report

report is a skill for Claude Code from stellarshenson/claude-code-plugins. It costs 56 tokens per session (1,610 once invoked), scanned A, original, MIT.

A reporting command for a project's acceptance criteria or defects. It prints status summaries, open fixes, rejection reasons, and a test-coverage grid, or can produce a custom table.

In plain words
What is it for?
Use it to review acceptance-criteria status, triage defects, inspect test coverage, or create an ad-hoc report from project data.
Why use it?
It gathers project status and coverage into one report, making unfinished work and gaps easier to see.

Skill for Claude Code

Written for Claude Code: allowed-tools in frontmatter. Also seen: mentions .claude-plugin.

Runs only inside its plugin — its command needs a path that Claude Code sets for a plugin’s own hooks and for nothing else. Install the plugin, not this.

Part of the project-management plugin — 5 skills, 4 commands, 2 hooks shipped together

Good fit Use it to review acceptance-criteria status, triage defects, inspect test coverage, or create an ad-hoc report from project data.

Compare 6 skills from other repositories ↓
Install

Getting it into your agent

This one installs as part of its plugin. Adding the marketplace and installing the plugin brings it with everything else the plugin ships.

Claude Code
/plugin marketplace add stellarshenson/claude-code-plugins
Claude Code
/plugin install project-management

Made for: Claude Code.

Or install project-management, the plugin that ships this one along with the rest of its 5 skills, 4 commands, 2 hooks.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for report

README.md
[![agentmods](https://agentmods.dev/badge/skills/stellarshenson/claude-code-plugins/report/github.svg)](https://agentmods.dev/skills/stellarshenson/claude-code-plugins/report)
Your own site
<a href="https://agentmods.dev/skills/stellarshenson/claude-code-plugins/report"><img src="https://agentmods.dev/badge/skills/stellarshenson/claude-code-plugins/report/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for report

Your own site · 80×15
<a href="https://agentmods.dev/skills/stellarshenson/claude-code-plugins/report"><img src="https://agentmods.dev/badge/skills/stellarshenson/claude-code-plugins/report.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 56 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,610 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00056 $0.01610
Opus 5.5 $0.00022 $0.00644
Sonnet 5.5 $0.00011 $0.00322
Haiku 4.5 $0.00006 $0.00161

Measured yesterday against content hash 120f7797fb97, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

report scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

plugins/project-management/skills/report/SKILL.md · 40 lines

How it starts

The opening of the file, as written. The whole thing — 40 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Report

Read the project-management skill first - it is the single source of truth for what the sections mean and how the tables are read. Do NOT duplicate its content here. skills/project-management/references/reports.md carries the section shapes, the filter semantics and --detail.

Toolchain gate (MANDATORY - run before anything else)

Run this first, every session, before any other work. The upgrade always runs; a version mismatch blocks.

python3 -m pip install --user --upgrade stellars-claude-code-plugins 2>&1 | tail -1
LIB=$(python3 -c "import importlib.metadata as m;print(m.version('stellars-claude-code-plugins'))" 2>/dev/null) || { echo "FATAL: toolkit unavailable"; exit 1; }
PLUG=$(grep -m1 '"version"' "${CLAUDE_PLUGIN_ROOT}/.claude-plugin/plugin.json" 2>/dev/null | cut -d'"' -f4)
OLDER=$(printf '%s\n%s\n' "$LIB" "$PLUG" | sort -V | head -1)
[ -n "$PLUG" ] && [ "$LIB" != "$PLUG" ] && [ "$OLDER" = "$LIB" ] && { echo "STALE: library $LIB older than plugin $PLUG - refusing to run on an outdated CLI; re-run the upgrade"; exit 1; }
echo "toolkit $LIB"

Run the CLI without touching the caller's project. The gate above puts it on PATH, so the bare command name is the whole invocation. uv run instead resolves whatever project the working directory sits in and writes uv.lock and .venv into it, so if you reach for uv pass --no-project (uv run --no-project <cli> ...) - it skips project discovery, leaves the tree untouched and still finds the same PATH binary. --no-sync and --frozen are not substitutes; both still create .venv.

Both branches exit non-zero and neither is advisory: an absent library (FATAL) and a version mismatch (STALE). A mismatch means the CLI is not the one this file was written against, so its documented flags and rules are unverified. Report the line and stop; do not work around it.

What to do

  1. Read the project-management skill, then skills/project-management/references/reports.md
  2. Run pm-tools report on the store - docs scans for both disciplines, a path narrows to one
  3. Map a filtered ask onto flags; never filter by hand. "The open defects only" is --status open, "the critical defects" is --severity CRITICAL, "what @kj has left in AUTH" is --author @kj --category AUTH, "what closed in August" is --dates closed --since 2026-08-01 --until 2026-08-31, "the critical criteria" is --importance CRITICAL, "the regressions" is --regressions, "what is blocked" is --blocked, "everything around DEF-LNCH-3" is --related-to DEF-LNCH-3, "anything whose title, body, evidence or log mentions the token" is --grep token, "what is being worked on" is --locked and "what @kj is working on" is --locked-by @kj. Flags combine. Every filter narrows the whole report except --status, which narrows ITEMS alone; --detail swaps the ITEMS tables for one block per item. Reading the document and filtering inside the answer is the failure this tool exists to prevent
  4. Asked about test coverage, run pm-tools coverage - the grid of categories by tags (UNIT, INTEGRATION, FUNCTIONAL, E2E, MANUAL, any other tag, NO-TEST last), counting open and closed items alike; it takes the same filters
  5. A question no report section answers is a list or a pivot, still a table. Who owns what by severity is pivot --rows author --cols severity; the open work oldest first with owners is list --status open --columns id,title,author,age --sort=-age; regressions per defect is pivot --rows root --regressions --values ids. "Is there already an item about X" is search "X" - a ranked table, pasted like any other, never a reading of the file. The ask-to-command table and the FIELDS vocabulary are in references/reports.md. Never tabulate by hand from the document - shape the table with the tools and paste it
  6. Asked for a summary, run --summary - it stops at the SUMMARY grid and lists no items, and it is plain by itself. Asked for something plain or short of a full report, --plain gives the grids and the queue with no icons and no CATEGORIES. The grids are plain counts - status per category, then the open items per level - and need no legend
  7. A wip @xx until <stamp> on an ITEMS row is a soft lock - the item's lock: line; @xx is likely working on that item, and the SUMMARY Worked on column counts them. Ask before picking a locked item up; lock one you pick up yourself with pm-tools lock FILE --id ID --author @xx. The lock never blocks a write, expired locks clear themselves on the next write, and pm-tools unlock clears one at will. report, list, search and refs also print N item(s) currently worked on: DEF-X by @xx until <stamp> on stderr before the table whenever a shown item is locked - read that line before choosing what to work on; taking or clearing an active lock held by another handle is a transfer - lock and unlock print TRANSFER: DEF-X was locked by @yy until <stamp> - you are taking it over; ask @yy and proceed, and a takeover with no --note records taken over from @yy
  8. Paste the tables verbatim - they are the deliverable. Do not re-type them, do not restate them in prose beside the table, do not summarise a table the user can read. A collection of items is always a table, never a bulleted list
  9. Add at most one line of your own: what the reader should do next, if anything is obvious from the queue. After a --summary, add nothing - naming the items, the clusters or the row count underneath puts back what the flag removed
  10. Audit mode - asked to audit rather than report, run pm-tools check docs --strict first and lead with its errors and warnings; the report follows underneath. check reports, it does not repair: a dangling relation is an error unrelate removes, a blocked-by or override cycle and a one-sided override are errors that name the relate call which repairs them, an open item that is overridden or blocked by finished work is a warning

Read the full file on GitHub · 40 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday Changed 120f7797fb97
  2. 16d ago Changed 09003291b968
  3. 1mo ago Changed b6fe1695b26b
  4. 1mo ago First seen · 40 lines · 56 tokens per session scan A 442e35267c97

Subscribe to this mod's changes

report is a skill published in the GitHub repository stellarshenson/claude-code-plugins (4 stars, last pushed today), licensed MIT. It adds 56 tokens to every session and 1,610 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-05.