Borrowing it
Nothing to install: this file belongs to andreymudri/vault-mcp. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/andreymudri/vault-mcp/main/.claude/skills/phase-gate/SKILL.mdgit clone --depth 1 https://github.com/andreymudri/vault-mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/andreymudri/vault-mcp/phase-gate)<a href="https://agentmods.dev/skills/andreymudri/vault-mcp/phase-gate"><img src="https://agentmods.dev/badge/skills/andreymudri/vault-mcp/phase-gate.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00092 | $0.02974 |
| Opus 5 | $0.00046 | $0.01487 |
| Sonnet 5 | $0.00018 | $0.00595 |
| Haiku 4.5 | $0.00009 | $0.00297 |
Grade D, and why
phase-gate scanned grade D with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
advance that sudo hangs, that `/tmp` is near a quota, or that CI does not cover Windows changes Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
cleanup() { git worktree prune; rm -rf "$SCRATCH"; } How it starts
The opening of the file, as written. The whole thing — 235 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Phase gate
A gate that rubber-stamps is worse than no gate: it converts "unreviewed" into "approved" at no cost. Everything below exists to make PASS expensive.
Inputs
| Input | Meaning | If missing |
|---|---|---|
TARGET |
branch, worktree path, or diff range (v0.1.1..HEAD) |
ask; never guess |
SPEC |
what this phase was supposed to do | ask; a gate with no spec can only check for bugs, not for done |
BUDGET |
severity budget, e.g. high=0, medium<=3 |
default high=0; state the default you used |
Record all three verbatim in the gate record. A gate whose scope is reconstructed afterwards is a gate that can be argued with.
Non-negotiables
These are not style preferences. Each one is here because skipping it has already produced a wrong PASS.
- An agent's summary is not evidence. Read the full diff yourself before any verdict. A subagent reporting "fixed, tests pass" is a claim, not a result.
- Never declare PASS from a self-report. PASS requires: you read the diff, the suite ran green under an explicit timeout, and every finding has a refutation verdict.
- A test that never failed proves nothing. See mutation proof (step 4).
- On any doubt about a destructive suggestion, don't suggest it. Verify the target is what you think it is first — see resource guards (step 5).
- Never print a secret. Not to debug, not to verify. Verify by length or truncated hash.
Never invoke a credential helper with
get. If one is exposed: stop, say so, tell the user to rotate it now.
0. Preflight
Run the env-preflight skill if it has not run this session. The gate runs commands; knowing in
advance that sudo hangs, that /tmp is near a quota, or that CI does not cover Windows changes
what the lenses can conclude.
1. Read the diff yourself
timeout 60 git diff --stat <TARGET>
timeout 120 git diff <TARGET>
Build a file-by-file table: file | what changed | how it is verified (test name or command). Any row whose third column is empty is itself a finding — untested change, severity at least medium.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 235 lines · 92 tokens per session scan D a2db8bf212d8
phase-gate is a skill published in the GitHub repository andreymudri/vault-mcp (0 stars, last pushed 10d ago), licensed MIT. It adds 92 tokens to every session and 2,974 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it D with 2 findings (asks for root, recursive force delete). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
api-linter
MCP definition linter rules reference. Use when bun run lint:mcp or bun run devcheck reports a lint error or warning (format-parity, schema-is-object, name-format, server-json-, etc.) and you need to understand the rule, its severity, and how to fix it. Every rule ID the linter emits has an entry in this doc.
code-simplifier
Post-session code review and cleanup against a working tree of changes. Analyzes git diff to simplify, consolidate, and align changed code with the existing codebase — modernize syntax, remove unnecessary complexity, consolidate duplicated logic, catch efficiency issues. Use after a substantive working session, or…
codex-review
Two-way heterogeneous code-review pair: Claude reviews Codex's diff AND Codex reviews Claude's diff — the final check is done by the OTHER vendor (research shows a hetero pair catches significantly more than a homogeneous one). Verdicts: APPROVE / REQUESTCHANGES with file:line references. Trigger on "/codex-review"…
pkm-session-end
Use when wrapping up a work session — creates devlog entry, captures undocumented decisions/research/debugging, audits link health of session work, and updates project index. Primarily used via the pkm-capture agent.
pkm-write
Use when writing to the vault — creating new notes (vaultwrite), editing existing notes (vaultedit, vaultappend, vaultupdatefrontmatter). Handles duplicate checking, link discovery, annotations, and index updates for new notes. Provides guidelines for modifications.
triage-tasks
Use when you want to review and batch-update open vault task statuses for the current project or across all projects.