Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/agricidaniel/anti-slop/slop-codenpx skills add AgriciDaniel/anti-slop --skill slop-codegit clone --depth 1 https://github.com/AgriciDaniel/anti-slopWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/agricidaniel/anti-slop/slop-code)<a href="https://agentmods.dev/skills/agricidaniel/anti-slop/slop-code"><img src="https://agentmods.dev/badge/skills/agricidaniel/anti-slop/slop-code.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00161 | $0.02129 |
| Opus 5 | $0.00081 | $0.01064 |
| Sonnet 5 | $0.00032 | $0.00426 |
| Haiku 4.5 | $0.00016 | $0.00213 |
Grade A, and why
slop-code scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 171 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Slop code
The firewall
These four rules bind this skill and hold even when the user asks for the opposite.
- Never emit an authorship verdict. Report defects, not origin. Never state or imply that a diff was written by a human, by AI, or by a named agent, and never assign a probability to any of those.
- Never hard-fail on a stylistic marker alone. A marker is a routing hint. Its only legitimate output is "run a structural test on this span".
- Severity is impact. Confidence is certainty. Two axes. Never merge them, never trade one against the other.
- Never let the model gate its own rewrite. The deterministic scanners re-run after any fix and their exit codes decide, not your judgment.
Standing instructions
The only HIGH severity in code is "this is not true". A package that does not exist in its registry. An API, flag, method or config key that does not exist in the version pinned by the project. A test that passes while asserting nothing about the behavior it names. A docstring that describes different behavior from the code under it. Everything else, however ugly, is MEDIUM or LOW.
Run scan_packages.py on every changed file that adds an import, always,
before anything else. Hallucinated package names are the one defect class in
this skill with a live supply chain attack attached. Frontier 2026 models
hallucinate package names at roughly 4.62% to 6.10% of responses in the Socket
and Churilov measurements, and 53 hallucinated names were still registerable at
the time of that measurement. Registry existence is decidable, so this scanner
is allowed to hard-fail. Note the default: existence checks are opt-in with
--online, and an offline run only enumerates dependencies. Reporting an
offline exit 0 as "packages verified" is itself a defect.
Verify APIs against the pinned version, not against memory. Read the lockfile, the vendored source, or the installed package. "This method exists" is a factual claim about a specific version and needs the same evidence as any other factual claim. If you cannot check, the finding is "unverified", not "correct".
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 171 lines · 161 tokens per session scan A ed431ad38347
slop-code is a skill published in the GitHub repository AgriciDaniel/anti-slop (45 stars, last pushed 1mo ago), licensed Apache-2.0. It adds 161 tokens to every session and 2,129 once invoked, about $0.0008 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
git-workflow
Git best practices, branching strategies, commit conventions, and PR workflows. Use when reviewing git history, writing commits, setting up branching strategy, or improving git practices. Triggers on "git best practices", "commit message", "branching strategy", or "PR workflow".
laravel-inertia-react
Laravel + Inertia.js + React integration patterns. Use when building Inertia page components, handling forms with useForm, managing shared data, or implementing persistent layouts. Triggers on tasks involving Inertia.js, page props, form handling, or Laravel React integration.
laravel-owasp-security
OWASP Top 10 security audit and secure coding guidelines for Laravel + React/Inertia.js applications. Use when auditing for vulnerabilities ("run OWASP audit", "security review", "check my app security") or writing secure Laravel code involving auth, payments, file uploads, or API design. Triggers on security-related…
seo-best-practices
SEO patterns, conventions, and audit for web applications. Use when implementing meta tags, structured data, Core Web Vitals, sitemaps, Open Graph, auditing SEO, or optimizing pages for search engines. Triggers on "audit SEO", "check SEO", "review SEO", or tasks involving search optimization, schema markup, or social…
state-management
React Query and Zustand patterns for state management. Use when implementing data fetching, caching, mutations, or client-side state. Triggers on tasks involving useQuery, useMutation, Zustand stores, caching, or state management.
technical-debt
Technical debt inventory, prioritization, and audit for PHP/Laravel (MySQL) and Node/TypeScript/React projects. Use when assessing code health, identifying refactoring candidates, planning debt paydown, or auditing a codebase for accumulated debt. Triggers on "audit technical debt", "find tech debt", "debt inventory"…