quality

quality is a skill for Claude Code from Jebel-Quant/rhiza-claude. It costs 48 tokens per session (8,548 once invoked), scanned C, original, MIT.

A command that assesses a repository against Rhiza code-quality standards and scores it, with an option to file findings as issues. It proposes fixes but does not apply them.

In plain words
What is it for?
Use it to run quality gates, review a non-Rhiza repository with a design assessment, or record findings as issues.
Why use it?
It shows where a repository falls short and distinguishes local quality checks from broader design or setup concerns.

Skill for Claude Code

Written for Claude Code: allowed-tools in frontmatter. Also seen: mentions CLAUDE.md; names the AskUserQuestion tool; mentions Claude Code.

Runs only inside its plugin — its command needs a path that Claude Code sets for a plugin’s own hooks and for nothing else. Install the plugin, not this.

Part of the rhiza plugin — 10 skills, 1 hook shipped together

Good fit Use it to run quality gates, review a non-Rhiza repository with a design assessment, or record findings as issues.

Compare 6 skills from other repositories ↓
Install

Getting it into your agent

This one installs as part of its plugin. Adding the marketplace and installing the plugin brings it with everything else the plugin ships.

Claude Code
/plugin marketplace add Jebel-Quant/rhiza-claude
Claude Code
/plugin install rhiza

Made for: Claude Code.

Or install rhiza, the plugin that ships this one along with the rest of its 10 skills, 1 hook.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for quality

README.md
[![agentmods](https://agentmods.dev/badge/skills/jebel-quant/rhiza-claude/quality.svg)](https://agentmods.dev/skills/jebel-quant/rhiza-claude/quality)
Your own site
<a href="https://agentmods.dev/skills/jebel-quant/rhiza-claude/quality"><img src="https://agentmods.dev/badge/skills/jebel-quant/rhiza-claude/quality.svg" alt="Measured on agentmods" height="20"></a>
Per session 48 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 8,548 The whole file, excluding the scripts and references it only reads on demand.
Security scan C 1 finding. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00048 $0.08548
Opus 5 $0.00024 $0.04274
Sonnet 5 $0.00010 $0.01710
Haiku 4.5 $0.00005 $0.00855

Measured 8d ago against content hash 952328ca47a5, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-07, from the pricing page.

Security

Grade C, and why

quality scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Recursive force deletehighDestructive command

rm -rf with a variable or a broad path is one typo away from removing the wrong tree.

`rm -rf`, and a fence that cannot parse is a documentation bug without running it.
plugin/skills/quality/SKILL.md · 540 lines

How it starts

The opening of the file, as written. The whole thing — 540 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Assess the quality of the current working directory's repo against Rhiza standards. This is the global variant of the per-repo rhiza_quality command synced from jebel-quant/rhiza; it adapts to whichever repo it runs in by reading that repo's CLAUDE.md, .rhiza/template.lock, and git remote at runtime.

0. Establish the mode — how much of this repo is Rhiza's

These three checks come first — before any make, any tool, any analysis, because they decide which half of this command applies:

test -f .rhiza/template.yml            # rhiza-managed at all?
test -f .rhiza/template.lock           # ...and actually synced?
test -f .rhiza/template-bundles.yml    # ...or is this repo the template itself?

| template.yml + template.lock | Full mode — the template's gates plus the design assessment. | | template.yml only | Degraded mode — managed but never synced, the state /init deliberately leaves behind. Mention /rhiza:update performs the first sync, then continue. | | template-bundles.yml, no template.yml | Template mode — this repo is the template. See below; never suggest /rhiza:init or /rhiza:update here. | | None of them | Degraded mode — not rhiza-managed. Mention /rhiza:init once, as information, then continue. |

The pointer wins where both appear. template-bundles.yml is decisive only when there is no template.yml: a repo with a pointer is a consumer, whatever else its .rhiza/ holds.

The second probe is the lock, not a synced file. It used to be .rhiza/rhiza.mk, which was a proxy: the sync delivered it, so its presence stood in for "a sync has happened". Template v1.4 retired the make layer and stopped shipping it, and the proxy inverted — every correctly and fully synced v1.4 repo answered "never synced" and was quietly assessed in degraded mode, which is the narrower assessment and understates the repo. .rhiza/template.lock is not a proxy: every sync writes it, at every template version, and its files: block is the authoritative record of what was materialised. /rhiza:init deliberately leaves it absent, which is exactly the never-synced state the table's middle row describes. Probe for an artefact the sync itself writes, never for one a particular template version happened to ship.

Degraded mode is a narrower assessment, not a refusal. Skip the template-delivered gates, run whatever the repo's own makefile provides, and score the design work in full. Say which mode you're in before the first gate, so nothing that follows is read as a Rhiza verdict when it isn't.

What degrading must never become is running the template's gates anyway. Every numbered gate below is a gate the sync provides — a make target through v1.3, a rhiza-task task from v1.4 — and in an unsynced repo it exists in neither form, so running it fails with "No rule to make target" and reporting that as FAIL describes a broken repo when the truth is an unsynced one. That was the original reason this was a hard stop, and it still holds — the answer is to not run them and mark them unavailable, which is exactly what the existing out-of-scope rule already does for a reduced profile. An unavailable gate is never a FAIL, in any mode.

So in degraded mode:

  • Skip the template-delivered gates, and every .rhiza/-dependent step: make rhiza-test (there is no .rhiza/tests/), template fidelity, and the known-issues.md lookup (it is keyed by the template ref in .rhiza/template.lock, which does not exist).
  • Except fmt, typecheck, docs-coverage and deps, which resolve in any repo. Each falls back to the repo's own tool config — see step 1 for the ladder and its one hard limit: no config means out-of-scope, never the template's flags. These four are gated in most mature repos, so skipping them reported gaps that usually are not there.
  • Run the bundled example checker, which needs no template at all — gate 8. It is stdlib-only Python this plugin ships, so it does not depend on a sync. Its README half is language-neutral and runs on a Rust or Go repo too; only its docstring half is Python's. It matters most here: the docstring and README checks a managed repo gets from make rhiza-test have no counterpart in an unmanaged one, so without it nothing at all asks whether this repo's documented examples still work.
  • Run the targets check_make_targets.py reports as undeclared — the repo's own documented ones. An unmanaged repo with a working make test and make lint is the Go/Rust case generalised: the named list describes a template this repo isn't using, and the discovered targets are the real gates. Score those.
  • Do steps 3 and 4 in full. The design analysis reads source, not .rhiza/, so it is unaffected — and in degraded mode it carries most of the assessment.
  • Score nothing you did not measure. A skipped gate is out-of-scope, never a 0 and never an assumed pass.

Read the full file on GitHub · 540 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 8d ago First seen · 540 lines · 48 tokens per session scan C 952328ca47a5

Subscribe to this mod's changes

quality is a skill published in the GitHub repository Jebel-Quant/rhiza-claude (4 stars, last pushed today), licensed MIT. It adds 48 tokens to every session and 8,548 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it C with 1 finding (recursive force delete). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.