Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add peteski22/agent-pragma --skill reviewgit clone --depth 1 https://github.com/peteski22/agent-pragmaWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/peteski22/agent-pragma/review)<a href="https://agentmods.dev/skills/peteski22/agent-pragma/review"><img src="https://agentmods.dev/badge/skills/peteski22/agent-pragma/review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/peteski22/agent-pragma/review"><img src="https://agentmods.dev/badge/skills/peteski22/agent-pragma/review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 77 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00012 | $0.01254 |
| Opus 5 | $0.00006 | $0.00627 |
| Sonnet 5 | $0.00002 | $0.00251 |
| Haiku 4.5 | $0.00001 | $0.00125 |
Grade A, and why
review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 157 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Review Changes
Run all applicable validators against recent changes and report findings.
Step 2 (rule injection) runs before validation. If no project rules are found, validation continues with validator built-in rulesets. Run /setup-project to configure project-specific rules.
Step 1: Identify what changed
Get changed files. Combine committed, staged, and unstaged changes to capture all recent work:
{ git diff HEAD~1 HEAD --name-only --diff-filter=ACMRT 2>/dev/null; git diff --cached --name-only --diff-filter=ACMRT 2>/dev/null; git diff --name-only --diff-filter=ACMRT 2>/dev/null; } | sort -u
The --diff-filter=ACMRT includes Added, Copied, Modified, Renamed, Type-changed (excludes Deleted).
Collect the list of changed files and their directories.
Step 2: Inject applicable rules
Collect project rules from the project's rule directory. Rule file locations vary by agent platform:
- Claude Code:
.claude/rules/*.md - OpenCode:
AGENTS.md(auto-loaded natively) - Other agents: check agent documentation for project rule conventions
For Claude Code, use the Glob tool to discover .claude/rules/*.md files, then the Read tool to load them. OpenCode auto-loads rules from AGENTS.md at the platform level.
Path-scoped filtering: Always include universal and local-supplements rule files. For files with paths: frontmatter, include only if at least one declared path pattern matches a changed file from Step 1. Files without paths: frontmatter are treated as global and always included. This prevents unrelated language rules from being applied (e.g., Go rules on a Python-only change).
De-duplicate (a rule file only needs to be read once even if multiple files share it).
If no rule files are found: Log "No project rules found — using validator built-in rulesets." and skip to Step 3. Validators have built-in rules and do not require project-specific rule files to function.
Precedence: Most specific (path-scoped) rules override more general (universal) rules. Local supplements have highest priority.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 157 lines · 12 tokens per session scan A 913b670540c7
review is a skill published in the GitHub repository peteski22/agent-pragma (22 stars, last pushed today), licensed Apache-2.0. It adds 12 tokens to every session and 1,254 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
review-prs
Review a GitHub pull request in the googleapis/mcp-toolbox repo against the team's reviewer checklist: PR title/description conventions, linked issue, logic errors and unhandled edge cases, breaking changes, test coverage, docs updates, security (input handling), and new dependencies. Use whenever a maintainer asks…
discount-review
Inspect the discount policy fixture with a repeatable review checklist and helper script.
code-review
Reviews code for bugs, security issues, and best practices.
mantis-plan
Formulates a targeted defensive security reviewing plan based on the active threat model and historical learnings. Use when starting a security review campaign to map the codebase boundaries and generate a roadmap (workspace/plan.json). Don't use for executing code reviews, writing test scripts, or patching code.
mantis-summarize
Pre-processes the repository by generating security-focused summaries (mantis-summary.md) for each directory to make planning and research more efficient. Use when starting a review campaign to map the codebase before threat modeling and planning. Don't use for executing code reviews, writing test scripts, or patching…
goal-pr
Drive a pull request to a clean state and merge it: run the review-pr skill, fix every mid-or-above finding, and repeat until no mid-or-above findings remain, then merge. Use when the user wants to finish a PR by reviewing, fixing, and merging it, or triggers on "the goal-pr skill".