Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Effulgent-Point/paw --skill quality-gategit clone --depth 1 https://github.com/Effulgent-Point/pawWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/effulgent-point/paw/quality-gate)<a href="https://agentmods.dev/skills/effulgent-point/paw/quality-gate"><img src="https://agentmods.dev/badge/skills/effulgent-point/paw/quality-gate/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/effulgent-point/paw/quality-gate"><img src="https://agentmods.dev/badge/skills/effulgent-point/paw/quality-gate.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.00468 |
| Opus 5.5 | $0.00000 | $0.00187 |
| Sonnet 5.5 | $0.00000 | $0.00094 |
| Haiku 4.5 | $0.00000 | $0.00047 |
Grade A, and why
quality-gate scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 51 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Quality Gate Skill
When to use: Reviewing code before merge. Running multiple review agents. Deciding what blocks and what doesn't.
The review checklist
Run through these dimensions for every change:
| Dimension | What to check |
|---|---|
| Correctness | Does it do what the spec says? Not what you assume it should do. |
| Edge cases | Empty input, null, max values, concurrent access, unicode, timezone |
| Error handling | Are failures logged and handled? Or swallowed silently? |
| Tests | Do they exist? Exercise behavior (not just import)? Cover unhappy paths? |
| Observability | Logs at boundaries? Metrics for SLIs? Enough to debug at 3 AM? |
| Security | Input validated? Output encoded? Authz checked? Secrets safe? |
| Documentation | Public API documented? Breaking changes noted? CHANGELOG updated? |
| Performance | N+1 queries? Unbounded fetches? Missing pagination? |
Severity rubric
Not everything is critical. Honest severity is more useful than inflated severity.
| Level | Meaning | Action |
|---|---|---|
| Critical | Data loss, security vulnerability, runtime crash, undocumented breaking change | Blocks merge. Must fix. |
| Warning | Missing test, swallowed error, unclear naming on public API, missing docs | Fix before merge. |
| Info | Nit, style preference, optional improvement, minor inconsistency | Optional. Author decides. |
Running multiple reviewers
Invoke each agent by name. They work independently — that's the point.
> Use the code-reviewer agent on the current diff.
> Use the bug-auditor agent on the current diff.
> Use the security-reviewer agent on the current diff.
Each checks different dimensions. Aggregate findings by severity:
- Any critical from any agent = do not merge
- Warnings = fix before merge
- Info = author decides
What NOT to flag in reviews
- Formatter / linter issues (the formatter handles those)
- Style preferences that are opinion, not clarity
- Architectural rewrites of already-merged code
- Missing features the spec doesn't require
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 51 lines · 0 tokens per session scan A 6499b97c6db1
quality-gate is a skill published in the GitHub repository Effulgent-Point/paw (2 stars, last pushed 2mo ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 468 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
hunk-launch-video
Produces Hunk videos by driving the real TUI headlessly in a PTY, compositing captioned 1080p frames in Chromium, and encoding with ffmpeg. Use for feature demos, workflow explainers, announcements, launch videos, and full-release roundups.
hunk-release
Prepares, publishes, verifies, and curates Hunk releases. Use for release metadata, benchmarks, tags, publishing, release videos, backports, or recovery.
shadow-verify
Dispatch a parallel adversarial verifier wave after any high-stakes sub-agent investigation (code reviews, audits, findings reports, large refactors, gap analyses) — or whenever a sub-agent asserts a claim with high-confidence language, since confidence is a trigger, not a verdict. Use when sub-agent output will drive…
code-review
Reviewing code for defects: diff-first reading, severity classification, evidence over inference, finding caps, and terminal verdicts. Use when reviewing a diff, PR, or patch, or auditing someone else's work.
responding-to-review
Answering review findings: verify each claim before implementing, no performative agreement, per-item fix/reject/defer with evidence, one batched remediation round. Use when responding to review or remediation rounds.
simplify
Discovers incidental complexity, duplication, and dead code in a codebase and produces a ranked, behavior-preserving reduction plan — optionally applying safe changes. Dispatches four parallel read-only discovery lenses (clone detection, dead code, complexity hotspots, wrong abstraction), synthesizes into a…