Getting it into your agent
There is no command for this one: it runs only inside a plugin, and the catalogue could not identify which plugin ships it. The source is linked below.
Wrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/0x0w1/jig/jig-rubric-scan)<a href="https://agentmods.dev/skills/0x0w1/jig/jig-rubric-scan"><img src="https://agentmods.dev/badge/skills/0x0w1/jig/jig-rubric-scan/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/0x0w1/jig/jig-rubric-scan"><img src="https://agentmods.dev/badge/skills/0x0w1/jig/jig-rubric-scan.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00063 | $0.01449 |
| Opus 5 | $0.00032 | $0.00724 |
| Sonnet 5 | $0.00013 | $0.00290 |
| Haiku 4.5 | $0.00006 | $0.00145 |
Grade B, and why
jig-rubric-scan scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
5. `~/.agents/skills/jig-version-rubric/rubrics` or `~/.gemini/config/skills/jig-version-rubric/rubrics` (user-scope install). Copies of this mod
1 near-identical copy found in the catalogue:
- rubric-scan — 100% identical, 2 lines differ
How it starts
The opening of the file, as written. The whole thing — 84 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Rubric Scan
Use this repository skill to find out what kind of project this repository is, and which version rubric it should grade releases with. The scan reads the repository, scores it against the rubric catalog, and reports candidates with evidence. Writing .jig/versioning.md belongs to version-rubric; this skill never writes it.
Run it before setting a rubric for the first time, or when a project has changed enough that its old rubric no longer matches what it ships.
Catalog
The catalog is the set of rubric drafts shipped alongside version-rubric. Resolve its directory in this order and stop at the first hit:
JIG_RUBRIC_CATALOGenvironment variable (session-only override).${CLAUDE_PLUGIN_ROOT}/skills/version-rubric/rubrics(Claude Code plugin install)..agents/skills/jig-version-rubric/rubrics(Codex and Antigravity project install).skills/version-rubric/rubrics(running inside the jig repository itself).~/.agents/skills/jig-version-rubric/rubricsor~/.gemini/config/skills/jig-version-rubric/rubrics(user-scope install).
Read the rubrics/INDEX.md in that directory first. It carries the type list, the detection signals, and the scoring rules; the per-type bodies are only read for the types that actually become candidates.
If no catalog is found, do not guess type names. Report that the catalog is missing, name the paths that were checked, and fall back to recommending the default rubric through version-rubric.
Scan
Read only. Never modify a file, never install anything, never run a build.
- Inventory —
git ls-filesfor the tracked file list. Untracked build output and dependency directories are not evidence. - Shape — count files by extension and top-level directory. A repository whose tracked files are overwhelmingly documents or assets is graded by what those files promise, even when a stray script exists.
- Manifests — read the dependency and packaging files that exist (
package.json,pyproject.toml,Cargo.toml,go.mod,pubspec.yaml,Gemfile,*.csproj, and the like). Dependency names are the strongest single source of type evidence. - Entrypoints — look for what the project hands to someone: published package metadata, executable names, server routes, deployment manifests, site config, exported assets.
- Distribution — check
.github/workflows,Dockerfile,install.sh, release automation, and store or registry configuration for how a release reaches its consumers. - History —
git log --oneline -30and existing tags show what the project actually releases. A repository that only ever ships documents is graded as one.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 84 lines · 63 tokens per session scan B f7ed571338c3
jig-rubric-scan is a skill published in the GitHub repository 0x0w1/jig (5 stars, last pushed 7d ago), licensed MIT. It adds 63 tokens to every session and 1,449 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it B with 1 finding (reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
github-release-briefing-skill
Create a source-linked briefing for the latest published GitHub release of a public repository. Use for engineering teams tracking a dependency release; do not use it to publish releases or change repositories.
taiyi-integration
A project workflow skill for closing a TaiyiForge change and recording it in a CHANGELOG.md file. It checks review results, tests, and the state of the working tree before archiving the change.
changelog-gen
A changelog generator that turns Git history into a version-by-version record of project changes. A changelog is a readable summary of new features, fixes, breaking changes, documentation, and other updates.
changelog-rules
Shared changelog conventions and formatting rules referenced by /create-changelog and /update-changelog. Not typically invoked directly.
release
Cut and publish a full stable NAC release after main, release-PR, and publication CI pass. Use when a maintainer asks for a stable version bump, tag, or GitHub Release. Never use for release candidates; NAC RC releases are automated.
ship
Use when code is ready to ship — creates PRs, merges, deploys, and verifies. Handles the full PR-to-production pipeline. Triggers on /ship.