Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add KevinZai/commander --skill ccc-makeovergit clone --depth 1 https://github.com/KevinZai/commanderWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/kevinzai/commander/ccc-makeover)<a href="https://agentmods.dev/skills/kevinzai/commander/ccc-makeover"><img src="https://agentmods.dev/badge/skills/kevinzai/commander/ccc-makeover/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/kevinzai/commander/ccc-makeover"><img src="https://agentmods.dev/badge/skills/kevinzai/commander/ccc-makeover.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00041 | $0.01388 |
| Opus 5.5 | $0.00016 | $0.00555 |
| Sonnet 5.5 | $0.00008 | $0.00278 |
| Haiku 4.5 | $0.00004 | $0.00139 |
Grade A, and why
ccc-makeover scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 103 lines — stays where its author put it; the contents beside it link to each section on GitHub.
$ccc-makeover — audit, fix, re-score
CC Commander · $ccc-makeover · X-Ray score, approved fixes in impact order, and a before/after report card.
$ccc-xray owns the scan, its dimensions and its scoring rubric; this skill does not redefine them. The user's selected model is preserved.
Codex: invoke $ccc-xray and ask each picker as a plain-text question.
When to use / when not to
- Use on an unfamiliar codebase, before a release, after a sprint to measure improvement, or when someone asks "how healthy is this codebase?".
- Use
$ccc-xrayalone for a read-only score,$ccc-code-review(or/code-review ultra) for a line-level review,$ccc-designfor a visual refresh.
What happens
1. Pick the mode
An argument (xray, makeover, report-card) or a clear intent selects the mode. Otherwise ask with AskUserQuestion (header "Makeover"):
- 🟢 X-Ray scan — score the project; nothing changes
- Makeover — scan, then fix the top recommendations one at a time with your OK
- Report card — current scores, maturity level and history from earlier makeovers
2. X-Ray
Invoke the ccc-xray skill with the Skill tool. Use its scorecard as-is: per-dimension 0–100 scores, its health bands and its fix-first rule.
3. Makeover
- Baseline. Invoke
ccc-xraywith the full scope (or the--categoryfocus). Record the overall score and each dimension score. - Pick targets. Take the critical rows, then the needs-attention rows, ordered by
$ccc-xray's fix-first rule (security first, then CI when nothing deploys, then lowest score). Keep at most--max N(default 5). With--category CAT, keep only that dimension. - Dry run. With
--dry-run, list the targets with their recommended fix and stop. - Apply, one at a time. For each target ask with AskUserQuestion:
- 🟢 Apply — run the recommended skill or targeted fix
- Skip — move to the next target
- Stop — end the makeover and go to step 6
Skip the question only when the user passed
--autoin this request.
- Check each fix. After every applied target, run the project's test command (
npm test,pnpm test,pytest,go test ./...orcargo test, whichever the repo uses) andgit status --short. On a failure, stop and ask:- 🟢 Fix it — make a targeted fix and re-run the tests
- Keep the changes and stop — report the failure as open
- Revert this target —
git restorethe files it touched (asks for confirmation first, since it discards those edits)
- Re-score. Invoke
ccc-xrayagain with the same scope. Compute the delta per dimension and overall from the two scorecards, not from memory. - Record. Write
tasks/makeover-<YYYYMMDD>.md: baseline and final scores, maturity level before and after, each target as applied / skipped / failed, and the test commands run with their results.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday Changed · -1 lines · -28 tokens per session 101ca7142bc7
- 14d ago Changed · +27 lines · +22 tokens per session 8f3aaca3b30c
- 1mo ago First seen · 77 lines · 47 tokens per session scan A c25b4cf919a5
ccc-makeover is a skill published in the GitHub repository KevinZai/commander (6 stars, last pushed today), licensed MIT. It adds 41 tokens to every session and 1,388 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
code-review
Use when changes affect interactions across multiple modules, involve high-risk areas (authorization/authentication, payments/funds, data deletion/migration, public APIs/cross-service interfaces/security boundaries), or the user requests a review. Review in this order—correctness → requirements → security → simplicity…
pr-review-expert
Tier: POWERFUL Category: Engineering Domain: Code Review / Quality Assurance.
tech-debt-tracker
Scan codebases for technical debt, score severity, track trends, and generate prioritized remediation plans. Use when users mention tech debt, code quality, refactoring priority, debt scoring, cleanup sprints, or code health assessment. Also use for legacy code modernization planning and maintenance cost estimation.
generic-fullstack-code-reviewer
Review full-stack code for bugs, security vulnerabilities, performance issues, accessibility gaps, and CLAUDE.md compliance. Enforces TypeScript strict mode, input validation, GPU-accelerated animations, and design system consistency. Use when completing features, before commits, or reviewing pull requests.
receive-review
Process code review feedback with technical rigor. Activates when the user shares review comments, PR feedback, or asks to address reviewer suggestions.
ui-design-team
Multi-agent UI review with 4 specialist perspectives: UX Researcher, Visual Designer, i18n/Multilingual QA, and Accessibility/Performance Auditor. Each agent scores independently from their expertise. Lead Designer synthesizes into prioritized fixes with exact code. Works with any stack: React, Astro, vanilla…