Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add 3awny/qship --skill qcheckgit clone --depth 1 https://github.com/3awny/qshipWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/3awny/qship/qcheck)<a href="https://agentmods.dev/skills/3awny/qship/qcheck"><img src="https://agentmods.dev/badge/skills/3awny/qship/qcheck/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/3awny/qship/qcheck"><img src="https://agentmods.dev/badge/skills/3awny/qship/qcheck.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00055 | $0.03374 |
| Opus 5.5 | $0.00022 | $0.01350 |
| Sonnet 5.5 | $0.00011 | $0.00675 |
| Haiku 4.5 | $0.00006 | $0.00337 |
Grade A, and why
qcheck scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 338 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Code Review
Step 0: Apply Auto-Memory
The memory index is already loaded in your system prompt — no re-read needed. As you review, apply the relevant feedback_* entries (analogous code, redundancy patterns, qbcheck-before-reporting, actor-critic review, single-source-of-truth, etc.). When a finding maps to a known memory, cite the entry name in the report so the user can trace the rule.
If a specific memory file looks relevant to a finding, read just that one file from the auto-memory directory listed in the system prompt.
Step 1: Gather Changes & Context
1.1 Get Git SHAs
BASE_SHA=$(git merge-base HEAD develop)
HEAD_SHA=$(git rev-parse HEAD)
If git merge-base fails (detached HEAD, or running on develop/main), STOP and ask the user for an explicit base — don't silently fall back to HEAD~1. Reviewing just the last commit on develop is almost never what's wanted; the user usually means a specific PR range, a Jira branch they forgot to switch to, or a tag.
1.2 Gather Diff
git diff --stat $BASE_SHA..$HEAD_SHA
git diff $BASE_SHA..$HEAD_SHA
Also check for unstaged/staged changes not yet committed:
git diff
git diff --cached
1.3 Read Guidelines
Read the review guidelines:
- Project-level:
CLAUDE.mdin the repository root - User-level:
~/.claude/CLAUDE.md(user preferences and lessons learned)
1.4 Identify What Was Built
Summarize from the diff and recent commits:
- What feature/fix was implemented
- Which files were changed and why
- The plan or requirements (if a plan file exists in
docs/plans/)
Step 2: Launch Parallel Review Agents
Deploy BOTH review agents simultaneously in a single message with two Task tool calls:
2.1 Superpowers Code Reviewer
Dispatch using the superpowers:code-reviewer subagent type:
Task(
subagent_type: "superpowers:code-reviewer",
description: "Comprehensive code review",
prompt: |
You are reviewing code changes for production readiness.
Your task:
1. Review: <WHAT_WAS_IMPLEMENTED>
2. Compare against: <PLAN_OR_REQUIREMENTS> (or "No formal plan -- review based on code quality and correctness")
3. Check code quality, architecture, testing
4. Categorize issues by severity
5. Assess production readiness
What Was Implemented: <DESCRIPTION>
Requirements/Plan: <PLAN_REFERENCE>
Git Range: Base: <BASE_SHA>, Head: <HEAD_SHA>
Run: git diff --stat <BASE_SHA>..<HEAD_SHA>
Run: git diff <BASE_SHA>..<HEAD_SHA>
Review Checklist:
- Code Quality: separation of concerns, error handling, type safety, DRY, edge cases
- Architecture: design decisions, scalability, performance, security
- Testing: tests test logic (not mocks), edge cases covered, integration tests
- Requirements: all plan requirements met, no scope creep, breaking changes documented
- Production Readiness: migrations, backward compatibility, documentation
Output Format:
### Strengths
### Issues (Critical / Important / Minor with file:line references)
### Recommendations
### Assessment: Ready to merge? [Yes/No/With fixes]
)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 338 lines · 55 tokens per session scan A bfaea382a9ce
qcheck is a skill published in the GitHub repository 3awny/qship (2 stars, last pushed 3mo ago), licensed MIT. It adds 55 tokens to every session and 3,374 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
reviewer
Philosophical guardrails enforcer — independently audits code, tests, and spec for layered-integrity, Why>What, error-as-data, and the related Ironclad philosophical invariants. Activate only when the connected project contains spec.yaml or the user explicitly names Cladding; ignore ordinary requests in uninitialized…
plan-eng-review
Engineering plan review. Reviews a plan document for architecture, code quality, test coverage, and performance before implementation begins. Produces a coverage diagram, failure modes map, and parallelization strategy. Use when asked to "review this plan", "eng review", or "architecture review".
review
Pre-merge code review — the single canonical review of a change before it lands. Covers BOTH diff safety/structure (SQL safety, LLM trust-boundary violations, conditional side effects) AND engineering quality (architecture fit, edge cases, test coverage, performance). Use when asked to "review this PR", "code review"…
requesting-code-review
Use when completing tasks, implementing major features, or before merging to verify work meets requirements.
receiving-code-review
Use when receiving code review feedback, before implementing suggestions, especially if feedback seems unclear or technically questionable - requires technical rigor and verification, not performative agreement or blind implementation.
review
5-pass structured code review — correctness, security, performance, readability, consistency.