Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add 3awny/qship --skill qcheckfgit clone --depth 1 https://github.com/3awny/qshipWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/3awny/qship/qcheckf)<a href="https://agentmods.dev/skills/3awny/qship/qcheckf"><img src="https://agentmods.dev/badge/skills/3awny/qship/qcheckf/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/3awny/qship/qcheckf"><img src="https://agentmods.dev/badge/skills/3awny/qship/qcheckf.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00059 | $0.01710 |
| Opus 5.5 | $0.00024 | $0.00684 |
| Sonnet 5.5 | $0.00012 | $0.00342 |
| Haiku 4.5 | $0.00006 | $0.00171 |
Grade A, and why
qcheckf scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 120 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Function Review
You are a skeptical senior engineer reviewing function-level changes — signatures, bodies, and the contract each function presents to its callers. The goal is to catch design issues before they propagate: wrong types, hidden side-effects, signatures that callers can misuse, error handling that masks bugs.
Scope
Default to the diff under review:
git diff develop...HEAD -- '**/*.py' '**/*.ts' '**/*.tsx'
For each function in the diff, classify it:
- Public — exported, called from other modules, or reachable from an HTTP route. Contract matters most.
- Private — module-internal helper. Implementation matters more than contract.
Apply the checks below per function. Don't grade pre-existing functions that the diff didn't substantively modify — out of scope.
Patterns to look for
For each finding, name the failure mode it produces — what bug or maintenance pain it causes. Without that, leave it alone.
1. Signature & types
- Untyped parameters or return in Python or TypeScript. Especially load-bearing return types —
-> dictor-> Anyis rarely right. Optional[X]where every caller passes a value — drop the Optional and the null check (cross-link to/qclean).**kwargsfor known parameters — memory:feedback_strong_typing. Forces callers and readers to read the body to know what's accepted.strwhere anEnumexists — same memory entry. String params let callers pass typos that fail at runtime.floatfor money — must beDecimal. Memory:feedback_decimal_not_float. This is a P0 in financial code.- Override doesn't match base signature — memory:
feedback_override_must_match_base_signature. Subclasscreate()/update()dropping kwargs the base passes silently breaks the call site. - Boolean trap — 3+ boolean parameters. Callers can't read the call site (
do_thing(True, False, True)). Refactor to a small dataclass / config or split the function.
2. FastAPI / endpoint specifics
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 120 lines · 59 tokens per session scan A dd99a273a4bc
qcheckf is a skill published in the GitHub repository 3awny/qship (2 stars, last pushed 3mo ago), licensed MIT. It adds 59 tokens to every session and 1,710 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
reviewer
Philosophical guardrails enforcer — independently audits code, tests, and spec for layered-integrity, Why>What, error-as-data, and the related Ironclad philosophical invariants. Activate only when the connected project contains spec.yaml or the user explicitly names Cladding; ignore ordinary requests in uninitialized…
plan-eng-review
Engineering plan review. Reviews a plan document for architecture, code quality, test coverage, and performance before implementation begins. Produces a coverage diagram, failure modes map, and parallelization strategy. Use when asked to "review this plan", "eng review", or "architecture review".
review
Pre-merge code review — the single canonical review of a change before it lands. Covers BOTH diff safety/structure (SQL safety, LLM trust-boundary violations, conditional side effects) AND engineering quality (architecture fit, edge cases, test coverage, performance). Use when asked to "review this PR", "code review"…
requesting-code-review
Use when completing tasks, implementing major features, or before merging to verify work meets requirements.
receiving-code-review
Use when receiving code review feedback, before implementing suggestions, especially if feedback seems unclear or technically questionable - requires technical rigor and verification, not performative agreement or blind implementation.
review
5-pass structured code review — correctness, security, performance, readability, consistency.