Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add sonature-lab/timsquad --skill tsq-tidyinggit clone --depth 1 https://github.com/sonature-lab/timsquadWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/sonature-lab/timsquad/tsq-tidying)<a href="https://agentmods.dev/skills/sonature-lab/timsquad/tsq-tidying"><img src="https://agentmods.dev/badge/skills/sonature-lab/timsquad/tsq-tidying/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/sonature-lab/timsquad/tsq-tidying"><img src="https://agentmods.dev/badge/skills/sonature-lab/timsquad/tsq-tidying.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00110 | $0.00952 |
| Opus 5 | $0.00055 | $0.00476 |
| Sonnet 5 | $0.00022 | $0.00190 |
| Haiku 4.5 | $0.00011 | $0.00095 |
Grade A, and why
tsq-tidying scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Tidying & AI Safety Gate
구현 완료 후 자동 트리거되는 필수 품질 게이트. 통과하지 못하면 TASK 완료 불가.
Philosophy
- Tidying 커밋과 Behavior Change 커밋은 절대 섞지 않는다
- AI가 생성한 코드는 반드시 사람이 리뷰 가능한 상태로 정리한다
- Deep Module 원칙: 인터페이스는 단순, 구현은 깊게
- glossary.md의 용어가 코드 네이밍에 100% 반영되어야 한다
Contract
- Trigger: tsq-developer가 구현 완료 선언 직전 (자동)
- Input: 변경된 파일 목록 + glossary.md + ports.ts
- Output: PASS/FAIL 판정 + 위반 항목 리스트
- Error: FAIL 시 구현 완료 선언 차단, 위반 사항 수정 후 재실행
- Dependencies: tsq-coding, tsq-security
Protocol
- 변경 파일 수집:
git diff --name-only로 변경 파일 파악 - Deep Module 검증:
- ports.ts / 인터페이스 파일: 메서드 5개 이하인지 확인
- adapters/ 구현체: 인터페이스보다 충분히 깊은지 (최소 3배 LOC)
- Tidying 분리 검증:
- 현재 커밋에 Guard Clause 정리, 네이밍 변경, Dead Code 제거가 로직 변경과 섞여있지 않은지
- 섞여있으면 → FAIL + "Tidying 커밋 분리 필요" 보고
- Glossary 네이밍 검증:
- glossary.md 로드
- 변경 파일의 export된 함수/타입/변수명이 glossary 용어와 일치하는지
- 불일치 → FAIL + 불일치 목록 보고
- AI 안전 스캔:
- 하드코딩된 시크릿 패턴 검색 (API key, password, token 리터럴)
- SQL raw query 존재 시 → 파라미터 바인딩 사용 여부 확인
any타입 사용 여부 (신규 코드에서)console.log잔존 여부
- 결과 보고: PASS면 구현 완료 진행 허용, FAIL이면 위반 목록 반환
Verification
| Check | Command | Pass Criteria |
|---|---|---|
| Secret scan | grep -rn "sk_live|password.*=.*['\"]" src/ |
0 matches |
| Any type | grep -rn ": any" src/ --include="*.ts" |
0 matches in new code |
| Console.log | grep -rn "console.log" src/ --include="*.ts" |
0 matches |
| Deep Module ratio | ports LOC * 3 < adapters LOC | true |
| Glossary compliance | exported names match glossary.md | 100% |
Quick Rules
Tidying (Kent Beck)
- Guard Clauses: 조건 역전으로 중첩 제거
- Dead Code: 주석 처리 대신 삭제 (git이 기억함)
- Normalize Symmetries: 유사한 코드는 동일 구조로 통일
- Chunk Statements: 관련 코드 그룹핑 + 빈 줄 구분
- Extract Helper: 3회 이상 반복되면 추출 (그 이전은 하지 않음)
AI Safety (타협 불가)
Co-Authored-By: Claude커밋 태그 필수- DB 쿼리 / 외부 API 호출 코드는 반드시 리뷰 대상 표시
- 환경변수 하드코딩 절대 금지
- 인증/인가 로직은 middleware/guards에 분리
What ships with it
4 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 76 lines · 110 tokens per session scan A b05f9555b096
tsq-tidying is a skill published in the GitHub repository sonature-lab/timsquad (11 stars, last pushed 11d ago), licensed MIT. It adds 110 tokens to every session and 952 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
review-work
Quality gate: verify each acceptance criterion of a completed task/work unit, run quality checks, and create follow-up tasks for gaps. Use before merging or to audit delivered work. Invoked as /agiflow:review-work . Uses getworkunit, gettask, updatetask, createtask, createtaskcomment.
sentinel
CocoSentinel — eight-dimension artifact quality gate. Dimension G evidence pre-gate runs first (deterministic, .
code-review-workflow
Review a change in a fixed order — context, correctness, security, then style — and write feedback that is actionable and ranked by severity. Use when the user asks for a code review, wants a pull request or diff reviewed before merge, asks whether a change is safe to ship, or when the task involves reviewing a patch…
reviewing-code-quality
Reviews a diff or module for slipping standards, favoring deletion over rearranging, and ends in one honest verdict. Use when a change risks oversized files, needless layers, feature logic leaking into shared code, or clever indirection. Do not use for a trivial obvious edit, or for a check that is only about whether…
dos-verify-done-claims
Before accepting an agent's 'done / shipped / fixed' claim, verify it against ground truth (git ancestry + the commit's own diff) using the DOS kernel's dos verify and dos commit-audit — never the agent's own narration.
reviewing-plan-docs
Review planning documents by reading the plan docs and doing a thorough codebase walkthrough, then writing detailed review docs. Use when the user asks to review, audit, critique, or validate a plan, design doc, or spec in the permit0 repository.