Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add SalesforceCommerceCloud/b2c-developer-tooling --skill sfnext-quality-gatesgit clone --depth 1 https://github.com/SalesforceCommerceCloud/b2c-developer-toolingWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/salesforcecommercecloud/b2c-developer-tooling/sfnext-quality-gates)<a href="https://agentmods.dev/skills/salesforcecommercecloud/b2c-developer-tooling/sfnext-quality-gates"><img src="https://agentmods.dev/badge/skills/salesforcecommercecloud/b2c-developer-tooling/sfnext-quality-gates/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/salesforcecommercecloud/b2c-developer-tooling/sfnext-quality-gates"><img src="https://agentmods.dev/badge/skills/salesforcecommercecloud/b2c-developer-tooling/sfnext-quality-gates.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00189 | $0.01391 |
| Opus 5.5 | $0.00076 | $0.00556 |
| Sonnet 5.5 | $0.00038 | $0.00278 |
| Haiku 4.5 | $0.00019 | $0.00139 |
Grade A, and why
sfnext-quality-gates scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 15d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 71 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Storefront Next Quality Gates
Your project enforces style, types, size and accessibility with a few commands. CI runs the same ones, and lint is strict: any warning fails.
Pre-PR checklist
pnpm lint # OxLint (type-aware, --max-warnings 0) then Biome format check
pnpm typecheck # route typegen + tsc --noEmit
pnpm test # unit tests
pnpm storybook:test --type=snapshot # if you touched components or stories
pnpm bundlesize # if you added dependencies or large components
If you changed UI, also run pnpm storybook:test --type=interaction and --type=a11y (needs pnpm exec playwright install chromium). Fix formatting and auto-fixable lint in one go with pnpm lint:fix.
Commands
| Command | What it does |
|---|---|
pnpm lint |
oxlint --type-aware --report-unused-disable-directives --max-warnings 0 (e2e excluded) then biome format check, then the e2e package's own lint |
pnpm lint:fix |
oxlint --fix then biome format --write |
pnpm format / pnpm format:check |
Biome formatting only (4-space indent, 120 columns, single quotes in JS, double in JSX) |
pnpm lint:a11y |
Reports only jsx-a11y/* findings; exit 1 if any (see storefront-next:sfnext-accessibility) |
pnpm lint:css |
After a build, checks the built app stylesheet for Tailwind candidates that only come from stories, tests or docs (dead or story-only classes). Run pnpm build first |
pnpm typecheck |
react-router typegen then tsc --noEmit (uses extra heap) |
node scripts/check-typescript-only.js |
Fails if .js/.jsx/.mjs/.cjs exist under src/ |
pnpm bundlesize |
Builds with BUNDLES_SIZE_CHECK=true; fails if chunks exceed limits in package.json#bundlesize (client and server lists) |
pnpm bundlesize:compare |
Compares two bundle metadata files: node scripts/compare-bundlesize.mjs --baseline <path> --candidate <path> [--tolerance <pct>] |
pnpm lighthouse:ci |
lhci autorun using lighthouserc.cjs (build first; it starts the preview server itself) |
pnpm config:inspect |
Prints the resolved config to debug env overrides |
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 15d ago First seen · 71 lines · 189 tokens per session scan A e6bcaaac4f1f
sfnext-quality-gates is a skill published in the GitHub repository SalesforceCommerceCloud/b2c-developer-tooling (56 stars, last pushed today), licensed Apache-2.0. It adds 189 tokens to every session and 1,391 once invoked, about $0.0008 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-05.
Other skills, from other repositories
caliber-testing
Writes Vitest tests following project patterns: tests/ directories, vi.mock() for module mocking with vi.hoisted() for test-time factories, global LLM mock from src/test/setup.ts, environment variable save/restore in beforeEach/afterEach, vi.clearAllMocks() lifecycle, and test file organization. Use when user says…
merge-queue-readiness
Pre-queue merge-group CI simulation. Triggered before adding a PR to a GitHub merge queue. Prevents merge-queue kick-outs from integration test failures.
restore-internals-seams-in-finally-blocks-after-each-test
When delegating a task affected by this skill, include.
run-affected-test-file-in-isolation-and-in-co-run-with-its-test-
When delegating a task affected by this skill, include.
use-internals-di-seam-pattern-for-test-injectable-functions
When delegating a task affected by this skill, include.
propagation-test
When delegating a task affected by this skill, include.