Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add paultyng/skill-issue --skill review-reliabilitygit clone --depth 1 https://github.com/paultyng/skill-issueWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/paultyng/skill-issue/review-reliability)<a href="https://agentmods.dev/skills/paultyng/skill-issue/review-reliability"><img src="https://agentmods.dev/badge/skills/paultyng/skill-issue/review-reliability.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00057 | $0.01862 |
| Opus 5 | $0.00028 | $0.00931 |
| Sonnet 5 | $0.00011 | $0.00372 |
| Haiku 4.5 | $0.00006 | $0.00186 |
Grade A, and why
review-reliability scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directorieslowAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
- Findings must cite probed evidence (`path:line`, grep output, command result), not pattern-matched suspicion. Per `~/.claude/rules/probe-not-assume.md`. Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
How it starts
The opening of the file, as written. The whole thing — 148 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Reliability Review
Structured reliability review producing actionable, prioritized findings with code-level references.
Workflow
1. Scope and explore
- Confirm scope with the user: full codebase, specific packages/directories, changed files only (PR or branch diff), or specific concern.
- Resolve scope to a file/package list. Based on what the user requested:
- Changed files (PR or branch): Run
git diff --name-only --diff-filter=d <base>...HEADto get changed files (default<base>ismain). If the user references a PR number, usegh pr diff <number> --name-onlyinstead. Filter to relevant file types (.go, config files, Kubernetes manifests). Derive affected Go packages from the file paths (unique parent directories containing.gofiles). - Explicit paths/packages: The user may specify directories (e.g.
internal/auth/), Go package patterns (e.g../internal/auth/...), or individual files. When given a directory or package pattern, include all files under it. - Full codebase: No filtering; explore everything (default).
- Changed files (PR or branch): Run
- Pass the resolved scope (file list) to all exploration and investigation subagents so they only read and analyze scoped files.
- Explore the scoped code using parallel subagents (
subagent_type="explore"). Read all relevant source files, configs, Kubernetes manifests, and deployment definitions.
2. System overview
Produce a brief architecture summary covering:
- Services, ports, and transport (gRPC, HTTP, etc.)
- Data stores and external dependencies
- Deployment model (if discernible)
Map the critical hot paths:
Client → Transport
→ step 1 (local / I/O annotation)
→ step 2 (DB round-trip #1)
→ step 3 (external call, round-trip #2)
→ response
Annotate each step: local vs. I/O, serial vs. parallel, cached vs. uncached.
3. Launch investigation subagent
Launch a single investigation subagent (subagent_type="generalPurpose", model: sonnet per subagent-model-routing) with the system overview, flow mapping, and in-scope file list.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 148 lines · 57 tokens per session scan A cd664b918169
review-reliability is a skill published in the GitHub repository paultyng/skill-issue (9 stars, last pushed 26d ago), licensed MIT. It adds 57 tokens to every session and 1,862 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 1 finding (reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
sdd-apply
Skill "sdd-apply" from Gentleman-Programming/gentle-ai, covering execution role, language domain contract, purpose, what you receive and execution and persistence contract.
api-design-reviewer
Use when reviewing API designs for consistency, usability, versioning, error semantics, security, backward compatibility, and developer experience before implementation or release.
kafka-connector-review
Review Kafka Connect connector configurations for common misconfigurations using the Lenses MCP server. Checks error handling, DLQ setup, converters, transforms, task count and task health. Use when user says "review connectors", "check connector configs", "why is my connector failing" or asks about Kafka Connect…
kafka-dlq-review
Review dead letter queue implementations for completeness using the Lenses MCP server. Checks DLQ topic existence, configuration, monitoring, metadata preservation, retry logic, reprocessing paths and connector DLQ alignment. Use when user says "review dead letter queues", "check DLQ setup", "DLQ audit" or asks about…
kafka-perf-review
Review Kafka producer and consumer performance configurations in both the live cluster (via Lenses MCP) and the codebase. Flags un-tuned defaults, anti-patterns and missing best practices. Use when user says "review Kafka performance", "check producer configs", "tune Kafka settings" or asks about throughput, batching…
kafka-schema-review
Review Kafka schema changes (Avro, Protobuf, JSON Schema) for compatibility and evolution best practices using the Lenses MCP server. Detects breaking changes, missing defaults, schema drift and naming issues. Use when user says "review schema changes", "check schema compatibility", "will this schema break consumers"…