Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add AdamBien/airails --skill web-standards-reviewergit clone --depth 1 https://github.com/AdamBien/airailsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/adambien/airails/web-standards-reviewer)<a href="https://agentmods.dev/skills/adambien/airails/web-standards-reviewer"><img src="https://agentmods.dev/badge/skills/adambien/airails/web-standards-reviewer/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/adambien/airails/web-standards-reviewer"><img src="https://agentmods.dev/badge/skills/adambien/airails/web-standards-reviewer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00221 | $0.02904 |
| Opus 5.5 | $0.00088 | $0.01162 |
| Sonnet 5.5 | $0.00044 | $0.00581 |
| Haiku 4.5 | $0.00022 | $0.00290 |
Grade A, and why
web-standards-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 128 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Review the build, dependency, and web-standards posture of $ARGUMENTS and report as briefly as possible. Review only; never modify code.
Composition
- rules come from
/javascript-conventions(platform-first list, ES module rules),/web-conventions(Baseline policy, snapshot lookup), and the detected stack skill (dependency allowlist, build rules, layout); this skill owns only the procedure and the output format - what the stack skill explicitly allows is not a finding:
/web-componentsallows lit-html, vendored Redux Toolkit as an import-map switch, zws plus Playwright as development tooling, and the Navigation API plus URLPattern without existence check inrouter.js;reduction.jsis application code, not a dependency;/web-staticand/web-sprinklesallow nothing at runtime - files are listed, searched, and read per
/zllm-scriptswith the scripts bundled inscripts/; that skill owns the output format, exit codes, denials, and fallbacks /web-latestin effect (a declared support floor in the project) suppresses Newly Available findings- BCE layering belongs to
/bce-reviewer, performance to/web-performance-reviewer, rendered-page verification to/web-static, fixing to the stack skill
Stack Detection
| Evidence | Stack |
|---|---|
import map mapping lit-html, or BElement.js, reduction.js, router.js present |
web-components |
| ES modules without lit-html; the HTML works with the scripts removed | web-sprinkles |
| no JavaScript | web-static |
| none of the above (framework, bundler) | unknown — reviewed against /web-conventions and /javascript-conventions with an empty allowlist: every runtime dependency is a finding; replacements name the web-components shape for applications, the web-sprinkles shape for sites |
Modes
| Invocation | Scope |
|---|---|
full [path] |
whole project below path (default: project root) |
diff |
uncommitted changes: git diff HEAD plus untracked files (git ls-files --others --exclude-standard) |
diff <ref> |
git diff <ref>... plus the working tree — a branch or PR range |
| mode omitted | diff when the working tree is dirty, otherwise full |
What ships with it
5 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago Changed · -39 tokens per session 6061f3da4567
- 6d ago First seen · 128 lines · 260 tokens per session scan A ab0452a3fc1d
web-standards-reviewer is a skill published in the GitHub repository AdamBien/airails (58 stars, last pushed 3d ago), licensed MIT. It adds 221 tokens to every session and 2,904 once invoked, about $0.0009 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-11.
Other skills, from other repositories
pr-review-comments
Posts review findings from a JSON file as inline comments on a GitHub Pull Request, attaching each comment to its file and line. Use when you have a list/JSON of review findings (each with a file path, line number, and a message such as summary/failurescenario) and want them published on a PR as inline review…
skill-author
Package and validate an existing skill draft for AutoVault when its frontmatter, resources, capabilities, or admission result need review.
otto-impact-assessment
Check the final diff's consumers, focused tests, evidence, and gaps.
otto-review-remediation
Handle trusted reviewers' change requests on Otto PRs.
feature-publish
Commit the feature, write the PR body, publish in the selected mode, and drive the PR.
cocoreview
CocoReview — structured code review with six-severity findings vocabulary, progressive disclosure architecture, and universal anti-pattern baseline. Invoked via $review [file] [--complexity] [--security] [--architecture] [--language ].