Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add paruff/uFawkesAI --skill reviewgit clone --depth 1 https://github.com/paruff/uFawkesAIWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/paruff/ufawkesai/review)<a href="https://agentmods.dev/skills/paruff/ufawkesai/review"><img src="https://agentmods.dev/badge/skills/paruff/ufawkesai/review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/paruff/ufawkesai/review"><img src="https://agentmods.dev/badge/skills/paruff/ufawkesai/review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00029 | $0.00923 |
| Opus 5 | $0.00015 | $0.00462 |
| Sonnet 5 | $0.00006 | $0.00185 |
| Haiku 4.5 | $0.00003 | $0.00092 |
Grade A, and why
review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 166 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Skill: Review
Load trigger:
"load review skill"> DORA: Cap 4 + 6 (Continuous Delivery + Operations) Token cost: Medium
Purpose
Review PR and build output for quality, security, and compliance.
Responsibilities
- Validate architecture compliance
- Check test coverage and gaps
- Identify security surface
- Scan for secrets and vulnerabilities
- Validate governance policies
- Assess code quality
Modes
PR Review Mode
Consumes PR diff and validates:
- Architecture compliance
- Test gap analysis
- Security surface identification
- Secrets scanning
- Dependency review
- Auth & data handling review
- fawkes suite gates check
Build Validation Mode
Consumes build output and validates:
- Spec compliance
- Design compliance
- Acceptance criteria validation
- Code quality
- Pipeline policy
- K8s policy
- GitOps overlay
- Security & RBAC
- Secret governance
- Policy-as-code
Sub-Skills
| Skill | Purpose |
|---|---|
review/spec-compliance |
Validate against specification |
review/design-compliance |
Validate against architecture |
review/code-quality |
Assess code quality |
review/acceptance-criteria |
Validate acceptance criteria |
review/security-rbac |
RBAC validation |
review/secret-governance |
Secret management review |
review/policy-validation |
Policy-as-code validation |
review/k8s-policy |
Kubernetes policy compliance |
review/pipeline-policy |
Pipeline policy validation |
review/gitops-overlay |
GitOps overlay validation |
Dependencies
| Skill | Relationship |
|---|---|
build |
Consumes build output |
test-execution |
Consumes test results |
spec |
Validates against requirements |
design |
Validates against architecture |
What ships with it
10 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- acceptance-criteria/SKILL.md 2.5 KB
- code-quality/SKILL.md 2.6 KB
- design-compliance/SKILL.md 2.0 KB
- gitops-overlay/SKILL.md 2.2 KB
- k8s-policy/SKILL.md 2.2 KB
- pipeline-policy/SKILL.md 2.3 KB
- policy-validation/SKILL.md 2.0 KB
- secret-governance/SKILL.md 1.9 KB
- security-rbac/SKILL.md 2.2 KB
- spec-compliance/SKILL.md 2.1 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 166 lines · 29 tokens per session scan A 9d8021704275
review is a skill published in the GitHub repository paruff/uFawkesAI (2 stars, last pushed 17d ago), licensed MIT. It adds 29 tokens to every session and 923 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
template-comprehensive-assessment
Full checkout audit for the Research Project Template — tests, architecture, docs, manuscript, pipeline. USE WHEN user asks for comprehensive assessment, full repo review, health check across projects, audit everything, or pre-merge sanity sweep for template exemplars — even without naming docs/prompts or a skill. Not…
shipjaw-challenge
Optional full adversarial ritual for locking a Shipjaw phase plan, ADR, or tech/product decision — durable challenge-report.md via proposer vs challenger (prefer a separate subagent). Use when the user runs /shipjaw-challenge, challenge this plan, wants a written challenge report, locking a meaty phase, contester ce…
karpathy-guidelines
Behavioral guidelines to reduce common LLM coding mistakes. Use when writing, reviewing, or refactoring code to avoid overcomplication, make surgical changes, surface assumptions, and define verifiable success criteria.
improve-codebase-architecture
Scan a codebase for deepening opportunities, present them as a visual HTML report, then grill through whichever one you pick.
adr-review
Review an ADR the user has written in docs/adr/. Use when the user says an ADR is ready for review or asks for feedback on a decision record. Never use this to write or rewrite an ADR for them.
code-review
Use before merging a diff. A structured review pass for correctness bugs, safety issues, and needless complexity.