Borrowing it
Nothing to install: this file belongs to sumulige/sumulige-claude. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/sumulige/sumulige-claude/main/.claude/skills/quality-guard/SKILL.mdgit clone --depth 1 https://github.com/sumulige/sumulige-claudeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/sumulige/sumulige-claude/quality-guard)<a href="https://agentmods.dev/skills/sumulige/sumulige-claude/quality-guard"><img src="https://agentmods.dev/badge/skills/sumulige/sumulige-claude/quality-guard/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/sumulige/sumulige-claude/quality-guard"><img src="https://agentmods.dev/badge/skills/sumulige/sumulige-claude/quality-guard.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.00841 |
| Opus 5 | $0.00000 | $0.00420 |
| Sonnet 5 | $0.00000 | $0.00168 |
| Haiku 4.5 | $0.00000 | $0.00084 |
Grade A, and why
quality-guard scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Quality Guard
代码质量守护者 - 合并: code-reviewer + security-reviewer + refactor-cleaner
核心职责
统一处理代码质量的三个维度：
- 代码审查 - 可读性、可维护性、最佳实践
- 安全检查 - OWASP Top 10、漏洞检测
- 代码清理 - 死代码、重复代码、未使用依赖
工作模式
模式 1：快速审查（默认）
触发：代码变更后
范围：变更文件
输出：问题列表 + 严重程度
模式 2：安全深扫
触发：--security 或处理认证/支付/用户输入
范围：相关模块
输出：安全报告 + 修复建议
模式 3：代码清理
触发：--clean 或明确要求清理
范围：整个项目
输出：可删除项列表 + 风险评级
审查清单
代码质量（HIGH）
- 函数 < 50 行
- 文件 < 800 行
- 嵌套深度 < 4 层
- 命名清晰、语义化
- 无 console.log 语句
- 无硬编码魔法值
- 错误处理完善
安全检查（CRITICAL）
- 无硬编码凭证（API keys, passwords, tokens）
- 无 SQL 注入风险
- 无 XSS 漏洞
- 输入验证完整
- 无不安全依赖（npm audit）
- 无路径遍历风险
- 认证/授权正确实现
代码清理（MEDIUM）
- 无未使用的导出
- 无未使用的依赖
- 无重复代码块
- 无死代码分支
- 无过时的 TODO/FIXME
分析工具
# 代码质量
npx eslint . --report-unused-disable-directives
# 安全检查
npm audit
npx snyk test
# 死代码检测
npx knip # 未使用的文件、导出、依赖
npx depcheck # 未使用的 npm 依赖
npx ts-prune # 未使用的 TypeScript 导出
输出格式
# Quality Guard Report
## Summary
- 🔴 CRITICAL: X issues
- 🟠 HIGH: X issues
- 🟡 MEDIUM: X issues
## Security Issues
| File | Line | Issue | Fix |
|------|------|-------|-----|
## Code Quality Issues
| File | Line | Issue | Fix |
|------|------|-------|-----|
## Cleanup Suggestions
| Item | Type | Risk | Action |
|------|------|------|--------|
## Verdict
✅ APPROVED / ⚠️ NEEDS ATTENTION / ❌ BLOCKED
严重程度
| 级别 | 类别 | 处理 |
|---|---|---|
| 🔴 CRITICAL | 安全漏洞 | 必须修复，阻止提交 |
| 🟠 HIGH | 代码质量 | 应该修复 |
| 🟡 MEDIUM | 清理建议 | 建议修复 |
| 🟢 LOW | 风格建议 | 可选修复 |
使用方式
# 快速审查（默认）
/review
# 安全深扫
/review --security
# 代码清理
/review --clean
# 完整审查
/review --all
原则：质量是不可妥协的。安全问题必须立即修复。
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 139 lines · 0 tokens per session scan A e29bea594678
quality-guard is a skill published in the GitHub repository sumulige/sumulige-claude (2 stars, last pushed 7mo ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 841 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
dev-review
Code-focused plan-bounce-execute workflow between Claude Code (Opus) and Codex CLI. Use when the user wants repo files changed, a bug fixed, a feature implemented, or a code plan verified before execution. One AI composes a plan, it bounces between agents with [CONTESTED]/[CLARIFY] markers until refined, then the…
arch-check
An architecture and implementation review tool that examines how a codebase is modeled, divided into responsibilities, organized into modules, and connected by dependencies. It also checks for issues such as circular dependencies, over-design, and violations of common design principles.
codex-build
Orchestrate Codex to BUILD code in the background while this Claude Code session (typically Opus) plans and reviews — never babysitting. The session composes the implementation plan, kicks the dev-review runner detached via a background Bash task with --preset codex-build, ENDS ITS TURN, and is woken on exit to run a…
co-evolution
General-purpose co-evolution for questions, ideas, drafts, plans, specs, arguments, and markdown documents. Composes or bounces content between agents using [CONTESTED]/[CLARIFY] markers until it converges. Triggers on "co-evolution", "co-evolve", "co evolve", "bounce", "bounce document", "agent bouncer", "refine with…
recursive-task-optimizer
Build, configure, run, inspect, or troubleshoot agent-agnostic recursive improvement loops for a repository or artifact. Use when a task should be attempted repeatedly by Claude Code, Codex CLI, Hermes, or another CLI agent; when candidates must inherit mutable task instructions, a self-improving meta-procedure, and…
review
Run a structured, read-only code review through agent-rack's agentreview tool.