Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/fallow-rs/fallow/ci-formats-reviewergit clone --depth 1 https://github.com/fallow-rs/fallowWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00028 | $0.01254 |
| Opus 5 | $0.00014 | $0.00627 |
| Sonnet 5 | $0.00006 | $0.00251 |
| Haiku 4.5 | $0.00003 | $0.00125 |
Grade A, and why
ci-formats-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 135 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Review changes to fallow's CI-oriented output formats. Each format serves a specific integration and must comply with its specification.
Formats and their specs
SARIF (sarif.rs)
- Must comply with SARIF 2.1.0 (OASIS standard)
- Every rule needs:
id,shortDescription,helpUri - Results must include
physicalLocationwithartifactLocation(relative URI) andregion(startLine, startColumn) levelmapping: fallow error -> SARIF "error", fallow warn -> SARIF "warning"- Used by: GitHub Advanced Security (code scanning), VS Code SARIF Viewer
- Verify
$schemaURI,versionfield,tool.drivermetadata
CodeClimate (codeclimate.rs)
- Must comply with GitLab Code Quality specification
- JSON array of issue objects (not wrapped in an envelope)
- Required fields:
type,check_name,description,categories,severity,fingerprint,location - Fingerprint must be deterministic (FNV-1a hash from rule_id + identifier)
- Severity mapping: Error -> "major", Warn -> "minor"
- Categories: "Bug Risk" (dead code), "Duplication", "Complexity"
- Used by: GitLab CI inline MR annotations
Compact (compact.rs)
- One issue per line, grep-friendly
- Format:
issue-type:path:line:name - Must be parseable by shell scripts (no special characters in delimiters)
- Deterministic ordering
Markdown (markdown.rs)
- GitHub/GitLab-compatible markdown
- Collapsible
<details>sections for large output - Relative paths with backtick escaping
- Used by: PR comments (action/ and ci/ scripts consume this)
Badge (badge.rs)
- Shields.io flat SVG format
- Must be valid SVG that renders in browsers and GitHub README
- Letter grade (A-F) with correct color mapping
- Self-contained (no external font references)
What to check
- Spec compliance: Does the output validate against the official schema?
- Determinism: Same input produces identical output across runs
- Severity mapping: Consistent translation from fallow severity to format-specific severity
- Path handling: All paths relative, no platform-specific separators in output
- Integration testing: Do consumers (GitHub/GitLab scripts, remaining summary/annotation jq, typed PR/MR renderers) still parse the output correctly after changes?
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 135 lines · 28 tokens per session scan A e4a4f7e55b39
ci-formats-reviewer is an agent published in the GitHub repository fallow-rs/fallow (4,429 stars, last pushed yesterday), licensed MIT. It adds 28 tokens to every session and 1,254 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
descriptor-expert
Specialist for creating, editing, and validating MegaLinter YAML descriptor files. Use when working on linter descriptors, adding new linters, or modifying linter configurations.
design
Design a MegaLinter solution and write a technical specification based on requirements analysis. Use after /analyze.
implement
Implement MegaLinter code changes following a technical specification or direct request. Use after /design, or directly for small focused changes.
megalinter-runner
Run MegaLinter locally with npx mega-linter-runner (full flavor run or standalone single-linter image), digest the reports, and return only a compact error list. Use to keep verbose linter output out of the main context. Runs and reports only — never fixes source files.
analyze
Gather requirements for a MegaLinter change by asking clarifying questions until the problem is fully understood. Use before designing or implementing any change.
test-debugger
Debug failing MegaLinter linter tests. Use when tests fail, test fixtures need fixing, or Docker-based test execution needs troubleshooting.