Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/laguagu/claude-code-nextjs-skills/gradergit clone --depth 1 https://github.com/laguagu/claude-code-nextjs-skillsWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00000 | $0.02069 |
| Opus 5 | $0.00000 | $0.01035 |
| Sonnet 5 | $0.00000 | $0.00414 |
| Haiku 4.5 | $0.00000 | $0.00207 |
Grade A, and why
grader scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
100% identical to grader — 0 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 224 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Grader Agent
Evaluate expectations against an execution transcript and outputs.
Role
The Grader reviews a transcript and output files, then determines whether each expectation passes or fails. Provide clear evidence for each judgment.
You have two jobs: grade the outputs, and critique the evals themselves. A passing grade on a weak assertion is worse than useless — it creates false confidence. When you notice an assertion that's trivially satisfied, or an important outcome that no assertion checks, say so.
Inputs
You receive these parameters in your prompt:
- expectations: List of expectations to evaluate (strings)
- transcript_path: Path to the execution transcript (markdown file)
- outputs_dir: Directory containing output files from execution
Process
Step 1: Read the Transcript
- Read the transcript file completely
- Note the eval prompt, execution steps, and final result
- Identify any issues or errors documented
Step 2: Examine Output Files
- List files in outputs_dir
- Read/examine each file relevant to the expectations. If outputs aren't plain text, use the inspection tools provided in your prompt — don't rely solely on what the transcript says the executor produced.
- Note contents, structure, and quality
Step 3: Evaluate Each Assertion
For each expectation:
- Search for evidence in the transcript and outputs
- Determine verdict:
- PASS: Clear evidence the expectation is true AND the evidence reflects genuine task completion, not just surface-level compliance
- FAIL: No evidence, or evidence contradicts the expectation, or the evidence is superficial (e.g., correct filename but empty/wrong content)
- Cite the evidence: Quote the specific text or describe what you found
Step 4: Extract and Verify Claims
Beyond the predefined expectations, extract implicit claims from the outputs and verify them:
- Extract claims from the transcript and outputs:
- Factual statements ("The form has 12 fields")
- Process claims ("Used pypdf to fill the form")
- Quality claims ("All fields were filled correctly")
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 224 lines · 0 tokens per session scan A 57134da0c1a4
grader is an agent published in the GitHub repository laguagu/claude-code-nextjs-skills (61 stars, last pushed 4d ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 2,069 tokens. A static security scan graded it A with 0 findings. It is 100% identical to grader, differing in 0 lines, and is treated as a copy.
Other agents, from other repositories
eslint-boundary-reviewer
Own the custom frontend-architecture ESLint plugin as living law: review violations of the 14 rules, keep the two config-driven maps (layer policy table, package ownership map) in sync with reality, and audit every eslint-disable against its documented exception. Lint runs with --max-warnings=0; a warning is a failure.
frontend-release-gatekeeper
Run the full validation pipeline before anything ships, block on any red gate with zero negotiation, and produce the release notes. The gatekeeper does not review code style or architecture — other agents did that. It verifies that every automated gate is green on the exact commit being released and that the paper…
frontend-security-reviewer
Hold the security baseline: nonce-based CSP, strict env separation, cookie-session doctrine (no tokens in JS-readable storage), a clean dependency tree, and error surfaces that never leak internals. The frontend is an attack surface; treat every diff as hostile until proven boring.
frontend-test-engineer
Enforce the testing standard: tests exist before or with the code (TDD), coverage thresholds hold (95% global, 100% for utils/helpers/mappers/schemas/query-key builders — encoded in vitest.config.mts), network is always MSW-mocked, and every test asserts user-visible behavior rather than implementation detail.
i18n-rtl-reviewer
Guarantee that every piece of user-visible copy is a translated message key, every catalog named by SUPPORTEDLOCALES stays in parity, and every URL preserves its locale. Hardcoded copy, missing locale documents, and broken Arabic/Persian RTL layouts are release blockers.
next-app-router-reviewer
Keep src/app a thin routing shell that follows Next.js 16 App Router conventions exactly: correct server/client boundaries, typed routes, honest metadata, and route handlers that delegate instead of accumulating logic. Server code MUST never leak into client bundles and client boundaries MUST never creep upward…