A scaffold for creating a new brooks-lint analysis skill, including its instruction file, step-by-step guide, and evaluation entry. brooks-lint is the repository's framework for checking these skills.

Use it when adding a new analysis skill to the repository, such as a security or testing skill, and when you need the standard files and test coverage created.

It turns the repository's checklist into generated files and wiring, reducing the chance of missing required sections or validation and evaluation setup.

new-skill — Skill for Claude Code by hyhmrright

About the project

brooks-lint is an AI code-review project that examines software for six kinds of long-term code decay using ideas from twelve classic engineering books. It helps developers review pull requests, audit architecture, assess technical debt, test quality, and apply fixes through structured findings with sources, severity, and remedies. Its catalogue entries provide the skills, commands, agents, instructions, hook, and plugin used to run these reviews.

hyhmrright/brooks-lint · 1,462 stars · on GitHub · hyhmrright.github.io

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add hyhmrright/brooks-lint --skill new-skill

Clone the repo

git clone --depth 1 https://github.com/hyhmrright/brooks-lint

Made for: Claude Code.

Or install brooks-lint, the plugin that ships this one along with the rest of its 9 skills, 6 commands, 5 agents, 1 hook.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/hyhmrright/brooks-lint/new-skill/github.svg)](https://agentmods.dev/skills/hyhmrright/brooks-lint/new-skill)

Your own site

<a href="https://agentmods.dev/skills/hyhmrright/brooks-lint/new-skill"><img src="https://agentmods.dev/badge/skills/hyhmrright/brooks-lint/new-skill/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/hyhmrright/brooks-lint/new-skill"><img src="https://agentmods.dev/badge/skills/hyhmrright/brooks-lint/new-skill.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 145 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 754 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits

NVIDIA SkillSpector warn 7 Sept 2026

SkillSpector: 2 findings, up to medium

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

medium Rogue Agent · line 10
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
medium Agent Snooping · line 28
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Fix: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.

How audits are shown

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00145	$0.00754
Opus 5	$0.00072	$0.00377
Sonnet 5	$0.00029	$0.00151
Haiku 4.5	$0.00015	$0.00075

Measured 11d ago against content hash adb5b06609d8, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-10, from the pricing page.

Security

Grade A, and why

new-skill scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.claude/skills/new-skill/SKILL.md · 51 lines

What it actually says

brooks-lint — New Skill Scaffold

Skill name comes from $ARGUMENTS (kebab-case, e.g. brooks-security). If empty, ask for the name and a one-line purpose first.

Follow the repo's "Adding a New Skill" checklist exactly:

Create skills/{name}/SKILL.md with frontmatter — name, a description that ends with a Do NOT trigger for: clause (validate-enforced for shipped skills; omitting it causes false triggering), and a Process section of 3–6 bullets that cite the guide's step ranges inline (e.g. Scan risks (Steps 1–6 of the guide)). Mirror the structure of an existing skill such as skills/brooks-review/SKILL.md (Setup → Process → Mode line).
Create skills/{name}/{name}-guide.md with sequentially numbered steps — no gaps, no duplicates. Sub-steps like Step 2a are allowed. The guide owns the detailed steps; the SKILL.md Process is just an orientation skeleton.
Wire the framework. The new SKILL.md Setup section must Read the relevant _shared/ files (common.md for Iron Law + Report Template, plus decay-risks.md / test-decay-risks.md as applicable) — _shared/ is NOT auto-loaded.
Add eval coverage to evals/evals.json: append with the next sequential id at least one happy-path scenario (with the relevant risk code in expected_output) and at least one false-positive scenario flagged no_risk_codes: true. Each scenario needs id, name, prompt, expected_output, mode, files.
Validate. npm run validate (structure + step continuity + Process-section presence) and npm run evals (eval schema). Fix until both pass.
Local-test. cp -r skills/* ~/.claude/skills/brooks-lint/ (if you've symlinked ~/.claude/skills/brooks-lint to the repo, skip this — edits are already live), trigger the new skill in a Claude session, verify the Iron Law output, then restore the marketplace copy: /plugin marketplace update → /plugin install brooks-lint@brooks-lint-marketplace.

Do NOT register a slash command by hand — short forms are auto-installed by the session-start hook. Report the files created and the validate/evals results.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

11d ago First seen · 51 lines · 145 tokens per session scan A adb5b06609d8

Subscribe to this mod's changes

new-skill is a skill published in the GitHub repository hyhmrright/brooks-lint (1,462 stars, last pushed 3d ago), licensed MIT. It adds 145 tokens to every session and 754 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Building agents Code review architecture-review claude-code-plugin clean-architecture code-quality tech-debt

recipe-front-review

Reviews completed frontend implementation for governing-source compliance, scope economy, repository quality, and security, then applies user-approved React corrections.

shinpr/claude-code-workflows · 29 tokens

review

Perform a structured code review by composing validation checklists from relevant atoms based on what code changed. Loads atoms conditionally -- clean-code always, architecture/DDD/security/tests only when the delta touches their domain. Produces a severity-ordered report with specific locations and fixes. Use when…

techygarg/lattice · 95 tokens

procoder

Work like a senior developer in a repository governed by procoder: run the commit gate before calling anything done, format and lint through the binary, and drive the spec, plan, todo, backlog, and sprint chain in .procoder/. Use this skill when the repository contains a .procoder/ directory or an AGENTS.md naming…

azrtydxb/procoder · 101 tokens

code-review

The depth half of a review - the dimensions a diff is read against (correctness, boundaries, concurrency, failure paths, secrets, data access, structure, test quality) and the rule that a finding is refuted before it is reported. The verdict stays with the reviewer agent. Use when reviewing a diff or a pull request…

jjanczur/tyran · 80 tokens

deslop

The optimization pass, defined - delete before you add, one smell class per pass, behaviour pinned by a test that ran BEFORE the edit. Lints a SKILL.md and prose by the same instinct. Use for the per-story optimization pass or when code has grown noisy without growing capable.

jjanczur/tyran · 58 tokens

code-confidence-map

Assesses code comprehensibility and maintainability risk. Use when the user asks about code confidence, risk, maintainability, tech debt, code health, or whether code is safe to change. Also use when the user asks to analyze code quality, scan for risks, check if code is messy or complex, audit code, do a code…

kanyun-inc/reskill · 104 tokens