Borrowing it
Nothing to install: this file belongs to cliftonc/drizzle-cube. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/cliftonc/drizzle-cube/main/.claude/skills/quality-gate/SKILL.mdgit clone --depth 1 https://github.com/cliftonc/drizzle-cubeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/cliftonc/drizzle-cube/quality-gate)<a href="https://agentmods.dev/skills/cliftonc/drizzle-cube/quality-gate"><img src="https://agentmods.dev/badge/skills/cliftonc/drizzle-cube/quality-gate/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/cliftonc/drizzle-cube/quality-gate"><img src="https://agentmods.dev/badge/skills/cliftonc/drizzle-cube/quality-gate.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 105 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 122 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00121 | $0.01837 |
| Opus 5.5 | $0.00048 | $0.00735 |
| Sonnet 5.5 | $0.00024 | $0.00367 |
| Haiku 4.5 | $0.00012 | $0.00184 |
Grade A, and why
quality-gate scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 150 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Quality Regression Gate
A "don't make it worse" gate for drizzle-cube. The hard part of static analysis on a mature codebase is noise: there are already 373 high-complexity functions, 120 duplicate clone groups, and 20 circular dependencies. Reporting those on every change is useless.
The gate is built around one tool that solves this: fallow audit scopes analysis to
the changed files and distinguishes findings the change introduced from findings it
inherited. The default new-only gate fails only on introduced findings. That — and
only that — is what "quality doesn't regress" means here. Inherited debt is reported for
context but never blocks.
When to use
- After a refactor or feature touching several files, before committing / opening a PR.
- When the user asks to verify a change is clean or that quality hasn't regressed.
- NOT needed for one-line fixes or doc/test-only edits — the gate's value is on large diffs.
This gate is the static-analysis layer. It complements, and does not replace,
npm run typecheck, npm run lint, and npm test. For a full pre-PR check, run those too.
Documentation Context
If the change affects public docs, examples, or agent-facing guidance, review https://www.drizzle-cube.dev/llms.txt to understand the published documentation surface before reporting quality findings. Do not run this quality gate solely because of a one-line or documentation-only edit; the guidance above still applies.
The one command that matters
npm run quality # fallow audit, base auto-detected (merge-base vs main/origin)
fallow audit auto-detects the base as the git merge-base against the branch's upstream or
origin/main, so on a feature branch no argument is needed. To pin the base explicitly
(pass args through npm with --):
npm run quality -- --base main
npm run quality -- --base "$(git merge-base main HEAD)"
Report-only: npm run quality always exits 0 — it never fails the build. The wrapper
runs fallow audit and then forces a clean exit, so the gate is advisory, not blocking.
You still read the verdict (pass / warn / fail) and the introduced findings from
the report — treat a fail verdict as "worth a look / mention in the PR," not as a hard
stop. The verdict ignores inherited findings — watch for the line
audit gate excluded N inherited findings, which confirms pre-existing debt was not counted
against the change.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2mo ago First seen · 150 lines · 121 tokens per session scan A 0f1318fce4e4
quality-gate is a skill published in the GitHub repository cliftonc/drizzle-cube (65 stars, last pushed yesterday), licensed MIT. It adds 121 tokens to every session and 1,837 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
recipe-front-review
Reviews completed frontend implementation for governing-source compliance, scope economy, repository quality, and security, then applies user-approved React corrections.
codebase-review
Review an entire codebase for architecture, engineering health, and exploitable risk; generate a prioritized remediation plan, an evidence-anchored system knowledge document, or both.
review-ticket
Review a ticket or PR through focused specialist lenses: scope, architecture, security, tests, AC coverage, and PR metadata.
common-feedback-reporter
Pre-write audit for skill violations: checks planned code against loaded skill anti-patterns before any file write. Use when writing Flutter/Dart/TS code or editing SKILL.md files with active project skills. Load as composite; on auto-fixed violation, also load +common/common-learning-log.
react-patterns
React 19 performance patterns and composition architecture for Vite + Cloudflare projects. 50+ rules ranked by impact — eliminating waterfalls, bundle optimisation, re-render prevention, composition over boolean props, server/client boundaries, and React 19 APIs. Use when writing, reviewing, or refactoring React…
qa-frontend
Internal PostHog developer frontend/browser QA skill. Use only when a PostHog developer explicitly asks to run frontend QA, browser-test a PR, verify a UI flow against the local PostHog stack, use qa-frontend, or QA current frontend changes with browser/runtime evidence, or to make a feature reel (see reel mode…