Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/Anselmoo/mcp-ai-agent-guidelinesnpx agentmods add skills/anselmoo/mcp-ai-agent-guidelines/pr-quality-cycleWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/anselmoo/mcp-ai-agent-guidelines/pr-quality-cycle)<a href="https://agentmods.dev/skills/anselmoo/mcp-ai-agent-guidelines/pr-quality-cycle"><img src="https://agentmods.dev/badge/skills/anselmoo/mcp-ai-agent-guidelines/pr-quality-cycle/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/anselmoo/mcp-ai-agent-guidelines/pr-quality-cycle"><img src="https://agentmods.dev/badge/skills/anselmoo/mcp-ai-agent-guidelines/pr-quality-cycle.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00067 | $0.02557 |
| Opus 5 | $0.00034 | $0.01278 |
| Sonnet 5 | $0.00013 | $0.00511 |
| Haiku 4.5 | $0.00007 | $0.00256 |
Grade B, and why
pr-quality-cycle scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
| `src/cli.ts` | 381 | P1 | `hooks setup` overwrites `~/.claude/settings.json` without merge | ✅ Write to `mcp-ai-agent-guidelines-hooks.json` | How it starts
The opening of the file, as written. The whole thing — 199 lines — stays where its author put it; the contents beside it link to each section on GitHub.
PR Quality Cycle
End-to-end workflow that combines inline review triage and Codecov patch coverage repair into a single linear cycle. Eliminates the context-switch between "fix what reviewers flagged" and "fix what CI flagged", so both land in the same commit batch.
When to Use
- A PR is in
CHANGES_REQUESTEDorCOMMENTEDstate and Codecov reports patch coverage below baseline - You want a single checklist for a complete PR quality pass without toggling between two separate skills
- A bot review (Copilot, human reviewer) and the Codecov bot have both left comments on the same PR
This skill supersedes running address-pr-review-locally + fix-codecov-gaps separately. Use those individual skills when you need only one of the two passes.
Procedure
Phase 1 — Fetch All Feedback in Parallel
Run two GitHub reads simultaneously:
mcp_github_pull_request_read method: get_review_comments → inline review threads
mcp_github_pull_request_read method: get_comments → PR-level comments (Codecov bot lives here)
From review threads: collect every thread where is_resolved: false and is_outdated: false.
From PR-level comments: locate the codecov[bot] comment. Extract:
- Patch coverage % (e.g.
85.79%) - Files table — each row has file path, patch %, missing count, partial count
PR #1461 reference — review:
#pullrequestreview-4157854720| Codecov:#issuecomment-4299851177
Phase 2 — Triage Review Comments (P1 → P2 → P3)
Group unresolved threads before writing any code:
| Priority | Trigger | Fix order |
|---|---|---|
| P1 — Safety/Correctness | Destructive overwrite, data-loss risk, security guard missing | First |
| P2 — Accuracy | Misleading docs, wrong label, logic gap, unquoted YAML | Second |
| P3 — Style | Docblock wording, minor naming, refactoring suggestion | Last / defer |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 199 lines · 67 tokens per session scan B 2c955217d20c
pr-quality-cycle is a skill published in the GitHub repository Anselmoo/mcp-ai-agent-guidelines (6 stars, last pushed today), licensed MIT. It adds 67 tokens to every session and 2,557 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it B with 1 finding (reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
sumo-qa-implementing-with-tdd
Use after sumo-qa-deciding-approach picks tdd-scaffold, regression-first, or coverage-first-then-refactor — e.g. "write a regression test for this bug" or "scaffold the failing tests first". Walks plan → name-the-risk-and-test-idea → confirm → red → hand off → green → review, one section per turn with confirmation…
sumo-qa-finishing-qa-work
Use at the end of a QA rollout (after sumo-qa-executing-qa-rollout, or after a manual multi-step QA task) to capture evidence, produce a PR-ready summary, and close the loop. Runs the suite one last time, captures coverage / risk-to-test map / open follow-ups, writes a markdown summary to docs/qa/runs/YYYY-MM-DD- .md…
sumo-qa-planning-qa-rollout
Use when you have a chunk of QA work (a story, a PR, a strategy phase) that needs to be turned into a written plan of bite-sized, independently-executable tasks before any test code is written. Walks scope → file structure → bite-sized tasks → confirm, one section per turn. Produces docs/qa/plans/YYYY-MM-DD- .md ready…
using-sumo-qa
MUST be called first for any QA-shaped request. Triggers — test plan, test strategy, test approach, regression scope, risk-based testing, exploratory testing, code review, safety-to-merge, scaffold tests, TDD, mutation testing, find test data, validate test data, QA audit, test pyramid, "how do I test X", "is this…
live-audit
Audit steam-games-mcp — build/test/lint gate, live MCP tool edge-case sweep (input validation, SteamID64/vanity/appid edge cases, key-gating), and source-level code review. Use when asked to test/audit the published or just-fixed steam-games-mcp package, hunt for bugs/edge cases, or repeat "the same kind of testing as…
sumo-qa-answering-testing-question
Use when the user asks a generic testing question — "how do I test this?", "what should I check for X?" — that doesn't fit a more specific QA skill. Cites a principle or technique from the loaded catalogue rather than producing generic advice.