Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/eai-org/agent-toolkit/self-reviewnpx skills add eai-org/agent-toolkit --skill self-reviewgit clone --depth 1 https://github.com/eai-org/agent-toolkitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/eai-org/agent-toolkit/self-review)<a href="https://agentmods.dev/skills/eai-org/agent-toolkit/self-review"><img src="https://agentmods.dev/badge/skills/eai-org/agent-toolkit/self-review.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00042 | $0.03087 |
| Opus 5 | $0.00021 | $0.01543 |
| Sonnet 5 | $0.00008 | $0.00617 |
| Haiku 4.5 | $0.00004 | $0.00309 |
Grade A, and why
self-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 214 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Self-review
Make a changeset merge-ready before submission — no regressions, sound code, the project's conventions respected — and prove it was scrutinized: a fresh-context reviewer hunts for what would block the merge, the author answers every finding, and a compact report — scannable by a maintainer in seconds — records the outcome. The report is the review record only; the change's what/why belongs to the PR description (e.g. via /handover), never here.
Only for a changeset you authored. The fresh-context reviewer exists to escape authoring
blindness, so someone else's PR has nothing to escape and belongs to maintainer-review.
Resolve the changeset
- Resolve source and target. No input → current branch against the auto-detected target: the
default branch of the
upstreamremote when one exists (fork workflow), else oforigin— viagit ls-remote --symref <remote> HEAD, never the often-absent localrefs/remotes/<remote>/HEAD; that failing (e.g. offline), the sole existing candidate amongmain,master,develop/development(preferringupstream's remote-tracking ref, thenorigin's, then the local branch) — still ambiguous or none → ask. Explicit branches in the invocation win; a detached HEAD → ask which branch is under review. State the chosen target. - The reviewed state is the source as it stands — working tree when checked out, else tip.
Uncommitted work is reviewed, not blocked, once the author sorts it: modified tracked files
are part of the change or deliberate local-only tweaks (build config, data paths), the latter
excluded from the diff (pathspec) and named in a procedural caveat — exclusion drops the whole
path, so a tweak atop a changed file the author stashes first; untracked files likewise, and
since the diff can't see them, those that belong the author
git adds first — a forgotten one ships unreviewed later. The report this skill writes needs no sorting and is always excluded. Nothing beyond the tip reviewed → pinned to its SHA; otherwise unpinned — reviewed, but with no SHA for a maintainer to check the pushed head against, until stamped. Pinned is preferable, so suggest committing first when the work is ready for it — never insist, the stamp closes the gap later. git fetchthe target's remote (local-only target → nothing to fetch; a failed fetch → say so and ask rather than diff stale refs), then diff from the merge base<base>of target and source:git diff <base>for the working tree,git diff <base> <source>for a tip. No merge base → usually a shallow clone or wrong target: deepen (git fetch --unshallow) and retry, else ask — never fall back to diffing against the target itself, which presents its own commits as the author's. Empty diff → probably a wrong target (typical: a fork's default branch already holding the commits) — say so and ask for the true one; it needs no local ref,git fetch <url> <branch>works by URL.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 214 lines · 42 tokens per session scan A 7af5c076841e
self-review is a skill published in the GitHub repository eai-org/agent-toolkit (43 stars, last pushed yesterday), licensed MIT. It adds 42 tokens to every session and 3,087 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
gsd-audit-milestone
Audit milestone completion against original intent before archiving.
spec-kitty-charter-doctrine
Run charter interview, generation, context, and sync workflows for project governance in Spec Kitty 3.x. Access doctrine artifacts programmatically via DoctrineService. Resolve agent profiles. Load action-scoped governance context iteratively, not all at once. Triggers: "interview for charter", "generate charter"…
spec-kitty-spdd-reasons
Drive REASONS Canvas authoring and review for Spec Kitty missions that opted in to Structured-Prompt-Driven Development (SPDD) via charter selection. Triggers: "use SPDD", "use REASONS", "generate a REASONS canvas", "apply structured prompt driven development", "make this mission SPDD". Does NOT handle: enforcing SPDD…
conductor-implement
Executes the tasks defined in the specified track's plan. Use this to start or continue working on a feature, bug fix, or chore.
dependency-upgrade
Plan, batch, and verify dependency upgrades safely. Triages outdated packages into risk tiers, upgrades in order (dev/minor/patch first, runtime majors last), verifies each batch, and produces an auditable commit sequence. Use when asked to "upgrade deps", "bump packages", "update nodemodules", "fix vulnerabilities"…
forensics
Post-mortem a failed GSD auto-mode run. Traces symptom to root cause via .gsd/ activity, journal, metrics, and lock artifacts, producing a filing-ready bug report with file:line refs and a fix suggestion. Use when asked to "forensics", "post-mortem", "why did auto-mode fail", "trace the stuck loop", "debug the crash"…