Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add bendaamerahmed/backstage-idp-plugin --skill backstage-quality-gategit clone --depth 1 https://github.com/bendaamerahmed/backstage-idp-pluginWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/bendaamerahmed/backstage-idp-plugin/backstage-quality-gate)<a href="https://agentmods.dev/skills/bendaamerahmed/backstage-idp-plugin/backstage-quality-gate"><img src="https://agentmods.dev/badge/skills/bendaamerahmed/backstage-idp-plugin/backstage-quality-gate/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/bendaamerahmed/backstage-idp-plugin/backstage-quality-gate"><img src="https://agentmods.dev/badge/skills/bendaamerahmed/backstage-idp-plugin/backstage-quality-gate.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00045 | $0.02728 |
| Opus 5 | $0.00023 | $0.01364 |
| Sonnet 5 | $0.00009 | $0.00546 |
| Haiku 4.5 | $0.00005 | $0.00273 |
Grade A, and why
backstage-quality-gate scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 168 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Backstage quality gate
Prove a Backstage change is sound by running the repository's own validation commands, narrowest first, and report exactly what ran. A command that did not run and exit zero is not a pass.
Preconditions
- The repo is mapped (
backstage-repo-discovery) or you have read the rootpackage.jsonscriptsand every CI workflow yourself. node_modulesis installed. If not,yarn install --immutableis step zero and its cost belongs in the summary. Assumeyarnunless the lockfile says otherwise.- Node 22 or 24. Any other major invalidates every result — report BLOCKED.
- You know which workspace packages your edits touch (map changed paths → the owning
package.jsonnameandbackstage.role). - You can run long commands in the background and poll them. Foreground-blocking a watch-mode test run or a dev server wastes the whole turn.
Procedure
-
Discover the real commands. Read the root
package.jsonscriptsverbatim, thescriptsof each touched package, and.github/workflows/*.y*ml(or GitLab/Circle/ Azure/Jenkins equivalents). CI is the contract; scripts are a hint. Scaffolded apps exposetsc,tsc:full,lint(repo lint --since origin/<default-branch>),lint:all,test,test:all,build:all,build:backend,prettier:check,fix— but any of these may be renamed, wrapped, or absent. Record command, working directory, and expected duration. Never invoke a script you have not seen defined. -
Make runs non-interactive.
backstage-cli repo testandpackage testdefault to Jest watch mode inside a git repo; run in the foreground they never exit. Pass--watch=falseexplicitly, or setCI=1(which is what CI does, and also makesrepo testrun all tests). Know the side effect: withCIset,TestDatabasesfrom@backstage/backend-test-utilsstops being SQLite-only and spins up every configured engine via testcontainers. Without Docker, prefer--watch=falseoverCI=1, or supplyBACKSTAGE_TEST_DATABASE_POSTGRES17_CONNECTION_STRING(and siblings), and say which you chose in the summary.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 168 lines · 45 tokens per session scan A 206d70ac72f6
backstage-quality-gate is a skill published in the GitHub repository bendaamerahmed/backstage-idp-plugin (1 stars, last pushed 1mo ago), licensed MIT. It adds 45 tokens to every session and 2,728 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
phx-work
Execute Elixir/Phoenix plan tasks with progress tracking. Use after phx-plan to implement features with mix compile and mix test verification after each step, or --continue to resume interrupted work.
lab:autoresearch
Self-improving loop for plugin skills. Reads program.md, proposes one mutation per iteration, evaluates against deterministic scorer, keeps improvements via git, reverts failures. Targets weakest skill+dimension. Use with /loop for overnight runs.
review-testing
Review test code for quality, design, and completeness after implementing a feature or fixing a bug. Use when the user asks to "review my tests", "check my test quality", "are these tests good enough", "review testing", or after completing a feature implementation that includes tests. Also use when tests feel brittle…
testing-r-packages
Best practices for writing R package tests using testthat version 3+. Use when writing, organizing, or improving tests for R packages. Covers test structure, expectations, fixtures, snapshots, mocking, and modern testthat 3 patterns including self-sufficient tests, proper cleanup with withr, and snapshot testing.
codex-loop
Fix Elixir/Phoenix code until Codex CLI review comes back clean — bounded review, fix, verify loop before opening a PR. Use when codex is installed and you want an external cross-model critic on your changes before pushing.
verify
Verify Elixir/Phoenix changes — compile, format, and test in one loop. Use after implementation, before PRs, or after fixing bugs.