Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add mthines/agent-skills --skill aw-review-quality-gategit clone --depth 1 https://github.com/mthines/agent-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/mthines/agent-skills/aw-review-quality-gate)<a href="https://agentmods.dev/skills/mthines/agent-skills/aw-review-quality-gate"><img src="https://agentmods.dev/badge/skills/mthines/agent-skills/aw-review-quality-gate/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/mthines/agent-skills/aw-review-quality-gate"><img src="https://agentmods.dev/badge/skills/mthines/agent-skills/aw-review-quality-gate.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00075 | $0.01004 |
| Opus 5 | $0.00037 | $0.00502 |
| Sonnet 5 | $0.00015 | $0.00201 |
| Haiku 4.5 | $0.00007 | $0.00100 |
Grade A, and why
aw-review-quality-gate scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 90 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Review Quality Gate
Run this gate on every finding you have generated, before formatting output or delivering results. The gate catches false positives, noise, and miscalibrated severity — the most common failure modes of single-pass review.
When to Use
- As the
autonomous-workflowPhase 6 review companion — invoked viaSkill()afterreview-changesreturns findings, before the workflow acts on them. Seephase-6-pr-creation.md#findings-quality-gate. Graceful skip: the workflow acts on the raw findings if this skill is not installed. - After the
pr-revieweragent generates findings (Step 2.5). - After DX or UX review skills produce their finding lists.
- Any time a skill produces actionable recommendations that a human will read.
Gate Checklist
For each finding, answer every question. Be honest — a dropped false positive is worth more than a delivered one.
| # | Question | Fail means |
|---|---|---|
| 1 | Is it actionable? The author can do something concrete. No "consider", "might want to", or "could be improved" without a specific fix. | Finding is vague noise |
| 2 | Did I read the surrounding code? Not just the diff hunk — the full function, the caller, the guard clause three lines up. | Finding may be wrong |
| 3 | Is severity calibrated? A style nit is never "required." A SQL injection is never "suggestion." Re-check the severity assignment against the actual impact. | Severity is misleading |
| 4 | Are file path and line number accurate? Verify the cited location against actual file content. A finding pointing to the wrong line is worse than no finding. | Finding is unlocatable |
| 5 | Does this duplicate linter/formatter/type-checker output? If the project's toolchain would catch this automatically, do not flag it. Focus on semantic issues the toolchain cannot see. | Finding is redundant |
| 6 | Is this actually true? Re-read the function in full context. Check: is the "bug" handled elsewhere? Is the "unused import" used in a type annotation? Is the "missing null check" guarded by the caller? Is the "race condition" prevented by a lock you didn't notice? | Finding is a false positive |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 90 lines · 75 tokens per session scan A b980b0d45559
aw-review-quality-gate is a skill published in the GitHub repository mthines/agent-skills (13 stars, last pushed yesterday), licensed MIT. It adds 75 tokens to every session and 1,004 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
ego-lite-simplify
Find and implement evidence-backed simplifications in the ego-lite repository. Use when reviewing the codebase for dead code, duplicated state or APIs, speculative abstractions, unnecessary compatibility layers, hand-written infrastructure, excessive tests or documentation, or when the user asks to reduce code size or…
best-practices
Apply modern web development best practices for security, compatibility, and code quality. Use when asked to "apply best practices", "security audit", "modernize code", "code quality review", or "check for vulnerabilities".
code-review-and-quality
Runs code review as a change-management process — right-sizing the diff, labeling findings by required-vs-optional severity, applying structural remedies for complexity, and resolving reviewer/author disagreements. Use when a change needs splitting before review, when review comments need severity labels, when a…
code-reviewer
Runs a fixed-category severity scan over a diff, file, or snippet — correctness, security, error handling, concurrency, performance, readability, tests — and emits a CRITICAL/HIGH/MEDIUM/LOW/INFO-graded report. Use when asked to "scan this code", grade a change by severity, or review Go code for concurrency bugs (data…
code-simplification
Simplifies working code for clarity without changing behavior — reduces nesting, renames vague identifiers, removes dead code and unnecessary abstraction. Use when code works but is harder to read, maintain, or extend than it should be, or when a review flagged accumulated complexity. Not for adding features or fixing…
coding-standards
Cross-language code-quality heuristics -- function size, nesting depth, magic numbers, comment intent, naming -- for reviewing or writing code in any language. Use when reviewing code for maintainability, setting up lint rules, or onboarding conventions. For Go-specific idioms use go-service-idioms, for API contracts…