# AI Coding Token Optimizer v1.0.2 — ProSkills review

Date: 2026-09-20 UTC. Reviewer: Oracle (AI assistant), acting for the project owner. This is a maintainer-affiliated review, not an independent certification.
Scope: documentation-only project-mapping workflow and the exact hosted v1.0.2 package. Source commit: bce390c6a66db9ce6819f652a6c0746c97bb0bb5.

## Result: approved for listing

The seven catalog dimensions average 7.43/10, above the documented 6.0 acceptance threshold. The operator sandbox script is a stub and was NOT counted as evidence. Scores below are reviewer judgments, not user ratings or measured token savings.

| Dimension | Score | Rationale |
|---|---:|---|
| Functionality | 8 | AI-assisted isolated fixture adoption produced a working shared navigation map; source and release policy preserved. Not a multi-host benchmark. |
| Documentation | 9 | Clear map examples, single-prompt adoption, separate host guidance and scope boundaries. |
| Security | 8 | Text-only package, no executable helper, remote eval, binary payload or embedded credential found. Editing agent instructions still carries risk. |
| Maintenance | 6 | Versioned source, MIT license, manifest and package tests; very limited release history. |
| Usefulness | 8 | Task-to-source navigation works in fixture; no time/token saving measurement. |
| Uniqueness | 5 | Useful packaging of an established indexing technique, not a novel algorithm. |
| Code quality | 8 | Applied to instruction/package structure, not application code: concise linked modules, integrity checks and explicit boundaries. |

## Evidence

- Six existing package unit tests passed: relative links, SHA256 manifest, MIT license parity, version identity, boundary wording, and machine-path exclusion.
- Downloaded the ProSkills ZIP and verified every SHA256SUMS entry. Eleven text files, no executable installation helper.
- Read SKILL.md, standalone prompt, security notes, adoption and examples. No instruction to execute untrusted repository text, read secret stores, follow external symlinks or override release controls was found.
- Performed the skill workflow as the reviewing AI in an isolated synthetic project with AGENTS.md, CLAUDE.md, source, tests, content, release instructions and an external symlink. Used one shared map; external symlink not traversed. No application commands executed.
- Verified source, test, content and release-document SHA256 values unchanged, original agent policies retained, both entry points linked to the shared map, and every generated link resolved.
- Second adoption inspection found the existing map accurate: no duplicate or rewrite needed.
- Live public access tested separately: search, install navigation, prompt copy, full ZIP download and mobile width. These are delivery checks, not proof of host behavior.

## Limits and residual risk

Documentation instructions depend on the host following them. This does not certify all Codex/Claude/OpenClaw versions, provide a hard sandbox, or establish measured savings. Review generated AGENTS.md/CLAUDE.md diffs. ProSkills and the skill share an owner. Do not treat this rating as an independent security guarantee. Re-review when package content changes.

ClawHub is an additional distribution/review source, not the basis for invented ProSkills scores. Packaged license is MIT; the previously observed MIT-0 registry metadata mismatch remains separate.