Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Intai/story-flow --skill learn-review-implementationgit clone --depth 1 https://github.com/Intai/story-flowWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/intai/story-flow/learn-review-implementation)<a href="https://agentmods.dev/skills/intai/story-flow/learn-review-implementation"><img src="https://agentmods.dev/badge/skills/intai/story-flow/learn-review-implementation.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00028 | $0.02559 |
| Opus 5 | $0.00014 | $0.01280 |
| Sonnet 5 | $0.00006 | $0.00512 |
| Haiku 4.5 | $0.00003 | $0.00256 |
Grade A, and why
Learn why to review implementation even with 100% test coverage scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 388 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Why Review Implementation Even with 100% Test Coverage?
Overview
This learning module helps junior developers understand why, as of today in 2026, human code review remains essential even when AI-generated code has 100% unit test coverage. Tests only verify code doesn't crash - humans must verify correctness, readability, and maintainability.
Instructions
Present the following content interactively. After each section, use AskUserQuestion to offer 3 options:
- "Continue to next section"
- "Show me an example"
- "I have a question"
Section 1: What 100% Test Coverage Actually Proves (and Doesn't)
Explain what test coverage measures and its limitations:
What 100% test coverage proves:
- Every line of code is executed during tests
- The code doesn't crash during execution
That's it. Coverage doesn't verify correctness - test assertions could be inadequate, wrong, or missing entirely.
What 100% test coverage does NOT prove:
- The code behaves correctly (assertions could be wrong)
- The code meets functional requirements (assertions could be inadequate)
- The code is easy to understand and intuitive
- The code will be easy to modify later
- The variable and function names are clear
- The solution is appropriately simple
The key insight:
Tests answer "Does it crash?" not necessarily "Does it work?" or "Is it good code?" All three questions matter.
Section 2: Why Test Cases Need Review
Since 100% coverage only proves code doesn't crash, the test assertions themselves are critical - and they need human review.
The Problem with Trusting Tests Blindly
// This test "passes" but proves nothing
test('should process order', () => {
const result = processOrder(mockOrder);
expect(result).toBeDefined(); // Weak assertion - just checks it exists
});
// This test passes but has wrong expectation
test('should calculate total', () => {
const total = calculateTotal([10, 20, 30]);
expect(total).toBe(50); // Wrong! Should be 60
});
// This test is missing assertions entirely
test('should update user', async () => {
await updateUser({ id: 1, name: 'John' });
// No assertions - test passes if it doesn't crash
});
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 388 lines · 28 tokens per session scan A 80b1d1ba335e
Learn why to review implementation even with 100% test coverage is a skill published in the GitHub repository Intai/story-flow (12 stars, last pushed yesterday), licensed MIT. It adds 28 tokens to every session and 2,559 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
fabrik-review
Use when operating as the Fabrik Review stage agent. This skill guides code review of an implementation, finding and fixing issues, and ensuring the PR is ready for human review.
fabrik-review-comment
Use when operating as the Fabrik Review comment reviewer. This skill guides applying user decisions on review findings — fixing issues, dismissing false positives, or deferring items — then committing and pushing without signaling stage completion.
fabrik-validate-comment
Use when operating as the Fabrik Validate comment reviewer. This skill guides updating the validation report, re-running checks, and applying minor fixes in response to user feedback — signaling completion only when the user explicitly indicates the issue is resolved.
fabrik-implement-comment
Use when operating as the Fabrik Implement comment reviewer. This skill guides applying user-requested code changes during implementation, committing and pushing, and updating the task checklist — without signaling stage completion.
pull-request-automation
Audits and improves the pull request workflow for a GitHub repository. Covers PR description templates, auto-labelling, CODEOWNERS, PR size checks, and branch protection rules. Invoked when the user asks to improve the PR process, set up PR automation, or add a PR template.
pr-gates
This skill should be used when the user asks to "open a PR", "prepare for review", "address review comments", "run gates", or "verify before pushing" in this repository. Enforces preflight/gate workflow, migration safety, and review-evidence closure.