Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add btspoony/mstar-harness --skill mstar-review-qcgit clone --depth 1 https://github.com/btspoony/mstar-harnessWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/btspoony/mstar-harness/mstar-review-qc)<a href="https://agentmods.dev/skills/btspoony/mstar-harness/mstar-review-qc"><img src="https://agentmods.dev/badge/skills/btspoony/mstar-harness/mstar-review-qc/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/btspoony/mstar-harness/mstar-review-qc"><img src="https://agentmods.dev/badge/skills/btspoony/mstar-harness/mstar-review-qc.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00052 | $0.03270 |
| Opus 5.5 | $0.00021 | $0.01308 |
| Sonnet 5.5 | $0.00010 | $0.00654 |
| Haiku 4.5 | $0.00005 | $0.00327 |
Grade A, and why
mstar-review-qc scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 90 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Load order（必读顺序）
首次 Read 本 skill 时：必须先 Read mstar-harness-core。 同仓检出与派发 → mstar-branch-worktree · mstar-dispatch-gates。冲突时 以 mstar-harness-core 为准。
摘要：职责分层 → references/review-responsibility-boundaries.md（L3 = code reviewer / diff+logic；不跑 test/build；运行时验证归 L1/L4）。Leaf QC 执行 → mstar-roles/references/qc-specialist/。L4 验收 → mstar-roles/references/qa-engineer/。
Morning Star QC Orchestration（PM · 编排层）
L3 是什么（派发前对齐）
- Plan QC seats are reviewers: assigned changed diff / logic / risk lenses and directly affected interfaces — same family as PR review, not a parallel QA test lane.
- Do not instruct QC in Assignment to “run the suite / build / lint to confirm” on shared tri cwd; that causes peer
Blockedand collapses L3 into L4. - Runtime proof stays with scoped implementer evidence and
QA gate(targeted unit evidence only).full tri-reviewdescribes seats, not full-repository review. Scope SSOT →mstar-harness-core§ 定向执行与验证边界; QC never broadens exploration or repeats unchanged L2 evidence. - Retained
sdd evidencebundles are review inputs, not something QC executes: QC reviews the code and the declared coverage rationale; it never runssdd evidence capture, never repeats the recorded child, and a record's integrity/outcome is not acceptance — coverage staysreview-required(command semantics →mstar-sddreferences/file-handoffs.md§ Verification evidence).
分派时机（与 plan / batch 对齐）
Execution mode: sdd：全部 task + L2 task reviewers 完成后 → 强制 tri-review（QC mode: full tri-review，N=3）。Assignment 须含 branch review-package 路径与{SDD_DIR}/review/qcN.mdreport paths。PM 汇总{SDD_DIR}/review/qc-consolidated.md并回写主 plan durable summary。Execution mode: inline：单席qc-specialist（N=1），或按 hotfix 路由跳过。席位自己把报告写入{SDD_DIR}/review/qc.md；该文件路径由 Assignment 的QC report path字段具名指定（N/A仅限显式 conversation-only review），不得让 coordinator 转录会话内容代写。- After
Request Changes(default)：Targeted re-review — PM dispatches only seats that raised blocking findings; each updates the same{SDD_DIR}/review/qcN.md(## Revalidation, update verdict). Do not spawnqcN-rev2.mdfor targeted re-review. Naming →mstar-artifacts/references/plan-files-and-reports.md§ QC 三审触发时机. - Three-seat re-review：only when all three seats have affected findings.
QC re-review: full tri-reviewdenotes seat count, never broader scope; each seat still checks its findings and fix delta. New wave basenames may distinguish reports, but do not reopen unchanged review coverage.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago Changed d2858a88e903
- 8d ago Changed 7bbdc55b6471
- 11d ago Changed · -76 tokens per session c34e038d9aa9
- 12d ago Changed · +2 lines c80dea721a33
- 22d ago Changed bafed3235827
- 25d ago Changed 64d33b4205fb
- 26d ago Changed 9b461c590e68
- 1mo ago Changed · +2 lines 389af5ea6837
- 1mo ago Changed 6b7568dccae9
- 1mo ago First seen · 86 lines · 128 tokens per session scan A f48bc49bdcff
mstar-review-qc is a skill published in the GitHub repository btspoony/mstar-harness (67 stars, last pushed yesterday), licensed MIT. It adds 52 tokens to every session and 3,270 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
comet-verify
Comet Phase 4: Verify and Close. Invoke with /comet-verify. Verify implementation matches design, handle development branch.
comet-review
A read-only review guide for checking the current Comet change, a managed software-change workflow. It focuses on correctness, security, and boundary problems without changing files or advancing the workflow.
comet-github-pr-review
A read-only review process for pull requests in Comet's GitHub repositories. A pull request is a proposed code change; the review checks its current code, related issue, comments, merge status, and automated checks.
openspec-verify-change
Verify implementation matches change artifacts. Use when the user wants to validate that implementation is complete, correct, and coherent before archiving.
requesting-code-review
Use when completing tasks, implementing major features, or before merging to verify work meets requirements.
receiving-code-review
Use when receiving code review feedback, before implementing suggestions, especially if feedback seems unclear or technically questionable - requires technical rigor and verification, not performative agreement or blind implementation.