Borrowing it
Nothing to install: this file belongs to jpawlowski/hacs.integration_blueprint. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/jpawlowski/hacs.integration_blueprint/main/.agents/skills/ha-quality-review/SKILL.mdgit clone --depth 1 https://github.com/jpawlowski/hacs.integration_blueprintWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/jpawlowski/hacs.integration_blueprint/ha-quality-review)<a href="https://agentmods.dev/skills/jpawlowski/hacs.integration_blueprint/ha-quality-review"><img src="https://agentmods.dev/badge/skills/jpawlowski/hacs.integration_blueprint/ha-quality-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/jpawlowski/hacs.integration_blueprint/ha-quality-review"><img src="https://agentmods.dev/badge/skills/jpawlowski/hacs.integration_blueprint/ha-quality-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Prompt Injection · line 81 Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.Fix: Remove the large whitespace padding (blank-line blocks or long space runs) and review any content hidden below or to the right of it. Keep skill files compact and reviewable so no instructions can be
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00186 | $0.02130 |
| Opus 5 | $0.00093 | $0.01065 |
| Sonnet 5 | $0.00037 | $0.00426 |
| Haiku 4.5 | $0.00019 | $0.00213 |
Grade A, and why
ha-quality-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 173 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Review the integration
A review that only restates the linter is worthless. Run the machines first, then spend your attention on what they cannot see: layering, failure behaviour, and whether a user would understand what this integration does.
0. Scope the review
Ask, or infer from the request:
- Full audit of the integration, or diff review of the current branch?
- Is there a target tier (this project aims for Silver, ideally Gold)?
For a diff review: git diff main...HEAD --stat, then read the changed files in full — not just the hunks.
1. Automated gates (always first)
script/lint # ruff format+fix, shfmt, prettier/markdownlint, yamllint, zizmor, shellcheck
script/type-check # pyright — never auto-fixed
script/hassfest # manifest, services.yaml, translations, integration structure
script/test --cov-html
Anything these report is a finding, not something to fix silently mid-review — but do note that script/lint already
auto-heals formatting, so only its remaining output counts.
2. Architecture
- Layering is Entity → Coordinator → source. Any entity importing
api/directly, or any coordinator holding HTTP details, is a finding. - Package structure matches the fixed set (
api/,coordinator/,config_flow_handler/,entity/,entity_utils/,<platform>/,service_actions/,utils/). Ahelpers/,common/,shared/, orlib/package is a finding. - Files are 200–400 lines, one entity class per file.
- Runtime state lives in
entry.runtime_data, neverhass.data[DOMAIN]. - No circular imports;
TYPE_CHECKINGguards for type-only imports.
Two upstream requirements this project deliberately does not meet. Neither is a finding here, and both should be stated as decisions rather than silently passed over:
- Core requires all device or service communication to be wrapped in a PyPI library. As a custom integration this
project allows an in-repo client (
AGENTS.md§ Custom Integration Flexibility) — with the consequence that the client would have to be extracted before this could ever be submitted to Core. creating_component_code_review.mdstill recommendshass.data[DOMAIN]. That page is out of date and is contradicted by the Bronzeruntime-datarule. Do not "correct"entry.runtime_databack to it.
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 173 lines · 186 tokens per session scan A c59d863e03e9
ha-quality-review is a skill published in the GitHub repository jpawlowski/hacs.integration_blueprint (49 stars, last pushed 5d ago), licensed MIT. It adds 186 tokens to every session and 2,130 once invoked, about $0.0009 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
contrib-pr-review
Review a contribution PR for safety, quality, and readiness. Checks for security concerns, test coverage, size appropriateness, and intent alignment. Use when reviewing external contributions.
issue-to-pr-resolver
Implement a GitHub issue end-to-end — create a worktree branch, implement the feature with tests, create a draft PR, then iteratively resolve all CI failures and review comments until the PR is clean. Use when you need to fully implement a GitHub issue from start to merge-ready. Triggers on "implement issue", "resolve…
my-pr-checker
Manage your own GitHub pull requests — check CI status, inline review comments, PR-level comments, resolve review threads, fix issues, and iterate until all checks pass and threads are resolved. Use for managing your own PRs (not external contributions). Triggers on "check my PR", "check PR", "/my-pr-checker ".
issue-analysis
Deep analysis of a single GitHub issue with codebase exploration, implementation planning, and architectural assessment. Use when you need to analyze a GitHub issue, assess its complexity, plan implementation approaches, and post a structured analysis comment. Triggers on "analyze issue", "deep analysis"…
homeassistant
Source-layer Home Assistant guide material preserved behind the runtime guide.
bat-story-eval
Compare MCP tool behavior between target and baseline versions using pre-built and custom stories with diff-based triage.