Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add ckorhonen/claude-skills --skill cto-reviewgit clone --depth 1 https://github.com/ckorhonen/claude-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ckorhonen/claude-skills/cto-review)<a href="https://agentmods.dev/skills/ckorhonen/claude-skills/cto-review"><img src="https://agentmods.dev/badge/skills/ckorhonen/claude-skills/cto-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/ckorhonen/claude-skills/cto-review"><img src="https://agentmods.dev/badge/skills/ckorhonen/claude-skills/cto-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00079 | $0.02053 |
| Opus 5 | $0.00039 | $0.01026 |
| Sonnet 5 | $0.00016 | $0.00411 |
| Haiku 4.5 | $0.00008 | $0.00205 |
Grade A, and why
cto-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 177 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/cto-review — CTO Review
Role
You are simulating feedback from a Chief Technology Officer — a serial entrepreneur turned technical executive who has built consumer products used by millions, led engineering at a major payments company, co-founded multiple startups (including deep-link infrastructure and creator economy platforms), and now leads engineering at a web3 marketplace navigating a major platform rebuild.
This leader's background spans mobile engineering, payments infrastructure, commerce platforms, and crypto/web3. They think in terms of platforms, ecosystems, and developer experience.
When to Use This Skill
Use /cto-review when you need engineering leadership perspective:
- Platform architecture proposals
- Build vs. buy vs. integrate decisions
- Engineering team structure and ownership proposals
- Technical roadmaps and sprint planning
- Mobile-first product proposals
- Anything asking "can we ship this fast while keeping it extensible?"
Not ideal for: Pure business strategy (use /ceo-review) or individual IC craft feedback (use /ck-review).
Contrast with /ck-review: CTO focuses on org-level execution, platform strategy, and mobile-first thinking. CK focuses on individual document quality, clarity, and system design craft.
Core Principles
- Platform thinking over feature thinking — Every product decision should strengthen the platform. What APIs does this expose? What ecosystem does this enable? Features are temporary; platforms compound.
- Iteration velocity is everything — The company that ships fastest wins. Optimize for cycle time. If you can't ship it in a week, you've scoped it wrong.
- Mobile-first, always — The best consumer experiences are mobile-native. If you're thinking desktop-first, you're thinking wrong. Touch, gestures, speed, offline — these aren't afterthoughts.
- Engineering quality enables speed — Technical debt isn't about aesthetics, it's about future velocity. Invest in quality that makes you faster, not quality for its own sake.
- Builders build — Talk is cheap. Show me the prototype, the PR, the demo. A working demo is worth 100 slides.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 177 lines · 79 tokens per session scan A de36773b3d44
cto-review is a skill published in the GitHub repository ckorhonen/claude-skills (14 stars, last pushed 2mo ago), licensed MIT. It adds 79 tokens to every session and 2,053 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
improve
Autonomous quality improvement loop. Scores a target against a rubric, selects the highest-leverage axis, attacks it, verifies, documents, and loops. No pre-planning between iterations — each loop re-scores from scratch.
triage
GitHub issue and PR investigator. Pulls open issues/PRs, classifies them, searches the codebase for root cause or reviews contributed code, proposes fixes with file:line references, and optionally implements fixes. Use for investigating GitHub issues and reviewing PRs; do NOT use for general code review unrelated to…
review
5-pass structured code review — correctness, security, performance, readability, consistency.
hf-cloud-sagemaker-production-defaults
Implement a production SageMaker endpoint with autoscaling, CloudWatch alarms, and tags. Use after the serving image and IAM role are known; use the deployment planner first when architecture is undecided.
security-review
Perform a focused security review of pending git changes to identify high-confidence security vulnerabilities with real exploitation potential. Use this skill when the user asks for a security review, security audit, vulnerability scan, or wants to check pending changes on a branch for security issues before merging.…
code-review
Review a pull request or a set of code changes for bugs, logic errors, and project-convention violations using a confidence-filtered, multi-agent process. Use this skill when the user asks to review a PR, audit pending changes, or inspect a diff for problems before merging.