Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add lync-cyber/CataForge --skill sprint-reviewgit clone --depth 1 https://github.com/lync-cyber/CataForgeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/lync-cyber/cataforge/sprint-review)<a href="https://agentmods.dev/skills/lync-cyber/cataforge/sprint-review"><img src="https://agentmods.dev/badge/skills/lync-cyber/cataforge/sprint-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/lync-cyber/cataforge/sprint-review"><img src="https://agentmods.dev/badge/skills/lync-cyber/cataforge/sprint-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Prompt Injection · line 87 Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.Fix: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00108 | $0.02741 |
| Opus 5 | $0.00054 | $0.01371 |
| Sonnet 5 | $0.00022 | $0.00548 |
| Haiku 4.5 | $0.00011 | $0.00274 |
Grade A, and why
sprint-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 131 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Sprint完成度审查 (sprint-review)
能力边界
- 能做: Sprint交付完成度审查、AC覆盖验证、范围偏移检测(gold-plating/drift/缺失)、质量聚合
- 不做: 修改代码或文档(仅报告问题)、单个任务的code-review
审查档位（standard / merged-review）
| 档位 | 触发 | per-task code-review | 适用 |
|---|---|---|---|
| standard | 默认 | 每任务一份 docs/reviews/code/CODE-REVIEW-T-NNN-*.md |
大多数 sprint，任务异质（feature / fix / docs / config 混合） |
| merged-review | dev-plan frontmatter project_features.merged_review: true |
跳过 per-task CODE-REVIEW；sprint-review 报告承担 per-task Layer 2 职责 | 任务同质（如同模块批量路由 / 同 adapter 系列），N 个任务的 N 份 CODE-REVIEW 冗余 |
merged-review 模式行为
启用 merged_review: true 后：Layer 1 code_review_present 自动短路（缺 CODE-REVIEW 不 FAIL）；单任务 CODE-REVIEW 可省略，亦可按需混合补充。sprint-review 报告必须包含 §per-task L2 维度表（structure / error-handling / test-quality / duplication / dead-code / complexity / coupling / security 八列，每任务一行），作为 per-task Layer 2 的等价交付。跨任务模式（重复 helper / 同型 bug）天然进入横截面视角，比 N 份独立 CODE-REVIEW 更易识别。
输入规范
- dev-plan 文档路径 (含Sprint任务表)
- Sprint编号 (N)
- 该Sprint所有任务的CODE-REVIEW报告路径 (docs/reviews/code/CODE-REVIEW-T-*.md)
- arch文档 (用于验证接口契约一致性)
- dev-plan 主卷 frontmatter 可选
project_features块（详见 §project_features schema），影响 Layer 1 行为
输出规范
- Sprint审查报告
SPRINT-REVIEW-s{N}-r{M}.md(问题列表 + 严重等级: CRITICAL/HIGH/MEDIUM/LOW) - 审查结论: approved/approved_with_notes/needs_revision
操作指令: 执行Sprint审查 (review)
Step 1: Layer 1 — Python脚本结构检查
cataforge skill run sprint-review -- {N} \
--dev-plan docs/dev-plan/ --src-dir src/ \
--test-dir tests/ --reviews-dir docs/reviews/code/
入口与返回码语义按 COMMON-RULES §Layer 1 调用协议；--src-dir 可重复用于 monorepo 缩范围。
可选参数（gold-plating 噪声治理）：
| 参数 | 默认 | 作用 |
|---|---|---|
--ignore PAT / --ignore-file PATH |
— | 追加 gitignore 风格规则（可重复） |
--no-respect-gitignore |
off | 关闭 git ls-files --exclude-standard 集成，回落 os.walk |
--no-default-ignores |
off | 关闭内建忽略（node_modules/ dist/ build/ .next/ *.tsbuildinfo *.map __pycache__/ .venv/ 等） |
--warn-cap N |
50 | unplanned WARN 超出折叠为 top-dir 摘要；0 不折叠 |
--unplanned-log PATH |
— | 完整 unplanned 列表落盘（配合 --warn-cap 审计） |
--format {text,json} |
text | json：结构化 issues，供 framework-review / CI 机读 |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 131 lines · 108 tokens per session scan A d45ec564faa3
sprint-review is a skill published in the GitHub repository lync-cyber/CataForge (129 stars, last pushed 1mo ago), licensed MIT. It adds 108 tokens to every session and 2,741 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
recipe-create-meet-space
Create a Google Meet meeting space and share the join link.
workthreads
SpecStory Workthreads - a weekly work-thread rollup across a team's repos from SpecStory coding histories (any agent - Claude Code, Codex, Cursor, Gemini, and more). It groups the window's sessions into threads of work per project and labels each new / open / recently closed, so a lead sees what shipped, what is still…
atmos-config
Atmos root configuration: atmos.yaml discovery, precedence, deep merging, basepath, imports, minimal bootstrap, and routing to narrower Atmos skills.
story-readiness
Validate that a story file is implementation-ready. Checks for embedded GDD requirements, ADR references, engine notes, clear acceptance criteria, and no open design questions. Produces READY / NEEDS WORK / BLOCKED verdict with specific gaps. Use when user says 'is this story ready', 'can I start on this story', 'is…
autotask-creator
Rules for automation CRUD from the group-chat commander. The commander does not call mutation tools and does not edit cloud/autotasks files directly. It emits one or more top-level ... containers in its final text; the bus parses and applies them after the turn.
projects
List all managed projects with status, branch, open PRs, and open issue counts — portfolio-level view.