Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add ArtemioPadilla/agent-triforce --skill review-findingsgit clone --depth 1 https://github.com/ArtemioPadilla/agent-triforceWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/artemiopadilla/agent-triforce/review-findings)<a href="https://agentmods.dev/skills/artemiopadilla/agent-triforce/review-findings"><img src="https://agentmods.dev/badge/skills/artemiopadilla/agent-triforce/review-findings/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/artemiopadilla/agent-triforce/review-findings"><img src="https://agentmods.dev/badge/skills/artemiopadilla/agent-triforce/review-findings.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00032 | $0.00841 |
| Opus 5 | $0.00016 | $0.00420 |
| Sonnet 5 | $0.00006 | $0.00168 |
| Haiku 4.5 | $0.00003 | $0.00084 |
Grade A, and why
review-findings scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 98 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Fix the findings from the QA review: $ARGUMENTS
If no specific review is mentioned, look for the most recent review in docs/reviews/.
Follow these steps:
SIGN IN:
- Run the SIGN IN checklist from your agent file
- Surface any concerns about the findings — complexity, risk, dependencies
Defect Severity Classification
Every finding in the review report must have a severity:
- Critical: Security vulnerability, data loss, system crash
- Major: Feature broken, workaround exists but painful
- Medium: Incorrect behavior, easy workaround
- Minor: Cosmetic, style, naming
Defect Status Lifecycle
Each finding tracks its status through the Centinela > Forja > Centinela loop:
Open (Centinela identifies in review)
> Assigned (handoff to Forja via review-findings)
> Implemented (Forja completes fix)
> Verified (Centinela re-verifies)
> Closed
When reading the review report, update each finding's status from Open to Assigned.
When fixing is complete, update status to Implemented.
Centinela re-verification updates to Verified then Closed.
Entry/Exit Criteria
Entry criteria (must be true before starting fixes):
- Implementation is complete and all existing tests pass
- Forja's Pre-Delivery checklist has been passed
- Review report exists at
docs/reviews/{feature-name}-review.md
Exit criteria (must be true before handoff back to Centinela):
- All Critical and Major findings have status
Implemented - Remaining Minor findings are documented in
TECH_DEBT.mdwith justification - Fix order was respected: Critical > Major > Medium > Minor
Review Report Finding Format
Each finding in the review report must include:
| Field | Description |
|---|---|
| ID | F-{NNN} sequential |
| Severity | Critical / Major / Medium / Minor |
| Status | Open / Assigned / Implemented / Verified / Closed |
| Category | Code Quality / Architecture / Spec Compliance |
| Description | What the issue is |
| Location | file:line reference |
| Recommendation | How to fix |
| Verified-By | Agent that verified the fix (populated during re-verification) |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 98 lines · 32 tokens per session scan A 7c63ac9df291
review-findings is a skill published in the GitHub repository ArtemioPadilla/agent-triforce (3 stars, last pushed 5mo ago), licensed MIT. It adds 32 tokens to every session and 841 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
skeptical-triage
Reusable 3-round self-challenge + arbiter pattern for filtering false positives from findings/verdicts. Use when the cost of a false-positive gate block exceeds the cost of 4 extra LLM turns.
anti-patterns
Catalogue of known SDLC anti-patterns that greatcto agents must actively reject when reviewing architecture, plans, code, or post-mortems. Used by architect (pre-impl), pm (planning), senior-dev (impl), l3-support (post-incident).
review-all
Multi-agent code review for diffs (project-agnostic). Covers standards, bugs, security, DRY, smells, perf, tests, API contracts, a11y/i18n. Verifies each finding to eliminate false positives. Use for /review-all, pre-PR/pre-commit review, or auditing uncommitted/staged changes.
observability-baseline
Scaffold-time observability so a shipped product is not blind in prod from day one — error capture (Sentry), request-id structured logging, and /healthz + /readyz endpoints. stack-baseline pins Sentry but nothing wires it; this is the wiring. Loaded by app-scaffolder (bake into the scaffold), infra-provisioner (prod…
x-cr
A software-correctness investigation skill for finding why code behaves differently from what was expected. It uses evidence from code paths, specifications, tests, logs, and changes to assess possible causes.
rubber-ducky
Use when you've planned a non-trivial change and are about to implement it, finished a complex or multi-file piece of work, just wrote tests, or are stuck on repeated failures — and any time the user says "rubber duck this", "rubber ducky", "get a second opinion", "sanity-check my plan", "poke holes in this", "what am…