Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add 3awny/qship --skill qbcheckgit clone --depth 1 https://github.com/3awny/qshipWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/3awny/qship/qbcheck)<a href="https://agentmods.dev/skills/3awny/qship/qbcheck"><img src="https://agentmods.dev/badge/skills/3awny/qship/qbcheck/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/3awny/qship/qbcheck"><img src="https://agentmods.dev/badge/skills/3awny/qship/qbcheck.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00073 | $0.03945 |
| Opus 5.5 | $0.00029 | $0.01578 |
| Sonnet 5.5 | $0.00015 | $0.00789 |
| Haiku 4.5 | $0.00007 | $0.00394 |
Grade A, and why
qbcheck scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 228 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Bug Review Validator
You are a skeptical senior engineer validating a list of bug findings. Your job is to separate real bugs worth fixing now from false positives, overstated severities, and overthinking — without flipping into the opposite failure mode of rejecting real bugs.
The goal is accuracy, not a low or high bug count. A typical pass rejects roughly 30–50% of automated findings, but the right number is whatever the code actually says.
Inputs
This skill takes a list of bug findings as input. The findings can come from anywhere:
/qbugoutput (most common)- A code-review subagent's report
- PR review comments
- A manual list the user pasted
What you need for each finding:
- Claim — what the finding says is wrong
- Location — file path + line number, or enough context to find it
- Source — which tool/agent flagged it (e.g.
silent-failure-hunter,security-scanner, "GitHub PR comment from X"). Use this as one signal, not a vote count.
If a finding is missing the location or claim, ask the user before guessing. Don't validate something you can't pin down.
What you produce
Two things, both required:
- Per-finding writeup — verdict + reasoning, in the format below.
- Final summary — human table + machine-readable filtered list (the bugs worth acting on, in order).
The machine-readable list is what downstream pipelines (e.g. /qship fix step) consume. Keep it clean.
Pre-flight: memory of past decisions (graceful — skip if unavailable)
Before validating, scan Claude Code's native auto-memory for past qbcheck verdicts on similar findings — this prevents re-litigating identical FP/TP judgments and reduces drift across runs. Per Memorisable Prompting. Defer to qmemory's rules; this section only describes the read + write shape qbcheck uses.
Read. The current project's memory directory is referenced in the system prompt's auto-memory section (typically ~/.claude/projects/<project-slug>/memory/) with MEMORY.md as the index. Skim MEMORY.md for existing entries that look like prior qbcheck verdicts — usually feedback_qbcheck_*.md (or anything tagged with the file/symbol you're validating). If you find ≤5 relevant entries, read them and use them as few-shot examples in your reasoning — "this finding is structurally similar to the one we marked False positive in feedback_qbcheck_X.md, which turned out wrong because…". Memory calibrates the verdict; it does not determine it.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 228 lines · 73 tokens per session scan A 6b66eb85e3a1
qbcheck is a skill published in the GitHub repository 3awny/qship (2 stars, last pushed 3mo ago), licensed MIT. It adds 73 tokens to every session and 3,945 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
doctor
Diagnose Cladding runtime health — Claude Code hook liveness and version, CI package pinning, lifecycle governance, and sentinel-miss frequency by phase × cause × fallback. Use when hooks may be silent, CI may float across Cladding releases, scan or run results look thinner than expected, or before tuning the host…
check-sentinel-setup
Run an offline Sentinel package doctor and separate local installation defects from host enablement or Roboflow sign-in problems. TRIGGER when: the user asks to check, verify, diagnose, or troubleshoot a Sentinel plugin installation; run the setup doctor; find missing skills, packaged files, or Roboflow tools; or…
health
Code Quality Dashboard. Runs the project's type-checker, linter, test runner, and dead-code detector, scores each category 0-10, and presents a dashboard with trends. Use when asked for a "health check", "code quality report", or "quality dashboard".
bug-fix
Use when a bug, regression, or unexpected behaviour is reported and the user wants it fixed end to end — "why is X broken", "this stopped working after Y", "fix this crash". Also use when a symptom is known but its cause is not. Not for building new behaviour, and not for a change whose cause is already proven.
bug-investigate
Use when someone wants to know WHY something is broken and has not asked for it to be fixed — "why is this happening", "what's causing this error", "find out what's wrong", "diagnose this before we decide". Also use before committing to a fix, when the cause is unknown and the decision depends on it. Not for fixing …
observability
Log and metrics analyst — reads .cladding/audit.log.jsonl, perf/baseline.json, and drift reports; surfaces patterns the human can act on. Activate only when the connected project contains spec.yaml or the user explicitly names Cladding; ignore ordinary requests in uninitialized projects.