Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add dmae97/omk --skill ponytail-reviewgit clone --depth 1 https://github.com/dmae97/omkWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dmae97/omk/ponytail-review)<a href="https://agentmods.dev/skills/dmae97/omk/ponytail-review"><img src="https://agentmods.dev/badge/skills/dmae97/omk/ponytail-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/dmae97/omk/ponytail-review"><img src="https://agentmods.dev/badge/skills/dmae97/omk/ponytail-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00100 | $0.01145 |
| Opus 5.5 | $0.00040 | $0.00458 |
| Sonnet 5.5 | $0.00020 | $0.00229 |
| Haiku 4.5 | $0.00010 | $0.00114 |
Grade A, and why
ponytail-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 90 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Review diffs for unnecessary complexity. One line per finding: location, what to cut, what replaces it. The diff's best outcome is getting shorter.
Format
L<line>: <tag> <what>. <replacement>., or <file>:L<line>: ... for
multi-file diffs.
Tags:
delete:dead code, unused flexibility, speculative feature. Replacement: nothing.stdlib:hand-rolled thing the standard library ships. Name the function.native:dependency or code doing what the platform already does. Name the feature.yagni:abstraction with one implementation, config nobody sets, layer with one caller.shrink:same logic, fewer lines. Show the shorter form.
Examples
❌ "This EmailValidator class might be more complex than necessary, have you considered whether all these validation rules are needed at this stage?"
✅ L12-38: stdlib: 27-line validator class. "@" in email, 1 line, real validation is the confirmation mail.
✅ L4: native: moment.js imported for one format call. Intl.DateTimeFormat, 0 deps.
✅ repo.py:L88: yagni: AbstractRepository with one implementation. Inline it until a second one exists.
✅ L52-71: delete: retry wrapper around an idempotent local call. Nothing replaces it.
✅ L30-44: shrink: manual loop builds dict. dict(zip(keys, values)), 1 line.
Scoring
End with the only metric that matters: net: -<N> lines possible.
If there is nothing to cut, say Lean already. Ship. and stop.
Boundaries
Scope: over-engineering and complexity only. Correctness bugs, security holes,
and performance are explicitly out of scope. Route them to a normal review
pass, not this one. A single smoke test or assert-based
self-check is the ponytail minimum, not bloat, never flag it for deletion.
Does not apply the fixes, only lists them.
"stop ponytail-review" or "normal mode": revert to verbose review style.
OMK Vendoring Notice
This skill is vendored from the upstream Ponytail
project (npm: @dietrichgebert/ponytail) as a pure markdown OMK skill, copied unmodified in
substance from skills/ponytail-review/SKILL.md at pinned commit
40e50d9
(full SHA 40e50d9e03242aa5dd53ac771950f9127362b25f).
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 90 lines · 100 tokens per session scan A 75c4cec9f8c1
ponytail-review is a skill published in the GitHub repository dmae97/omk (148 stars, last pushed today), licensed MIT. It adds 100 tokens to every session and 1,145 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
review-harness
Use when reviewing implementation work that ran through a /tmp Pi task harness. Checks contract drift, unsafe shortcuts, validation evidence, and status honesty.
review
Review checkpoints in SyncPoint — create review requests, add checklists, submit evidence, approve or request changes. Use when reviewing another agent's work before it can proceed.
pr-review
Review Cool Workflow pull requests or branch diffs. Use when Codex must inspect code changes for bugs, regressions, FreeBSD/POLA violations, missing tests, generated artifact drift, release-contract risk, or CI implications, and return findings first with file/line citations.
autofix-pr
Watch a pull request and fix it from a worktree of its own - CI failures, review feedback from trusted authors and merge conflicts are fixed, pushed to the PR branch and answered on the PR under the user's git and gh identity. Usage - /autofix-pr [ | ] [--once] [--every ] [--no-reply] [--yes] [instructions]…
gh-compile-issues
Triage N GitHub issues into a coverage matrix: fetch each, check current code, classify already-done/quick-fix/design/defer with cited evidence.
gh-find-prs
Survey open Codewhale PRs and triage each for mergeability and disposition against the real landing branch.