Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add JasonColapietro/suede-creator-skills --skill suede-codegit clone --depth 1 https://github.com/JasonColapietro/suede-creator-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/jasoncolapietro/suede-creator-skills/suede-code)<a href="https://agentmods.dev/skills/jasoncolapietro/suede-creator-skills/suede-code"><img src="https://agentmods.dev/badge/skills/jasoncolapietro/suede-creator-skills/suede-code/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/jasoncolapietro/suede-creator-skills/suede-code"><img src="https://agentmods.dev/badge/skills/jasoncolapietro/suede-creator-skills/suede-code.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00115 | $0.04599 |
| Opus 5.5 | $0.00046 | $0.01840 |
| Sonnet 5.5 | $0.00023 | $0.00920 |
| Haiku 4.5 | $0.00012 | $0.00460 |
Grade A, and why
suede-code scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
Verify: set JWT_SECRET="" and curl /api/me: expect 401, currently 200. How it starts
The opening of the file, as written. The whole thing — 379 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Suede AI Code Skills
One skill for judging code: what is wrong, and whether it ships. Every finding has a file, evidence, and a fix path. Every grade has the evidence that earned it. No finding without evidence; no volume without signal.
Runs only when asked. Never fire this as a side effect of a diff, a save, or a commit.
Compatibility
An agent with repository read access and Git; Bash is needed for local tests and the bundled commit-dirt scan. Fix mode additionally needs authorized file edits. Review can proceed with explicitly unverified runtime checks when execution is unavailable.
Gate policy: advisory, not blocking
Every check, grade, and ship verdict here is a recommendation to the user, not a control on the agent.
- Run every check and report results honestly.
ship,ship-with-caveats,hold, letter grades, and BLOCKED items are advice attached to the work. - Never block, delay, skip, or rewrite the action the user asked for because a gate said hold. A failed gate changes what you report, never what you do.
- Single exception: an extreme-risk finding (data loss, credential exposure, legal or rights violation, payment mistake, irreversible public damage). Pause, state the risk and the options, and let the user pick. Their choice is final.
Pick the mode
| Request sounds like | Mode | Emits |
|---|---|---|
| "review and grade", "is this safe to ship", "check this PR" | full (default) | Findings, grade, deploy safety, commit dirt, ship gate |
| "findings only", "no grade", "line by line", "find the bugs" | --findings-only |
Findings, deploy safety, commit dirt, ship gate. No letters. |
| "grade only", "give it a letter", "A-F verdict", "should this merge" | --grade-only |
Lane grades, caps, required upgrades, ship gate. No findings list. |
Grade-only still runs Step 1 (Instant-F) and still reads the code. It skips the itemized findings output, not the investigation.
Other modes that combine with any of the above:
What ships with it
12 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- agents/openai.yaml 436 B
- CARD.md 4.4 KB
- references/grading-contract.md 3.1 KB
- references/maintainability-baseline.md 3.4 KB
- references/security-baselines.md 3.3 KB
- references/threat-verify.md 1.4 KB
- references/traps-swift-ios.md 3.7 KB
- references/traps-web.md 11 KB
- references/usage-contract.md 845 B
- references/worked-example-grade-only.md 7.9 KB
- references/worked-example.md 11 KB
- scripts/commit-dirt-scan.sh 3.3 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed · -50 lines · -116 tokens per session 82c33f0e1db6
- 3d ago Changed · +194 lines · +65 tokens per session d22404149d10
- 23d ago Changed fe00c98db29d
- 26d ago Changed · -1 tokens per session 66730f7774f1
- 1mo ago First seen · 235 lines · 167 tokens per session scan A e7fab39147b4
suede-code is a skill published in the GitHub repository JasonColapietro/suede-creator-skills (126 stars, last pushed today), licensed MIT. It adds 115 tokens to every session and 4,599 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
code-review
Review a change along two axes — Standards (does the code follow the repo's documented standards, plus a smell baseline?) and Spec (does it faithfully implement the originating issue/spec?) — run as parallel sub-agents and reported side by side, prioritizing correctness, lifecycle, and security over style. Use when…
pr-history-hygiene
Keep pull-request history deliberate and safe — split independent changes, rewrite with lease-protected force-push (never raw force), apply one kind label plus all material area labels, and land a stack of dependent PRs through the platform's native stack feature rather than manually merging and retargeting. Use when…
responding-to-review-on-a-stack
Respond to code review across a dependent PR stack — fix on the PR that introduced the issue, propagate the fix up-stack, keep each review fix a distinct commit, lease-protect any rewrite, and re-audit threads, approvals, and checks after every rewrite. Use when review comments span several stacked PRs.
role-auditor
Use when the overall state of the repo needs checking (not a diff) — before releases, after major rework, at milestone gates, or periodically: pattern consistency, module boundaries, security posture, rule compliance, doc drift. Not for package reviews (→ role-reviewer).
role-reviewer
Use when a completed work package or a bounded diff needs checking — architecture, risks, test quality, truth of DONE/status claims — including as a review subagent in autonomous-loop. Not for whole-repo state audits (→ role-auditor).
react-patterns
React 19 performance patterns and composition architecture for Vite + Cloudflare projects. 50+ rules ranked by impact — eliminating waterfalls, bundle optimisation, re-render prevention, composition over boolean props, server/client boundaries, and React 19 APIs. Use when writing, reviewing, or refactoring React…