Borrowing it
Nothing to install: this file belongs to SukramJ/openccu-loom. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/SukramJ/openccu-loom/main/.claude/skills/comment-claims-sweep/SKILL.mdgit clone --depth 1 https://github.com/SukramJ/openccu-loomWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/sukramj/openccu-loom/comment-claims-sweep)<a href="https://agentmods.dev/skills/sukramj/openccu-loom/comment-claims-sweep"><img src="https://agentmods.dev/badge/skills/sukramj/openccu-loom/comment-claims-sweep/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/sukramj/openccu-loom/comment-claims-sweep"><img src="https://agentmods.dev/badge/skills/sukramj/openccu-loom/comment-claims-sweep.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00063 | $0.00723 |
| Opus 5.5 | $0.00025 | $0.00289 |
| Sonnet 5.5 | $0.00013 | $0.00145 |
| Haiku 4.5 | $0.00006 | $0.00072 |
Grade A, and why
comment-claims-sweep scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 19d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 56 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Comment-claims sweep
Mechanical guards cover only two shapes of prose:
TestDeclaredSilentEventDocsClaimNoConsumers and
TestRatchetReasonsAreNotDeferrals. Everything else a comment asserts is
unverified. The 0.54.4 sweep found one live delivery bug and a dozen refuted
claims behind seven green PRs.
What to look for
A comment is a claim. These four shapes go stale silently:
- Comments naming a consumer — "for the MQTT/webhook consumers", "so MQTT/WS subscribers receive it", "consumed by X". Resolve the event type or symbol and check that a subscriber actually exists in production code (test files do not count).
- "stub" / "not wired yet" / "TODO: hook up" — either still true (then the seam is dead and that is a finding) or long since done (then the comment misleads).
- File-header inventories — "this file holds A, B and C". Check the file still holds exactly that.
- Ratchet justifications in
tests/contract/—wiringSettersWithoutCaller,wiringSeamsUnderInvestigation,registryWalkersWithoutAdoptSeam,eventsWithoutSubscriber. Each entry claims a reason; verify the reason still holds.
How to run it
Size the fan-out from the host (see the root CLAUDE.md): these are
read-only sweep agents, so 6–8 in parallel is fine. Run them with
model: "sonnet" — a VERIFIED verdict is a first reading nobody re-reads, and
the root CLAUDE.md (Which model does which work) keeps Haiku to lists. Give
each one a disjoint tree — internal/central, internal/north/mqtt, internal/north/rest,
internal/north/matter, internal/model, internal/store + internal/client,
tests/contract — and this brief:
Find every comment in that makes a checkable claim of the four shapes above. For each, resolve the claim against production code (exclude
_test.gowhen checking whether a consumer exists). Report a table: file:line, the claim, VERIFIED / REFUTED, and the evidence line you checked. Do not edit anything. ≤ 250 words; longer tables to the scratchpad as a path.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 19d ago Changed · +4 lines 7ca0f5812fea
- 2mo ago First seen · 52 lines · 63 tokens per session scan A df0a4dc2d758
comment-claims-sweep is a skill published in the GitHub repository SukramJ/openccu-loom (7 stars, last pushed yesterday), licensed Apache-2.0. It adds 63 tokens to every session and 723 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
home-assistant
Use when automating a smart home with Home Assistant 2026.10 — configuration.yaml and automations.yaml, triggers/conditions/actions YAML, REST API /api/states and /api/services, WebSocket subscribeevents, long-lived access tokens, Docker container installs; also for 'Configuration invalid' after a YAML edit, 401 from…
unraid-management-agent
Monitor and control an Unraid server via the Unraid Management Agent's MCP server (125 tools, 5 resources, 6 diagnostic prompts) and REST API. Use when: connecting an AI client (Claude, ChatGPT, Cursor, Copilot, Gemini CLI) to Unraid; checking system, array, disk, Docker, VM, GPU, UPS, ZFS, or network status…
contrib-pr-review
Review a contribution PR for safety, quality, and readiness. Checks for security concerns, test coverage, size appropriateness, and intent alignment. Use when reviewing external contributions.
issue-to-pr-resolver
Implement a GitHub issue end-to-end — create a worktree branch, implement the feature with tests, create a draft PR, then iteratively resolve all CI failures and review comments until the PR is clean. Use when you need to fully implement a GitHub issue from start to merge-ready. Triggers on "implement issue", "resolve…
my-pr-checker
Manage your own GitHub pull requests — check CI status, inline review comments, PR-level comments, resolve review threads, fix issues, and iterate until all checks pass and threads are resolved. Use for managing your own PRs (not external contributions). Triggers on "check my PR", "check PR", "/my-pr-checker ".
issue-analysis
Deep analysis of a single GitHub issue with codebase exploration, implementation planning, and architectural assessment. Use when you need to analyze a GitHub issue, assess its complexity, plan implementation approaches, and post a structured analysis comment. Triggers on "analyze issue", "deep analysis"…