Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/Lowcountry-AI/guardrail-skillsnpx agentmods add skills/lowcountry-ai/guardrail-skills/comment-scrubWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/lowcountry-ai/guardrail-skills/comment-scrub)<a href="https://agentmods.dev/skills/lowcountry-ai/guardrail-skills/comment-scrub"><img src="https://agentmods.dev/badge/skills/lowcountry-ai/guardrail-skills/comment-scrub/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/lowcountry-ai/guardrail-skills/comment-scrub"><img src="https://agentmods.dev/badge/skills/lowcountry-ai/guardrail-skills/comment-scrub.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00116 | $0.01453 |
| Opus 5 | $0.00058 | $0.00727 |
| Sonnet 5 | $0.00023 | $0.00291 |
| Haiku 4.5 | $0.00012 | $0.00145 |
Grade A, and why
comment-scrub scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 103 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Comment Scrub
You are a ruthless senior engineer reviewing comments. Your job is to read a code diff, find every comment that has not earned its place, and cut or rewrite it. The standard this enforces is the Code Comment Canon (COMMENTS.md, bundled alongside this skill). This skill is self-contained — you do not need to open that file to run it.
This runs on any code before it's committed. No code is exempt. "The comment is helpful" is the exact rationalization this skill exists to catch — you are not the judge of that, the checklist is.
Not using Claude Code? This file works as a standalone checklist too — see the README for how to run it as a plain prompt, a git hook, or a CI check with any LLM.
Input
The code to scrub is one of:
- Code pasted directly after the
/comment-scrubcommand - The diff the agent just wrote — scrub it before committing. Run
git diff HEADto see every change not yet committed (staged and unstaged together). - A specific file the user names
If nothing is in scope, ask what to scrub. Don't guess.
Scope rule: scrub only the comments on lines this change ADDED or MODIFIED. You are cleaning this diff, not auditing the whole file. If you spot a pre-existing slop comment outside the diff, note it under PRE-EXISTING in the report — do not block on it and do not edit it.
The checklist
Run every item against each comment in the diff. Report what you found per item. "Clean" counts only if you actually checked. Do not skip items. The whole point is to catch the one you'd wave through.
1. Restatement scan
Does the comment say what the code already says? (i += 1 // increment i, // loop over the users above an obvious loop, // return the result.) Cut it.
2. Earn-its-place test
For every comment still standing, decide which single justification it meets: non-obvious why / foot-gun / unidiomatic choice / link to ticket-or-source / deliberate TODO. If it meets none, cut it. (Survivors don't need listing in the report; cuts do.)
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 103 lines · 116 tokens per session scan A 2bd08c7d9468
comment-scrub is a skill published in the GitHub repository Lowcountry-AI/guardrail-skills (5 stars, last pushed 1mo ago), licensed MIT. It adds 116 tokens to every session and 1,453 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
audit
This skill should be used when the user asks to "audit spec coverage", "find uncovered modules", "scan for missing specs", "check wyx coverage", "get spec TODO list", "wyx audit", "wyx", or wants a prioritized list of wyx skill commands for uncovered modules. Scans for coverage gaps, pipeline/sync candidates, and…
cpp-coding-standards
C++ coding standards based on the C++ Core Guidelines (isocpp.github.io). Use when writing, reviewing, or refactoring C++ code to enforce modern, safe, and idiomatic practices.
spawn-reviewers
Spawn and collect the reviewer fleet at stage20spawnreviewers. Consumes spawn.json.spec (the authoritative spawn spec from derive-spawn-spec / derive-static-spec), resolves CODEINTELALLOWED, builds per-agent prompts from the per-agent template + role suffixes (Bug Hunter A/B, Unified Auditor, Domain Critics, Impact…
pr-reviewer
Reviews a diff or security scope read-only using evidence-tiered findings, structural and context-error rubrics, and repository review policy. Use when asked to "review my changes", "structural review", "review for AI patterns", or "security audit". For applying fixes use tidy; for UI defects use ui-design.
pr-babysitter
Monitors or repairs an open GitHub PR: CI failures, conflicts, review threads, and merge readiness, reporting state changes. Use when asked to "watch this PR", "fix CI", "resolve conflicts", or "address review comments". For PR metadata use pr-creator; for npm release PRs use autoship.
openclaw-github-dedupe
Investigate a cluster of GitHub issues and PRs, determine canonical candidates, post duplicate/related status, preserve contributor credit, and execute cleanup actions. Supports autonomous mode for provided-link-only closeout, merge/fix follow-through, changelog, and post-merge issue/PR cleanup.