Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Koroqe/claude-code-sdlc --skill merge-readygit clone --depth 1 https://github.com/Koroqe/claude-code-sdlcWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/koroqe/claude-code-sdlc/merge-ready)<a href="https://agentmods.dev/skills/koroqe/claude-code-sdlc/merge-ready"><img src="https://agentmods.dev/badge/skills/koroqe/claude-code-sdlc/merge-ready.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00044 | $0.09935 |
| Opus 5 | $0.00022 | $0.04967 |
| Sonnet 5 | $0.00009 | $0.01987 |
| Haiku 4.5 | $0.00004 | $0.00993 |
Grade A, and why
merge-ready scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 597 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Command: Merge Ready
Run a full quality gate before merge. All checks must pass.
Arguments
$gate (also available as $ARGUMENTS) optionally names a single gate to rerun. When empty, run every gate in order.
Literal-token flag rule: a documented flag is active ONLY if its literal token appears in $ARGUMENTS. Never infer that a flag was passed because the documentation describes it.
Tier Check
This step runs before Gate 0. It is deliberately unnumbered — mirroring the existing unnumbered "Finalization: Changelog Entry" postamble's precedent for adding a step without renumbering the gates — because other files and CI checks reference gates by number, and none of them may shift.
Read .claude/scratchpad.md's ## Tier: field:
- Fail-closed rule: any
## Tier:value other than the literalquickruns all 9 gates unmodified —full, the field absent,fast, a typo, merge-conflict garbage, or anything else that is not an exactquickmatch. This is the rule itself, not a fallback for the cases spelled out below. full, or the field absent: run all 9 gates unmodified, exactly as documented below. Absent-means- full is the backward-compatibility instance of the fail-closed rule above — a pre-F4 scratchpad with no## Tier:field at all gets the full, unreduced gate sequence, never a silently reduced one.quick: run Gate 0 (Git Hygiene), Gate 2 (Code Review), Gate 3 (Security Audit), and Gate 4 (Build Verification). Report Gate 1, Gate 5, Gate 6, Gate 7, and Gate 8 asSKIPPED (tier: quick)in the output table. Never silently omit a row — a missing row reads as an oversight; an explicitSKIPPED (tier: quick)reads as a decision.- Why Gates 0, 2, 3, and 4 still run (FR-4.8): Gate 2 and Gate 3 review the diff itself — neither
depends on any PRD/use-case/QA artifact — and Gate 4 is deterministic. Skipping any of the three would
make
quicka synonym for "unreviewed"; keeping them is what stops that. This sentence is the justification for thequicktier existing at all, not an incidental detail.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 597 lines · 44 tokens per session scan A 72bcaa984757
merge-ready is a skill published in the GitHub repository Koroqe/claude-code-sdlc (51 stars, last pushed 5d ago), licensed MIT. It adds 44 tokens to every session and 9,935 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
test-reporting
Run the Level 2 dummy agent integration test suite and produce a detailed HTML report with per-test input → outcome analysis.
accessibility-testing
Skill "accessibility-testing" from vibeeval/vibecosystem, covering accessibility testing, axe-core setup, jest-axe (unit / component tests), playwright-axe (e2e) and cypress-axe.
multi-agent-e2e-validation
Multi-agent parallel E2E validation for database refactors. TRIGGERS - E2E validation, schema migration testing, database refactor validation.
symmetric-dogfooding
Bidirectional integration validation where two repositories validate each other before release.
schema-e2e-validation
Earthly E2E validation for YAML schema contracts. TRIGGERS - schema validation, YAML schema, schema contracts, regenerate types.
alpha-forge-preship
Alpha Forge quality gates for PR review - RNG determinism, URL validation, parameter validation, manifest sync.