Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Mathews-Tom/armory --skill pre-landing-reviewgit clone --depth 1 https://github.com/Mathews-Tom/armoryWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/mathews-tom/armory/pre-landing-review)<a href="https://agentmods.dev/skills/mathews-tom/armory/pre-landing-review"><img src="https://agentmods.dev/badge/skills/mathews-tom/armory/pre-landing-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/mathews-tom/armory/pre-landing-review"><img src="https://agentmods.dev/badge/skills/mathews-tom/armory/pre-landing-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00068 | $0.00996 |
| Opus 5 | $0.00034 | $0.00498 |
| Sonnet 5 | $0.00014 | $0.00199 |
| Haiku 4.5 | $0.00007 | $0.00100 |
Grade A, and why
pre-landing-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 109 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Pre-Landing Review
Gate-oriented safety audit for code changes before landing. Uses a structured checklist with two-pass severity triage and blocking/non-blocking classification.
Distinct from pr-review: pr-review is a multi-dimension code quality review. This skill is a gate-oriented safety audit — it uses an external checklist with two-pass severity triage and a blocking/non-blocking classification.
Native alternative: Claude Code's
/ultrareviewruns a dedicated native review session optimized for bug-finding (Anthropic ships three free per month on Pro/Max plans at Opus 4.7's launch). Use this skill for checklist-driven, gate-oriented blocking classification with a documented triage protocol; use/ultrareviewfor lightweight bug-hunting on a single change.
Workflow
1. Determine Diff
Identify the changes to review:
- If on a feature branch: diff against the default branch (
git symbolic-ref refs/remotes/origin/HEAD) - If given a PR number: fetch that PR's diff
- If given specific files: review those files
2. Load Checklist
Read references/checklist.md. This is mandatory — if the checklist is unreadable, STOP and report the error.
3. Pass 1 — CRITICAL (blocking)
Review the diff against critical safety categories. These are potential ship-blockers.
SQL & Data Safety
- Raw SQL without parameterization
- Schema changes without migration safety (lock timeout, reversibility)
- Bulk updates/deletes without WHERE clause verification
- Direct column updates bypassing model validations/callbacks
Race Conditions & Concurrency
- Read-then-write without locking
- Unique constraint reliance without database-level enforcement
- Shared mutable state without synchronization
- Queue/background job idempotency
Trust Boundaries
- LLM/AI output used in SQL, shell commands, or rendered HTML without sanitization
- User input reaching privileged operations without validation
- External API responses used without schema validation
- Deserialization of untrusted data
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 109 lines · 68 tokens per session scan A 738fa4812f3b
pre-landing-review is a skill published in the GitHub repository Mathews-Tom/armory (316 stars, last pushed yesterday), licensed MIT. It adds 68 tokens to every session and 996 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-05.
Other skills, from other repositories
mx-flow
Full development workflow orchestrator: brainstorm → plan → worktree → convergent TDD/review loop → verify → PR. One human gate (spec approval); all other gates auto-proceed. Use when starting a feature or significant change from scratch. Usage: /mx-flow ; /mx-flow status [name]; /mx-flow finish .
mx-pr
Draft a pull request from the feature spec and git log, run an autonomous commit-history cleanup (content check), then publish to GitHub or GitLab (Bitbucket experimental) — or hand off. Use when a feature branch is ready for PR, standalone or from mx-flow. Usage: /mx-pr [name].
mx-team-review
Deep code review of a local git diff or files against this user's own engineering standards (Go, C#), written to a report file that /mx-review-triage consumes. Use before commit/merge when you want the standards-based review, not a quick diff scan. Usage: /mx-team-review [diff-spec] | --repo.
mx-brainstorm
Turn a rough idea into an approved design spec: clarifying questions in one batch, 2-3 distinct approaches with trade-offs, spec (and ADR when a real choice was made) written to /.mx/ / /. Hard gate: no implementation until the user approves the spec. Use when starting any feature or non-trivial fix.
mx-review-triage
Triage review findings — from local mx-team-review reports or GitHub/GitLab PR comments — into fix / track / skip buckets by validity, severity (P0-P3), and cost, then execute approved decisions. Use after mx-team-review or when handling PR feedback before merge. Usage: /mx-review-triage [--source review | --source pr…
mx-commit
Commit all pending changes as one commit per logical concern, following the project's message convention (type prefix, 50-char subject, English). Use when the working tree may hold several changes or the convention must be enforced; a single trivial change can use plain git commit. Usage: /mx-commit [--auto].