展示合法候选集合 -> 用户选择候选 -> 写入待提交草稿 / 修正提案。候选项必须显示玩家能核对的名称、缩略图或可试听 / 可预览结果;路径只能作为辅助定位信息。 - 面向玩家、配置者或人工审查者的主交互不得把内部路径、素材 ID、字段 key、文件名或源码路径作为主要可见标签。候选卡、按钮、主表字段和提案弹窗的主标签必须是玩家可识别名称、缩略图、业务状态或可预览结果;路径只允许进入
title、data-*、payload、隐藏上下文、折叠技术信息或维护者辅助列。 - 当候选对象的可识别性主要来自图像本体,例如地图 token、骰面、图标、卡背或其它纯视觉资源时,不得为了替代路径而生成“候选 01 / 正式素材候选”这类无决策价值标签;主 UI 应直接展示候选图块、选中态和必要的最短动作提示,技术定位仍只放辅助上下文。
- 素材关联字段必须按现实职责拆成独立字段;例如玩家面板资源和地图 token 是两个独立字段时,候选来源、预览、写入字段和提案字段路径都必须分开,不能用一个通用素材格或一个文本框混用。
- 自由文本编辑只允许作为高级 / 兜底入口;使用它时必须有合法性校验、错误提示和明确“不会直接改正式源,只生成修正提案”的语义。不能把自由文本可编辑当作候选字段交互已完成。
- E2E 验收必须覆盖真实用户动作链:打开配置表、定位对象、点击字段或素材本体、候选列表出现、选择候选、待提交修正计数变化、提交后提案 payload 或弹窗显示当前值与修改后值。只断言字段存在、搜索命中或文本输入可用,不足以证明交互设计合格。
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 112 lines · 102 tokens per session scan A ff03f8260da2
config-review-workflow is a skill published in the GitHub repository zhuanggenhua/BoardGame (23 stars, last pushed yesterday), licensed MIT. It adds 102 tokens to every session and 3,079 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
systematic-debugging
Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.
local-ai-agents
Build local-first AI agents that run entirely on a developer workstation with Microsoft Foundry Local and Qwen function-calling models. Covers Small Language Models (SLMs), the OpenAI-compatible local endpoint, sandboxed local tools, local RAG with Chroma, local MCP servers, hybrid cloud/local routing, and the…
next-cache-components-adoption
Turn on Cache Components in a Next.js app and resolve the blocking routes it surfaces. Use when the user wants to enable, adopt, or migrate to Cache Components, flip the cacheComponents flag, work through a flood of blocking-prerender / instant validation errors, run the cache-components-instant-false codemod, or…
insight-error-page
Write or audit an insight-kind error page for the Next.js dev overlay. Use when creating a new errors/ .mdx page, auditing an existing one, or checking that a page matches the framework fix cards. Covers page structure, title alignment, FixCard cards with Copy prompt button, code snippets, terminology verification…
next-cache-components-optimizer
Drive a Next.js route to instant navigation by setting up an agentic loop, under Cache Components / PPR, on initial load (hard navigation) and client-side navigation (soft navigation). Encode the goal as a failing @next/playwright instant() e2e and work it to green, one verified route at a time; the shipped test then…
next-partial-prefetching-adoption
Turn on Partial Prefetching in a Next.js app and work through the insights it surfaces. Use when the user wants to enable or adopt Partial Prefetching, flip the partialPrefetching flag, opt routes in with export const prefetch = 'partial', audit Link prefetch={true} behavior, preserve existing prefetched UI with…