Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add 3awny/qship --skill qchecktgit clone --depth 1 https://github.com/3awny/qshipWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/3awny/qship/qcheckt)<a href="https://agentmods.dev/skills/3awny/qship/qcheckt"><img src="https://agentmods.dev/badge/skills/3awny/qship/qcheckt/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/3awny/qship/qcheckt"><img src="https://agentmods.dev/badge/skills/3awny/qship/qcheckt.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00062 | $0.01559 |
| Opus 5.5 | $0.00025 | $0.00624 |
| Sonnet 5.5 | $0.00012 | $0.00312 |
| Haiku 4.5 | $0.00006 | $0.00156 |
Grade A, and why
qcheckt scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- **E2E test that doesn't actually run live** — uses Jest mocks or curls localhost while the service isn't actually running. Must produce a real artifact (curl output, browser screenshot, SQL row). Memory: `feedback_e2e_ How it starts
The opening of the file, as written. The whole thing — 105 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Tests Review
You are a skeptical senior engineer reviewing test code. The goal is to catch tests that look like they cover the change but don't actually fail when the implementation breaks — and to surface flaky / over-mocked / over-asserted tests before they ship.
Scope
Default to the diff under review:
git diff develop...HEAD -- '**/test_*.py' '**/*_test.py' '**/conftest.py' '**/*.test.ts' '**/*.test.tsx' '**/*.spec.ts' '**/*.spec.tsx'
If staged changes are the target, swap for git diff --cached. Whole-suite audits are an opt-in (--full), not the default.
For each test you find, classify it: unit, integration (real DB / real services), or E2E (live browser / live API stack). The review criteria differ.
What to look for
Walk these patterns. Flag a finding only when you can name the failure mode it produces — i.e., what bug the test would miss.
1. Tests that don't actually test the behavior
- Assertion is too weak:
assert len(result) > 0,assert result is not None,assert response.status_code < 500. Proves the code ran, not that it's correct. - Mocked the thing under test: the function whose behavior is being verified is itself a mock. Common in route tests that mock the service the route delegates to.
- Snapshot without semantic check: snapshot test on a structure where any superficial change passes (auto-update on diff). Add at least one semantic assertion.
- Tests the implementation, not the contract: assertions on internal call counts (
mock.assert_called_with(...)) when the public behavior is what should be checked. Mocks are scaffolding, not assertions.
2. Mocking that hides real bugs
- Mocking the database in a code path that does SQL gymnastics — your memory has explicit feedback on this (mocked tests pass while real migrations / SQL syntax fail). Integration tests for repos must hit a real DB.
- Mocking time / network without testing the unmocked path elsewhere — at least one test in the suite must exercise the real I/O.
mock.ANYin critical assertions — proves nothing about the value. Replace with the actual expected value.- Patching the wrong import path — patches
module_a.funcwhen the test target imports it asmodule_b.func. Test passes; mock never fired.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 105 lines · 62 tokens per session scan A 2dba7d5c8491
qcheckt is a skill published in the GitHub repository 3awny/qship (2 stars, last pushed 3mo ago), licensed MIT. It adds 62 tokens to every session and 1,559 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
oracle
Author an IMPL-BLIND spec-conformance oracle for an acceptance criterion the policy worklist (clad oracle --required) demands — an empty worklist means don't author unless the user explicitly asks. YOU spawn a blind sub-agent from a spec-only brief, then record it. Activate only when the connected project contains…
reviewer
Philosophical guardrails enforcer — independently audits code, tests, and spec for layered-integrity, Why>What, error-as-data, and the related Ironclad philosophical invariants. Activate only when the connected project contains spec.yaml or the user explicitly names Cladding; ignore ordinary requests in uninitialized…
check
Run every Iron Law stage and the drift detector suite. Use when the user wants the full project health snapshot, a CI gate, or to verify nothing regressed before committing. Add --strict to promote warn-severity drift findings to errors. Activate only when the connected project contains spec.yaml or the user…
sync
Validate the active spec.yaml against the Ironclad schema and refresh the inventory. Rarely needed manually — cladcreatefeature already auto-syncs the inventory and clad check / clad done self-validate the spec, so do NOT run it as a reflexive pre-flight before those. Use it only after you have directly hand-edited a…
visual-verification
Use for any UI/web project — make the verify gate cover more than unit tests by composing a pipeline (types → unit → design-scan → flow-smoke) and running the built-in yoke flow-smoke gate (landmark + zero console errors + screenshot proof to .yoke/proof/ /, video kept on failure). Catches the unwired-page /…
blind-author
Impl-blind test/oracle author — writes conformance tests from a spec-only brief. Tool-restricted by definition (no Read/Grep/Glob/Edit), so "authored blind" is a structural fact, not a promise. Activate only when the connected project contains spec.yaml or the user explicitly names Cladding; ignore ordinary requests…