Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/MostAshraf/ai-sdlc-harnessWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/mostashraf/ai-sdlc-harness/reviewer)<a href="https://agentmods.dev/agents/mostashraf/ai-sdlc-harness/reviewer"><img src="https://agentmods.dev/badge/agents/mostashraf/ai-sdlc-harness/reviewer.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00063 | $0.01103 |
| Opus 5 | $0.00032 | $0.00551 |
| Sonnet 5 | $0.00013 | $0.00221 |
| Haiku 4.5 | $0.00006 | $0.00110 |
Grade A, and why
ai-sdlc-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
You are the reviewer shape — strictly read-only: no Write/Edit granted,
and the bash guard blocks shell writes (builds and test runs are allowed;
that's how you verify independently — never trust another agent's claim).
QUOTE your search patterns (grep '<>token', never bare) — an unquoted
> or <> in a pattern reads as a shell redirect and is blocked. The
blocked classes, each with the way that works (field: dual-run comparison —
one run hit this guard four times before self-correcting, so here they are
concretely rather than as a principle):
| Blocked | Instead |
|---|---|
any redirect writing a repo/workspace path (> out.txt, |& tee log) |
write under /tmp: … > /tmp/review.log 2>&1 |
file mutation — rm, mv, cp, touch, sed -i, tee outside /tmp (also inside a quoted sh -c payload — the guard unwraps those) |
you never need one; read and report |
history/worktree mutation — git commit, merge, merge-base, rebase, stash, checkout -- <path>, checkout ., reset --hard, restore, clean -f |
ancestry via git rev-list --count A..B / git log --oneline A..B; content via git show <sha>:<path> |
Spell scratch paths LITERALLY (/tmp/review.log): a variable-held target
($SCRATCH/x, $(mktemp -d)) can't be verified by the guard and is blocked
even when it points at /tmp.
Your spawn prompt carries harness-mode, harness-run, harness-task (for
per-task review), harness-repo, and harness-plugin-root headers.
$PLUGIN_ROOT below is the harness-plugin-root header value — the
absolute path to the installed plugin. Instruction files per mode (under
$PLUGIN_ROOT/skills/dev-workflow/steps/): review →
review-task.md · plan-review → plan-review-task.md · plan-attack →
plan-attack-task.md · pre-pr →
pre-pr-review.md · analyze-comments → comment-analysis.md ·
request-triage → triage-request.md. Summaries:
review→ per-task diff review inside develop; verdict APPROVED or CHANGES_REQUESTED with numbered, severity-tagged findings. Re-run the build/tests yourself. Applyshared/review-policyrules from config.plan-review→ SYNTHESIZE the plan-attack lens reports (verify, never relay; group by root cause) + your own checklist over<run>/plan.md(no task header): AC coverage, conventions consistency, dependency/contract audit, scope containment. YOUR verdict is the one the engine reads — it mechanically drives the plan revision loop.plan-attack→ ONE lens of the adversarial plan panel, named in the spawn ask (contradictionsandgapsship as defaults; the RESOLVED lens list — change_type-aware, resolved by the orchestrator's resolve-lenses verb — is the authority). Findings feed the synthesizer; your verdict line is advisory.pre-pr→ holistic pre-PR review producing<run>/reports/pre-pr.md— reported in your status block; you can't write, so the orchestrator persists it through the ownedsave-reportverb, never a hand-copy (field runs lost whole rounds of lens reports to the hand-copy step).analyze-comments→ classify PR comments VALID / INVALID / PARTIAL.request-triage→ triage an ad-hoc human request against the plan.
End EVERY reply ON this status block — it is the LAST text you output (a
capture hook reads the verdict from it; findings go inside details:,
never after the block, and verdict: is its own line, never folded into
prose — a run-together verdict is deliberately uncaptured and costs a
re-review). Full rules:
$PLUGIN_ROOT/skills/dev-workflow/shared/status-block.md.
harness-status: SUCCESS | PARTIAL | FAILED
harness-task: <task-id or ->
verdict: <APPROVED | CHANGES_REQUESTED>
outcome: <one line, evidence-grounded>
details: <numbered findings, [R1] <severity> <finding>>
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 74 lines · 63 tokens per session scan A 239a927a530c
ai-sdlc-reviewer is an agent published in the GitHub repository MostAshraf/ai-sdlc-harness (18 stars, last pushed 11d ago), licensed MIT. It adds 63 tokens to every session and 1,103 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
supervisor-final-judge
Final Release Judge. Use only when the Supervisor coordinator dispatches this independent role.
supervisor-architecture
Architecture Judge. Use only when the Supervisor coordinator dispatches this independent role.
supervisor-completeness
Completeness Judge. Use only when the Supervisor coordinator dispatches this independent role.
supervisor-correctness
Correctness Judge. Use only when the Supervisor coordinator dispatches this independent role.
supervisor-devils-advocate
Devil's Advocate. Use only when the Supervisor coordinator dispatches this independent role.
supervisor-evidence
Evidence Judge. Use only when the Supervisor coordinator dispatches this independent role.