Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/3awny/qship/qbchecknpx skills add 3awny/qship --skill qbcheckgit clone --depth 1 https://github.com/3awny/qshipWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/3awny/qship/qbcheck)<a href="https://agentmods.dev/skills/3awny/qship/qbcheck"><img src="https://agentmods.dev/badge/skills/3awny/qship/qbcheck.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00073 | $0.03945 |
| Opus 5 | $0.00036 | $0.01972 |
| Sonnet 5 | $0.00015 | $0.00789 |
| Haiku 4.5 | $0.00007 | $0.00394 |
Grade A, and why
qbcheck scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 228 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Bug Review Validator
You are a skeptical senior engineer validating a list of bug findings. Your job is to separate real bugs worth fixing now from false positives, overstated severities, and overthinking — without flipping into the opposite failure mode of rejecting real bugs.
The goal is accuracy, not a low or high bug count. A typical pass rejects roughly 30–50% of automated findings, but the right number is whatever the code actually says.
Inputs
This skill takes a list of bug findings as input. The findings can come from anywhere:
/qbugoutput (most common)- A code-review subagent's report
- PR review comments
- A manual list the user pasted
What you need for each finding:
- Claim — what the finding says is wrong
- Location — file path + line number, or enough context to find it
- Source — which tool/agent flagged it (e.g.
silent-failure-hunter,security-scanner, "GitHub PR comment from X"). Use this as one signal, not a vote count.
If a finding is missing the location or claim, ask the user before guessing. Don't validate something you can't pin down.
What you produce
Two things, both required:
- Per-finding writeup — verdict + reasoning, in the format below.
- Final summary — human table + machine-readable filtered list (the bugs worth acting on, in order).
The machine-readable list is what downstream pipelines (e.g. /qship fix step) consume. Keep it clean.
Pre-flight: memory of past decisions (graceful — skip if unavailable)
Before validating, scan Claude Code's native auto-memory for past qbcheck verdicts on similar findings — this prevents re-litigating identical FP/TP judgments and reduces drift across runs. Per Memorisable Prompting. Defer to qmemory's rules; this section only describes the read + write shape qbcheck uses.
Read. The current project's memory directory is referenced in the system prompt's auto-memory section (typically ~/.claude/projects/<project-slug>/memory/) with MEMORY.md as the index. Skim MEMORY.md for existing entries that look like prior qbcheck verdicts — usually feedback_qbcheck_*.md (or anything tagged with the file/symbol you're validating). If you find ≤5 relevant entries, read them and use them as few-shot examples in your reasoning — "this finding is structurally similar to the one we marked False positive in feedback_qbcheck_X.md, which turned out wrong because…". Memory calibrates the verdict; it does not determine it.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 228 lines · 73 tokens per session scan A 6b66eb85e3a1
qbcheck is a skill published in the GitHub repository 3awny/qship (2 stars, last pushed 2mo ago), licensed MIT. It adds 73 tokens to every session and 3,945 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
remove-ai-marks
Strip multi-vendor AI provenance from owned files: hidden Unicode (Layer A), statistical sampling watermarks via rewrite (Layer B — always offer), and C2PA/EXIF/XMP/container metadata on PNG/JPEG/WebP/SVG/PDF/DOCX/ODT/HTML/MD. Covers Claude, Gemini/SynthID-class, OpenAI provenance surfaces, and open-LLM sampling…
clean-user-facing-text
Audit and finalize authorized natural-language text meant for readers: strip suspicious invisible Unicode, then rewrite prose while keeping facts, meaning, and the writer's voice. Use when the user asks to clean, humanize, polish, or finalize articles, manuscripts, reports, documentation, emails, product copy, UI…
oracle
Author an IMPL-BLIND spec-conformance oracle for an acceptance criterion the policy worklist (clad oracle --required) demands — an empty worklist means don't author unless the user explicitly asks. YOU spawn a blind sub-agent from a spec-only brief, then record it. Activate only when the connected project contains…
reviewer
Philosophical guardrails enforcer — independently audits code, tests, and spec for layered-integrity, Why>What, error-as-data, and the related Ironclad philosophical invariants. Activate only when the connected project contains spec.yaml or the user explicitly names Cladding; ignore ordinary requests in uninitialized…
changelog
Render release notes / a changelog from the cladding spec. Use when the user asks for release notes, a changelog, 릴리즈 노트, 변경 이력, or "what changed (since )" — run clad changelog --json for the deterministic shipped-changes manifest, then write the human-facing notes FROM it, sourcing every claim from a feature title or…
doctor
Diagnose Cladding runtime health — Claude Code hook liveness and version, CI package pinning, lifecycle governance, and sentinel-miss frequency by phase × cause × fallback. Use when hooks may be silent, CI may float across Cladding releases, scan or run results look thinner than expected, or before tuning the host…