Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/rossoctl/examples/orchestrate-reviewnpx skills add rossoctl/examples --skill orchestrate-reviewgit clone --depth 1 https://github.com/rossoctl/examplesWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00028 | $0.01833 |
| Opus 5 | $0.00014 | $0.00916 |
| Sonnet 5 | $0.00006 | $0.00367 |
| Haiku 4.5 | $0.00003 | $0.00183 |
Grade B, and why
orchestrate:review scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Enumerates other installed skillsmediumAgent snooping
Other skills' SKILL.md files reveal prompts, capabilities and secrets that should be invisible to peers.
find .repos/<target>/.claude/skills -name "SKILL.md" -exec head -5 {} \; 2>/dev/null How it starts
The opening of the file, as written. The whole thing — 221 lines — stays where its author put it; the contents beside it link to each section on GitHub.
flowchart TD
START(["/orchestrate:review"]) --> GATHER["List open orchestration PRs"]:::orch
GATHER --> PER_PR["Per-PR review"]:::orch
PER_PR --> CROSS["Cross-PR consistency checks"]:::orch
CROSS --> DRAFT["Draft review summary"]:::orch
DRAFT --> APPROVE{User approves?}
APPROVE -->|Yes| SUBMIT["Post reviews via gh api"]:::orch
APPROVE -->|No| REVISE["Revise reviews"]:::orch
REVISE --> DRAFT
SUBMIT --> STATUS["Update phase-status.md"]:::orch
STATUS --> DONE([Review complete])
classDef orch fill:#FF9800,stroke:#333,color:white
classDef check fill:#FFC107,stroke:#333,color:black
class APPROVE check
Follow this diagram as the workflow.
Orchestrate: Review
Phase 7 quality gate. Review all orchestration PRs created by phases 2-6 before merge. Checks each PR individually, then validates cross-PR consistency, and submits reviews after user approval.
When to Use
- After all orchestration phases (2-6) have created their PRs
- Before merging any orchestration PRs into the target repo
- When
/orchestrate reviewis invoked from the router
Prerequisites
scan-report.mdandplan.mdexist in/tmp/rossoctl/orchestrate/<target>/- Phases 2-6 are complete (or at least the phases that were planned)
- PRs are open on the target repo
Phase 1: Gather
List open PRs for the target repo and collect metadata:
# List open PRs created by orchestration (look for orchestrate-related branch names or labels)
gh pr list --repo <org>/<repo> --state open --json number,title,headRefName,additions,deletions,files
For each PR, fetch the diff:
gh pr diff <number> --repo <org>/<repo>
Record PR metadata in a working table:
| PR | Title | Branch | Files | +/- |
|---|---|---|---|---|
| #N | ... | orchestrate/... | N | +X/-Y |
Phase 2: Per-PR Review
For each PR, run this review checklist:
Commit Conventions
- Signed-off (
Signed-off-by:trailer present) - Emoji prefix on commit message (if repo convention requires it)
- Imperative mood in subject line
- Body explains "why" not just "what"
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 221 lines · 28 tokens per session scan B c54a986fb0b7
orchestrate:review is a skill published in the GitHub repository rossoctl/examples (11 stars, last pushed 4d ago), licensed Apache-2.0. It adds 28 tokens to every session and 1,833 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it B with 1 finding (enumerates other installed skills). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
importing-a-codebase
Use when the repo holds real source code but no specs: the existing-codebase branch of setting-up-a-project, normally reached via that dispatcher, directly only when the situation is unmistakable. Not for empty workspaces (starting-a-new-project) or feature work in a specced project (brainstorming).
starting-a-new-project
Use when the workspace is empty — no code yet — and the user brings a raw idea: the brand-new branch of setting-up-a-project, normally reached via that dispatcher, directly only when the situation is unmistakable. Not for features in an existing project — use brainstorming instead.
todos
This chat has a shared, live TODO plan — your tasks for the conversation, which the user also edits. Read this skill and reach for the todo tools whenever a request takes more than a couple of steps. It covers the plan model (group = task, items = its steps; loose items are the user's lane), how to work it: propose…
writing-workflow-skills
Use when adding a new workflow skill to pi-thinkrail-workflow, changing an existing workflow skill's role, trigger, handoff, or structure, or checking a workflow skill against the workflow system's rules. Not for authoring general-purpose skills outside this package.
spec-graph
The project's specs are its ground truth: durable documents describing the architecture, decisions, contracts, and boundaries behind the code, organized as a connected graph. Read this skill and reach for the spec tools FIRST — before reading code — whenever you explore the project, plan or start a task, add or change…
asking-user-questions
Use when composing an askuserquestion round inside a workflow, or when a workflow skill names it at a question step. Shared norms for the tool — not a workflow, nothing to execute.