Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add organvm-iv-taxis/a-i--skills --skill coding-standards-enforcergit clone --depth 1 https://github.com/organvm-iv-taxis/a-i--skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/organvm-iv-taxis/a-i--skills/coding-standards-enforcer)<a href="https://agentmods.dev/skills/organvm-iv-taxis/a-i--skills/coding-standards-enforcer"><img src="https://agentmods.dev/badge/skills/organvm-iv-taxis/a-i--skills/coding-standards-enforcer/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/organvm-iv-taxis/a-i--skills/coding-standards-enforcer"><img src="https://agentmods.dev/badge/skills/organvm-iv-taxis/a-i--skills/coding-standards-enforcer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 3 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 84 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 87 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 87 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00028 | $0.00647 |
| Opus 5.5 | $0.00011 | $0.00259 |
| Sonnet 5.5 | $0.00006 | $0.00129 |
| Haiku 4.5 | $0.00003 | $0.00065 |
Grade A, and why
coding-standards-enforcer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Coding Standards Enforcer
Automate code quality and consistency with linters, formatters, and hooks.
ESLint Configuration
// .eslintrc.js
module.exports = {
extends: [
'eslint:recommended',
'plugin:@typescript-eslint/recommended',
'plugin:react/recommended',
'prettier'
],
rules: {
'no-console': 'warn',
'@typescript-eslint/no-unused-vars': 'error',
'@typescript-eslint/explicit-function-return-type': 'warn',
'react/prop-types': 'off',
'complexity': ['warn', 10],
'max-lines-per-function': ['warn', 50]
}
};
Prettier Configuration
{
"semi": true,
"singleQuote": true,
"trailingComma": "es5",
"printWidth": 100,
"tabWidth": 2,
"arrowParens": "avoid"
}
Pre-commit Hooks
// package.json
{
"husky": {
"hooks": {
"pre-commit": "lint-staged"
}
},
"lint-staged": {
"*.{ts,tsx}": [
"eslint --fix",
"prettier --write"
],
"*.{json,md}": [
"prettier --write"
]
}
}
Git Hooks Setup
# Install husky
npm install --save-dev husky lint-staged
# Initialize husky
npx husky install
# Add pre-commit hook
npx husky add .husky/pre-commit "npx lint-staged"
Naming Conventions
// PascalCase for classes and types
class UserService {}
type UserData = {};
// camelCase for functions and variables
function getUserById() {}
const userName = 'John';
// UPPER_SNAKE_CASE for constants
const MAX_RETRY_COUNT = 3;
const API_BASE_URL = 'https://api.example.com';
// kebab-case for files
// user-service.ts
// api-client.ts
Integration Points
Complements:
- verification-loop: For pre-commit validation
- tdd-workflow: For test standards
- code-refactoring-patterns: For style improvement
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 116 lines · 28 tokens per session scan A a679d28d1583
coding-standards-enforcer is a skill published in the GitHub repository organvm-iv-taxis/a-i--skills (17 stars, last pushed 2mo ago), licensed Apache-2.0. It adds 28 tokens to every session and 647 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
godot-code-review
Use when reviewing GDScript or C# Godot code — checklist of best practices, common anti-patterns, and Godot-specific pitfalls. Triggers on "review this script", "check my code", "any issues with this", "what's wrong with this code", including a short pasted snippet.
domain
Domain-specific: SAP Commerce, OpenSearch detection, WordPress validation, enterprise search.
quality-gate
Orchestrates the QUALITY pipeline stage for egregore work items, running code review, unbloat, and test updates. Use when running quality checks before a PR.
agent-cross-review-1ambda-dataops-platform-2
This page used to hold an archived copy of this skill. The archive now lives in the registry's data repository.
agent-design-best-practices
This page used to hold an archived copy of this skill. The archive now lives in the registry's data repository.
pr-review
AUTHOR SKILL (internal to microsoft/aspire-skills). Reviews pull requests into this repo for problems only — bugs, regressions, missing eval coverage, frontmatter or routing damage, plugin-manifest drift, hook safety, and other concrete issues. Drives a six-step workflow: identify the PR, ensure the branch is…