Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add btspoony/mstar-harness --skill mstar-review-qcgit clone --depth 1 https://github.com/btspoony/mstar-harnessWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/btspoony/mstar-harness/mstar-review-qc)<a href="https://agentmods.dev/skills/btspoony/mstar-harness/mstar-review-qc"><img src="https://agentmods.dev/badge/skills/btspoony/mstar-harness/mstar-review-qc/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/btspoony/mstar-harness/mstar-review-qc"><img src="https://agentmods.dev/badge/skills/btspoony/mstar-harness/mstar-review-qc.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00128 | $0.02226 |
| Opus 5 | $0.00064 | $0.01113 |
| Sonnet 5 | $0.00026 | $0.00445 |
| Haiku 4.5 | $0.00013 | $0.00223 |
Grade A, and why
mstar-review-qc scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 13d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 77 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Load order（必读顺序）
首次 Read 本 skill 时：必须先 Read mstar-harness-core。 同仓检出与派发 → mstar-branch-worktree · mstar-dispatch-gates。冲突时 以 mstar-harness-core 为准。
摘要：职责分层 → references/review-responsibility-boundaries.md（L3 = code reviewer / diff+logic；不跑 test/build；运行时验证归 L1/L4）。Leaf QC 执行 → mstar-roles/references/qc-specialist/。L4 验收 → mstar-roles/references/qa-engineer/。
Morning Star QC Orchestration（PM · 编排层）
L3 是什么（派发前对齐）
- Plan QC seats are reviewers: whole-branch diff / logic / risk lenses — same family as PR review, not a parallel QA test lane.
- Do not instruct QC in Assignment to “run the suite / build / lint to confirm” on shared tri cwd; that causes peer
Blockedand collapses L3 into L4. - Runtime proof stays with implementer evidence and
QA gate(qa-engineeror PM acceptance).
分派时机（与 plan / batch 对齐）
Execution mode: sdd：全部 task + L2 task reviewers 完成后 → 强制 tri-review（QC mode: full tri-review，N=3）。Assignment 须含 branch review-package 路径与{SDD_DIR}/review/qcN.mdreport paths。PM 汇总{SDD_DIR}/review/qc-consolidated.md并回写主 plan durable summary。Execution mode: inline：单席qc-specialist→{SDD_DIR}/review/qc.md（N=1），或按 hotfix 路由跳过。- After
Request Changes(default)：Targeted re-review — PM dispatches only seats that raised blocking findings; each updates the same{SDD_DIR}/review/qcN.md(## Revalidation, update verdict). Do not spawnqcN-rev2.mdfor targeted re-review. Naming →mstar-artifacts/references/plan-files-and-reports.md§ QC 三审触发时机. - Full tri re-review (exception)：Assignment
QC re-review: full tri-review→ new basenames (qc1-rev2.md…); PM marks active wave in consolidated decision.
Engine check (when available): run
mstar review seats <assignment-file> [--mode sdd|inline|targeted] [--reviewers <role1,role2,...>](orimport { executionModeToN, assertTriIdentity } from "@mstar-harness/engine"in a host hook) to mapExecution modeto its QC seat count N above and assert tri identity. Onfail-> do not proceed; fix and re-run. Skill text below remains authoritative when the runtime is absent.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 13d ago First seen · 77 lines · 128 tokens per session scan A 413944a680b1
mstar-review-qc is a skill published in the GitHub repository btspoony/mstar-harness (57 stars, last pushed today), licensed MIT. It adds 128 tokens to every session and 2,226 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
comet-verify
Comet Phase 4: Verify and Close. Invoke with /comet-verify. Verify implementation matches design, handle development branch.
comet-review
A read-only review guide for checking the current Comet change, a managed software-change workflow. It focuses on correctness, security, and boundary problems without changing files or advancing the workflow.
comet-github-pr-review
A read-only review process for pull requests in Comet's GitHub repositories. A pull request is a proposed code change; the review checks its current code, related issue, comments, merge status, and automated checks.
openspec-verify-change
Verify implementation matches change artifacts. Use when the user wants to validate that implementation is complete, correct, and coherent before archiving.
requesting-code-review
Use when completing tasks, implementing major features, or before merging to verify work meets requirements.
receiving-code-review
Use when receiving code review feedback, before implementing suggestions, especially if feedback seems unclear or technically questionable - requires technical rigor and verification, not performative agreement or blind implementation.