Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/catwillgh/mainframe/mainframe-peer-reviewnpx skills add CATWILLgh/MAINFRAME --skill mainframe-peer-reviewgit clone --depth 1 https://github.com/CATWILLgh/MAINFRAMEWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/catwillgh/mainframe/mainframe-peer-review)<a href="https://agentmods.dev/skills/catwillgh/mainframe/mainframe-peer-review"><img src="https://agentmods.dev/badge/skills/catwillgh/mainframe/mainframe-peer-review.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00056 | $0.00609 |
| Opus 5 | $0.00028 | $0.00304 |
| Sonnet 5 | $0.00011 | $0.00122 |
| Haiku 4.5 | $0.00006 | $0.00061 |
Grade A, and why
mainframe-peer-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 56 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Independent Codex review
Use Codex only to expose blind spots. The primary Claude session keeps ownership, verifies every material finding, and decides what changes.
Prepare
Inspect codex exec --help and codex exec resume --help. Create a temporary
directory outside the repository and write a neutral English brief with the
decision or final state, alternatives, load-bearing assumptions, verified
evidence, acceptance conditions, and affected paths. Exclude secrets and
unrelated transcript content.
Use gpt-5.6-sol with medium reasoning for complex, ambiguous, cross-cutting,
or architectural work. Use xhigh only for irreversible data, money, security,
broad production impact, or hard-to-reverse architecture.
Run
codex exec --ignore-user-config --strict-config \
-C /absolute/repository -s read-only -m <model> \
-c 'model_reasoning_effort="<effort>"' -c 'approval_policy="never"' --json \
-o /absolute/temporary/answer.md \
"$(< /absolute/temporary/brief.md)" < /dev/null \
> /absolute/temporary/events.jsonl 2> /absolute/temporary/diagnostics.log
Read the final answer and obtain the exact thread_id from thread.started;
never use --last. Treat a missing answer, failed process, or malformed event
stream as unavailable, not approval. Verify every material finding before
changing the decision.
Resume only when a newly verified material finding changes architecture, recommendation, definition of done, or load-bearing evidence. Send the revised package and a concise factual delta to the exact thread:
codex exec resume --ignore-user-config --strict-config <thread-id> -m <model> \
-c 'model_reasoning_effort="<effort>"' -c 'sandbox_mode="read-only"' \
-c 'approval_policy="never"' --json -o /absolute/temporary/answer-2.md \
"$(< /absolute/temporary/follow-up-2.md)" < /dev/null \
> /absolute/temporary/events-2.jsonl 2> /absolute/temporary/diagnostics-2.log
Allow at most three completed passes, keep model and reasoning stable unless a verified result proves under-classification, and never downgrade within a cycle. Remove temporary artifacts after reconciliation. Codex is an independent input, never the final authority.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 56 lines · 56 tokens per session scan A f5532e2ea9f5
mainframe-peer-review is a skill published in the GitHub repository CATWILLgh/MAINFRAME (2 stars, last pushed 15d ago), licensed MIT. It adds 56 tokens to every session and 609 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
built-for-shopify-standards
Prepare a Shopify app for Built for Shopify status. Covers current quality criteria, performance, accessibility, Shopify admin integration, compliance webhooks, observability, support, application readiness, and ongoing eligibility.
dev-troubleshooting
Use when a Shopify dev workflow is failing — shopify app dev cryptic errors, Cloudflare tunnel not starting, App Bridge v3→v4 migration 'No AppBridge context provided', GraphQL 200 OK with throttle errors, webhook 401, double-subscribed webhooks, app proxy 404, REST 302 loops, Rust function wasm-validator errors…
app-performance
Use when optimizing Shopify embedded app performance — LCP, INP, CLS, TTI, cold-start, App Bridge init, Polaris bundle slimming, large GraphQL costs, Remix defer/streaming/prefetch, image lazy-loading, server cache + CDN, Prisma connection pooling, webhook handler latency, and meeting Built for Shopify performance…
app-pricing-strategy
Use when designing Shopify app pricing, choosing a pricing model (flat tiered / usage-based / freemium / hybrid), setting trial length (7/14/30 days), structuring 3-4 tier plans, sizing capped usage, raising prices on existing customers, or writing pricing copy for the App Store listing. Triggers: 'shopify app…
ux-modern-app-feel
Use when you want a Shopify embedded app to feel modern, fast, and opinionated like Linear, Notion, Vercel, or Cron — speed-first, keyboard-first, calm UI, opinionated defaults, no-config success path. Covers keyboard shortcuts inside App Bridge, command palette patterns, micro-interactions Polaris allows, density vs…
ux-polaris-antipatterns
Use when reviewing or writing Polaris UI for common design mistakes — using deprecated Stack instead of BlockStack/InlineStack, modal overuse, blocking validation, wrong tone (success/critical/warning/info), custom CSS overrides instead of tokens, off-brand colors, mis-sized cards, missing helpText, no FormLayout…