Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/patforna/auto-task/review-designnpx skills add patforna/auto-task --skill review-designgit clone --depth 1 https://github.com/patforna/auto-taskWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/patforna/auto-task/review-design)<a href="https://agentmods.dev/skills/patforna/auto-task/review-design"><img src="https://agentmods.dev/badge/skills/patforna/auto-task/review-design.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00025 | $0.00668 |
| Opus 5 | $0.00013 | $0.00334 |
| Sonnet 5 | $0.00005 | $0.00134 |
| Haiku 4.5 | $0.00003 | $0.00067 |
Grade A, and why
review-design scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 51 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Review Design
Usage
/at:review-design [the change + its design intent]
Prerequisite
Requires chrome-devtools MCP. If not available, do not proceed and fail loudly.
Goal
Verify a design / UI change matches the specified design.
Guidance (DO NOT IGNORE!)
- Skip entirely for changes that don't alter rendered output.
- Read-only: surface findings, never fix.
Step 1: Start the App
Start the app on deterministic fixture data and drive it via the chrome-devtools MCP.
The serve command comes from the project config (.claude/auto-task.config.md, design-review section) — e.g. a recipe that serves test fixtures. If no such entry exists, look for an obvious fixture-backed dev-server; if none, fail loudly — do not review against live/non-deterministic data.
Prefer a serve command that binds free ports (so parallel sessions don't collide) and navigate to the URL it prints — don't assume a fixed port.
Step 2: Verify
- Measure, Don't Eyeball. Read DOM geometry / computed styles (
getBoundingClientRect, colour, contrast) and compare to the spec. - Check Token Fidelity. Read the diff, not just the render — flag hardcoded literals where a token was specified (e.g.
#3B82F6instead ofvar(--color-primary)or abg-primaryutility). Computed styles collapse the token name, so this is a source-level check. - Confirm the Gestalt with a screenshot against the design reference. Save the frames — one per state×theme the change actually touches, plus open interaction states (tooltip/popover) — under
.design-review/<task-or-slug>/(ensure it's gitignored) so the human can review them without re-booting the app. The chrome-devtools screenshot tool only writes within the repo workspace root, so save there even when reviewing a worktree (not under the worktree path). - Exercise Interaction States (hover / focus / open) with real input (real key/click events) — synthetic dispatch hides state-dependent bugs. Also cover the data / UI states the design defines (disabled / error / empty / loading), driven via the fixtures.
- Check for Unguarded Invariants — load-bearing geometry / colour with no e2e assertion.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 51 lines · 25 tokens per session scan A b45e28b89252
review-design is a skill published in the GitHub repository patforna/auto-task (3 stars, last pushed yesterday), licensed MIT. It adds 25 tokens to every session and 668 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
finishing-a-development-branch
Use when implementation is complete, all tests pass, and you need to decide how to integrate the work.
weather-fetcher
Instructions for fetching current weather temperature data for Dubai, UAE from Open-Meteo API.
agr-cli
Install, share, sync, and create AI agent skills across coding tools (Claude Code, Cursor, Codex, OpenCode, Copilot, Pi) using the agr CLI. Use whenever the user mentions agr, agr.toml, agr.lock, agrx, or asks to: add a skill ("install the pdf skill", "agr add ..."), sync agent resources across tools, share skills…
agr-release
Release process for the agr package. Handles version bumping (major/minor/patch/beta), changelog updates, pre-release quality checks, git tagging, and monitoring the GitHub Actions publish pipeline. Use this skill whenever the user wants to cut a release, bump the version, publish to PyPI, or asks about the release…
linkedin-post
You take a YouTube video transcript and produce a single LinkedIn post draft.
incident-response
Protocolo de respuesta ante incidentes en produccion: triaje, mitigacion, causa raiz y postmortem. Usar ante caidas, errores criticos, incidentes de seguridad o degradacion de servicio.