Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add nobodyohm-web/Thot --skill sdlc-reviewgit clone --depth 1 https://github.com/nobodyohm-web/ThotWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/nobodyohm-web/thot/sdlc-review)<a href="https://agentmods.dev/skills/nobodyohm-web/thot/sdlc-review"><img src="https://agentmods.dev/badge/skills/nobodyohm-web/thot/sdlc-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/nobodyohm-web/thot/sdlc-review"><img src="https://agentmods.dev/badge/skills/nobodyohm-web/thot/sdlc-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00015 | $0.01861 |
| Opus 5 | $0.00008 | $0.00931 |
| Sonnet 5 | $0.00003 | $0.00372 |
| Haiku 4.5 | $0.00002 | $0.00186 |
Grade A, and why
sdlc-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
100% identical to sdlc-review — 0 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 182 lines — stays where its author put it; the contents beside it link to each section on GitHub.
SDLC Review Skill
Independently verify work handed from a Kanban implementation run to the review lane, then approve it, request changes, or escalate. This skill reviews the deliverable and its evidence; it does not take over the implementer's work.
When to Use
Use this skill when all of the following are true:
- the dispatcher spawned you for a task claimed from the
reviewlane; - an implementer submitted a
review_requestedhandoff; - the task needs an independent verdict before it can be completed.
Do not use it for a separate downstream review card. A downstream card is ordinary implementation work with a review-oriented specification and completes through its own lifecycle.
Prerequisites
- A Kanban worker context with the current task and run identifiers.
- Native Kanban tools:
kanban_show,kanban_comment,kanban_complete,kanban_request_changes, andkanban_block. - Workspace access through
read_file,search_files, andterminalwhen the deliverable is code. - The task's original specification, acceptance criteria, handoff summary, and prior run history must be available through
kanban_show.
How to Run
This skill is loaded automatically by the review dispatcher. Start with kanban_show before inspecting files or choosing a verdict.
- Read the task specification and the latest
review_requestedhandoff. - Inspect the actual deliverable and run relevant verification.
- Choose exactly one verdict: approve, request changes, or escalate.
- Record concrete evidence in the terminal Kanban transition.
Quick Reference
| Verdict | When | Final action |
|---|---|---|
| Approve | Acceptance criteria and verification pass | kanban_complete |
| Request changes | Correctable implementation defects remain | kanban_comment, then kanban_request_changes |
| Escalate | A human decision or external prerequisite is required | kanban_block |
A requested-changes transition returns the task to its original implementer. When that implementer requests review again without naming a reviewer, the persisted reviewer provenance routes the re-review back to the same reviewer profile.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 182 lines · 15 tokens per session scan A ce90e8a3e145
sdlc-review is a skill published in the GitHub repository nobodyohm-web/Thot (0 stars, last pushed 16d ago), licensed MIT. It adds 15 tokens to every session and 1,861 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. It is 100% identical to sdlc-review, differing in 0 lines, and is treated as a copy.
Other skills, from other repositories
batch-all-issues
Resolve every open issue one at a time: fact-check each with web research, close the ones that need no action, and run the goal-pr skill to fix, review, and merge the ones that do — repeating until no actionable issues remain.
post-issue-comment
Post a reply comment on a GitHub issue in English with a natural, concise writing style, based on the intent passed as arguments.
secretary
Workspace and research management — dispatch analyses, monitor running agents, manage workspaces and threads.
cocoplus-config
CocoPlus configuration SSOT — $cocoplus sync propagates cocoplus.toml into downstream artifacts; $cocoplus migrate-config converts legacy safety-config.json. Invoked via $cocoplus sync and $cocoplus migrate-config.
project-manager
Project management expert for Agile, estimation, risk management, and stakeholder communication.
seed-list
Evaluate all pending seed trigger conditions against current project state and show which ideas are ready to promote and which are still waiting.