Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/gerard-labs/superpowers-api-platform/quality-checksnpx skills add gerard-labs/superpowers-api-platform --skill quality-checksgit clone --depth 1 https://github.com/gerard-labs/superpowers-api-platformWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/gerard-labs/superpowers-api-platform/quality-checks)<a href="https://agentmods.dev/skills/gerard-labs/superpowers-api-platform/quality-checks"><img src="https://agentmods.dev/badge/skills/gerard-labs/superpowers-api-platform/quality-checks.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00194 | $0.00818 |
| Opus 5 | $0.00097 | $0.00409 |
| Sonnet 5 | $0.00039 | $0.00164 |
| Haiku 4.5 | $0.00019 | $0.00082 |
Grade A, and why
quality-checks scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 51 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Quality checks (Symfony / API Platform 4.3)
Use when
- Bootstrapping the quality stack of a new project.
- Tightening static analysis (raising PHPStan level, enabling custom rules).
- Setting up CI quality gates that fail on regressions.
- Auditing dependencies for CVEs before deploy.
Default workflow
- PHP-CS-Fixer: install +
@Symfony+@PER-CSrulesets + project-specific overrides. - PHPStan: install +
phpstan-symfony+phpstan-doctrine+ raise level progressively (5 → 7 → 9 → max). - PHPUnit: enable
--coverage-cloverand enforce a minimum on the domain layer. - ParaTest:
./vendor/bin/paratest -p8for parallel CI runs. - Infection:
./vendor/bin/infection --threads=4 --min-msi=80 --min-covered-msi=85— mutation testing on critical packages (domain, voters, processors, finance/rights/PII). composer audit+symfony check:securityon every PR.- Production builds:
composer install --no-dev --optimize-autoloader— nevercomposer update. - Renovate for automated dependency updates.
Guardrails
- CI fails on PHPStan regression. No
// @phpstan-ignorewithout a comment + ticket. - CI fails on coverage drop. Minimum threshold enforced.
- CI fails on MSI regression. Minimum
--min-msi=80and--min-covered-msi=85on critical packages. A green coverage with surviving mutants signals tautological tests — CI must reject it. composer auditruns on every PR. No CVE merged into main.- No
composer updatein CI / prod. Alwayscomposer install. - No
--no-verifyon commits / pushes — hooks exist for a reason.
Progressive disclosure
SKILL.mdcovers posture and tools.reference.mdcarries the full configs (PHP-CS-Fixer.php-cs-fixer.dist.php,phpstan.dist.neonwith extensions, PHPUnitphpunit.xml.dist, GitHub Actions / GitLab CI templates, Renovate config).
Output contract
.php-cs-fixer.dist.php,phpstan.dist.neon,phpunit.xml.dist,infection.json5present and aligned.- CI workflow that runs PHPStan + tests + coverage threshold + Infection (MSI ≥ 80, covered-MSI ≥ 85) + audit.
- Production deploy script using
composer install --no-dev --optimize-autoloader. - Renovate config (or equivalent) in place.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 51 lines · 194 tokens per session scan A 943d6f677633
quality-checks is a skill published in the GitHub repository gerard-labs/superpowers-api-platform (2 stars, last pushed 3mo ago), licensed MIT. It adds 194 tokens to every session and 818 once invoked, about $0.0010 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
symfony:daily-workflow
Daily development workflow for Symfony projects including common tasks, debugging, and productivity tips.
symfony:interfaces-and-autowiring
Master Symfony Dependency Injection with autowiring.
symfony-domain-modeling
Symfony domain modeling — entities, value objects, domain events, aggregates, domain exceptions. Triggers on: entity, value object, domain event, aggregate, domain exception, domain model, domain logic, business rule, invariant.
symfony-validation
Symfony validation — 3-layer validation strategy, constraints, DTO validation, domain invariants, validation groups, custom validators. Triggers on: validation, validator, constraint, DTO validation, input validation, invariant, assert, validation group.
Behat BDD Testing
PHP BDD testing with Behat framework using Gherkin feature files, Mink browser extension, context classes, and Symfony integration for behavior-driven acceptance testing.
ccxt-php
CCXT cryptocurrency exchange library for PHP developers. Covers both REST API (standard) and WebSocket API (real-time). Helps install CCXT, connect to exchanges, fetch market data, place orders, stream live tickers/orderbooks, handle authentication, and manage errors in PHP 8.1+. Use when working with crypto exchanges…