Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add javiarmesto/ALDC-AL-Development-Collection --skill skill-al-review-pipelinegit clone --depth 1 https://github.com/javiarmesto/ALDC-AL-Development-CollectionWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/javiarmesto/aldc-al-development-collection/skill-al-review-pipeline)<a href="https://agentmods.dev/skills/javiarmesto/aldc-al-development-collection/skill-al-review-pipeline"><img src="https://agentmods.dev/badge/skills/javiarmesto/aldc-al-development-collection/skill-al-review-pipeline/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/javiarmesto/aldc-al-development-collection/skill-al-review-pipeline"><img src="https://agentmods.dev/badge/skills/javiarmesto/aldc-al-development-collection/skill-al-review-pipeline.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00045 | $0.02016 |
| Opus 5.5 | $0.00018 | $0.00806 |
| Sonnet 5.5 | $0.00009 | $0.00403 |
| Haiku 4.5 | $0.00005 | $0.00202 |
Grade A, and why
skill-al-review-pipeline scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 142 lines — stays where its author put it; the contents beside it link to each section on GitHub.
AL review pipeline
Read the provider contract and task-context guidance. Resolve these links from this installed skill, not a sibling repository. This procedure supplements the caller's write scope, report format and human gate; it grants no extra tools and never authorizes changes to the provider or AL code.
Scope and independent evidence
Start from the requested files/diff and acceptance criteria. A standalone reviewer resolves context itself; a Conductor reviewer consumes the supplied phase context and reads precise references only for gaps. An explicitly attached object is a valid scope without a Git diff. Missing source means no code review has occurred. Read relevant rules explicitly; do not assume another agent loaded them for you. Verify claims in an implementer's report against current code and evidence. Never approve code generated in your own context as an independent review.
Execute the selected provider
- Select the provider from this project's configuration. In plugin mode discover
the exact configured identity in the host and load its instructions here;
home,entryPointandworkspacebelong to multiroot selection. Do not fall back to a different clone or rename a skill implicitly. - Follow the loaded provider's execution model. For an instruction-based skill, loading starts the workflow: apply its Entry/routing, READ/DO and dispatched checks to the actual inputs. You produce their results; do not wait for the host to emit them automatically or recursively invoke the same skill. A tool invocation is required only when the loaded provider actually requires one.
- Derive layers and filters from supported provider configuration/defaults.
Preserve the actual routing result. Do not pick only the most obvious leaf:
account for each dispatched check and each applicable child of a super-skill
as completed, not applicable, skipped with reason, partial, failed or pending.
Follow provider relevance rules; do not execute irrelevant checks merely to
fill a table. Reuse already-read knowledge within this invocation.
Entry may return more than one top-level skill in
dispatch[]— for example theal-code-reviewsuper-skill plus the Communityal-agents-reviewleaf, which is a first-level peer and not one of the super-skill's children. Execute every dispatched entry and retain every resulting findings-report; never treat the first report as the whole run. Roll each one intosub-resultsand account for it in coverage under its own domain label. When the provider documents bounded retrieval helpers (BCQuality:tools/Search-Knowledge.ps1for the catalog andtools/Get-KnowledgeArticles.ps1for bodies), prefer them over ad-hoc reads where an execution capability exists: they page deterministically, cap each response, and return per-article SHA-256 so a cited body is provably the one that was read. Without that capability, use the provider's native bounded reads through EOF and never treat a retrieval failure as an empty result. - Index refresh is independent. If writes/PowerShell are unavailable or forbidden,
record
provider.index.status: not-attemptedand use the provider's documented path-based lookup. When the project carries an installer receipt (.github/aldc-bcquality-index.json) whosecorpusShamatches the observed corpus revision, reportprovider.index.status: prebuiltwith the receipt's generator, index path, SHA-256 and corpus revision; a bare status is refused. Map the receipt into the observation asindexPath→index.path,indexSha256→index.sha256;generatorandcorpusShacarry over unchanged. Then use the provider's index-backed retrieval — including its bounded pagination and per-article content-hash validation. A mismatched or absent receipt isnot-attempted, not a failure. A missing fresh index alone does not cancel code review. If lookup fails, name the exact resource, attempted operation and observed error. - Retain actual sub-results and references. Reading a leaf or describing its
intended behavior is not a completed check. An executed attempt can fail or be
partial;
executed: truedoes not mean success. Never reconstruct unobserved results afterwards as evidence. Zero findings is valid for completed checks.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago Changed · +32 lines dc1315410b11
- 1mo ago First seen · 110 lines · 45 tokens per session scan A 2380f9f29566
skill-al-review-pipeline is a skill published in the GitHub repository javiarmesto/ALDC-AL-Development-Collection (112 stars, last pushed yesterday), licensed MIT. It adds 45 tokens to every session and 2,016 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-19.
Other skills, from other repositories
code-review-and-quality
Use when reviewing Android code (own or others'). Five-axis review framework: Correctness, Readability, Architecture, Security, Performance. Categorized findings with Kotlin/Compose-specific checks.
code-simplification
Use when code is harder to understand than it needs to be. Guides incremental simplification that preserves behavior exactly, following project conventions and Kotlin idioms.
doubt-driven-development
Use when a decision is high-stakes and hard to reverse — architecture choices, data migrations, dependency adoption, public API contracts. Adversarial self-review that attacks the chosen approach before the code does, instead of defending the first idea that worked.
agentmaster-review
Adversarial code review with the agentmaster evidence pipeline. Use when the user asks for an agentmaster review of a diff, branch, or change set, or invokes /agentmaster-review. Assumes the code is guilty until proven working across correctness, structure, testability, flexibility, and security axes, with severity…
sql-code-review
Universal SQL code review assistant that performs comprehensive security, maintainability, and code quality analysis across all SQL databases (MySQL, PostgreSQL, SQL Server, Oracle). Focuses on SQL injection prevention, access control, code standards, and anti-pattern detection. Complements SQL optimisation prompt for…
code-review
Applies a consistent, language-agnostic review framework to any code change. It evaluates code across five dimensions, produces prioritised findings with inline suggestions, and distinguishes blockers (must fix before merge) from improvements (worth addressing but not blocking).