Borrowing it
Nothing to install: this file belongs to fmind/dotfiles. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/fmind/dotfiles/main/.agents/skills/full-review/SKILL.mdgit clone --depth 1 https://github.com/fmind/dotfilesWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/fmind/dotfiles/full-review)<a href="https://agentmods.dev/skills/fmind/dotfiles/full-review"><img src="https://agentmods.dev/badge/skills/fmind/dotfiles/full-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/fmind/dotfiles/full-review"><img src="https://agentmods.dev/badge/skills/fmind/dotfiles/full-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00026 | $0.00988 |
| Opus 5.5 | $0.00010 | $0.00395 |
| Sonnet 5.5 | $0.00005 | $0.00198 |
| Haiku 4.5 | $0.00003 | $0.00099 |
Grade A, and why
full-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 64 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Full Repository Review
Confirm this dotfiles repo is healthy end to end: the local gate is green, dot works, every pinned tool/dependency is current, and AGENTS.md/README.md/skills/ still describe the live repo. Every step below is read-only or idempotent — no chezmoi apply, no mise upgrade, no mise run release, no mise run prune.
1. Validate the gate
mise run check # check:actions, check:chezmoi, check:dprint, check:docs, check:go, check:leaks, check:lua, check:python, check:scan, check:shell, check:skills
mise run test # Go (dot/) + Python (skills/python-stack) suites
mise run build # compiles the dot binary
check:docs and check:skills already assert consistency between the documentation and the live CLI (mise tasks, dot commands, the AGENTS.md layout inventory, every SKILL.md under skills/ and .agents/skills/) — a green check:docs proves that layer; don't hand-re-audit it.
2. Confirm the dot CLI
dot verify # sanity checks: environment, tools, secrets, install freshness
dot --help # every subcommand needs an alias, matching skills/dot-cli/SKILL.md
dot status # git/docker/k3d smoke test
mise run doctor # chezmoi doctor + mise doctor
mise run diff # pending chezmoi diff, read-only
Only treat a dot verify failure as a repo bug when it is not explained by local environment state (an unauthenticated CLI, a missing optional secret) — those are sandbox facts, not defects.
3. Check tool and dependency currency (report, don't bump)
mise outdated # repo-scoped tools
mise -C "$HOME" outdated # global tool list
mise --version # warns here when mise itself is behind: `mise self-update`
go -C dot list -m -u all # Go module updates
mise outdated only covers mise-managed pins. Also scan what it can't see: action versions in .github/workflows/*.yml, plugin versions in dprint.json, and any exact-version (not "latest") tool pin in dot_config/mise/config.toml.tmpl. If something is genuinely stale, don't bump it here — hand off to upgrade-tools, one ecosystem at a time, validating after each.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2mo ago First seen · 64 lines · 26 tokens per session scan A 84dd8328d21d
full-review is a skill published in the GitHub repository fmind/dotfiles (4 stars, last pushed 2mo ago), licensed MIT. It adds 26 tokens to every session and 988 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
chrome-devtools
Debug Chrome with DevTools MCP: console, network, performance, accessibility.
full-review
Full review or routine upkeep: read every repo area, fix tools, dead code, stale config, and ignore files, and prove all checks pass.
systematic-debugging
Debug failures to root cause and benchmark fixes: DNS/TLS, Pyinstrument, Memray, hyperfine, oha, Locust.
repository-history
Explain why code exists: Git blame, renames, reverts, and linked PRs.
draft-doc
Create and update Google Docs with gws: native Markdown with Mermaid/SVG figures, or styled .gdoc.
duckdb
Query and export CSV, Parquet, JSON, or SQLite data with DuckDB.