Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add sungurerdim/dev-skills --skill ds-qualitygit clone --depth 1 https://github.com/sungurerdim/dev-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/sungurerdim/dev-skills/ds-quality)<a href="https://agentmods.dev/skills/sungurerdim/dev-skills/ds-quality"><img src="https://agentmods.dev/badge/skills/sungurerdim/dev-skills/ds-quality.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00068 | $0.06803 |
| Opus 5 | $0.00034 | $0.03402 |
| Sonnet 5 | $0.00014 | $0.01361 |
| Haiku 4.5 | $0.00007 | $0.00680 |
Grade D, and why
ds-quality scanned grade D with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Tells the agent never to refusehighAnti-refusal
Suppressing the ability to decline removes a core safety control; a later harmful request then succeeds.
2. **Classify** against the table in [references/invariant-patterns.md](references/invariant-patterns.md) (nine patterns, P1–P9). No pattern fits → use the nearest skeleton and record the gap in the report; never refuse Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
- Global gate, installed once (`--install`): `~/.claude/hooks/ds-quality-gate.sh`, registered in `~/.claude/settings.json` under `.hooks.Stop` (no matcher). Priority order per Stop: (1) explicit marker `<root>/.claude/ds How it starts
The opening of the file, as written. The whole thing — 205 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/ds-quality
Agents promise "done" without proof — quality depends on whether an instruction was followed, not on a mechanism. This skill installs a deterministic, local, no-CI quality gate — one entry point (format → lint → type → test) — then wires it into whichever host you use (Phase 4). --invariant mode extends the same principle past the toolchain: any invariant the user can describe becomes a generated, red-proven, chain-wired check (see Invariant Mode).
Quality-by-Mechanism — guaranteed by a verify-loop that runs real checks, not by hoping an agent obeys.
Install per host: Claude Code — /ds-quality --install (once); other hosts — --arm {codex|gemini|copilot|aider|git-hook}; no flag bootstraps missing tooling first, then auto-selects and wires the host's arm — see Phase 4.
Completion Evidence — applies to every phase: Report
done/OKonly with the machine-checkable evidence the gates name — the exact command run and its observed output (orfile:linediff). Missing evidence → reportINCOMPLETEplus what is missing. Self-assessment is never evidence. (This band repeats at file end by design — both copies are normative.)
Triggers
- User runs
/ds-quality - User asks to "enforce quality / set up a quality gate / block done until checks pass"
- User asks for local format+lint+type+test enforcement without CI
- User asks to make an agent keep working until tests/build pass
- User describes an invariant and asks for it to be mechanically enforced ("these two constants must stay equal", "X must never come back", "this generated file must match its source") →
--invariant
Triggers — INVOKE / DON'T INVOKE
| INVOKE | DON'T INVOKE |
|---|---|
| "set up a local quality gate that blocks done" | "write the feature / fix this bug" (→ target dev skill) |
| "enforce format/lint/type/test on every stop/commit" | "set up CI / GitHub Actions" (out of scope — LOCAL ONLY) |
| "make checks deterministic, not instruction-based" | "just run the tests once" (→ run the test runner) |
| "wire quality enforcement into Aider / a non-Claude-Code host" | "review this PR" (→ ds-review) |
"make this invariant mechanically enforced" (--invariant) |
"run the audits that already exist" (→ --run) |
What ships with it
8 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed · +1 lines 13b8dfe66de5
- 3d ago Changed · -76 lines · -101 tokens per session c09c9d2bf825
- 6d ago First seen · 280 lines · 169 tokens per session scan D 348df8aea253
ds-quality is a skill published in the GitHub repository sungurerdim/dev-skills (1 stars, last pushed yesterday), licensed MIT. It adds 68 tokens to every session and 6,803 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it D with 2 findings (tells the agent never to refuse, reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
ring:running-dev-cycle
Running the backend dev cycle: implements every task in a rolling-wave plan.md (ring:writing-plans format) for a Go/TS service, driving specialist agents through Gate 0 implementation/TDD, Gate 8 parallel review, and Gate 9 validation per epic, elaborating later phases at each phase boundary. Use when starting or…
ring:instrumenting-streaming-events
Instrumenting streaming events: wires lib-streaming event emission end-to-end into a Lerian Go service via a 13-gate cycle (catalog, Builder bootstrap, Emit sites, outbox, HTTP manifest, NoopEmitter fallback, integration and chaos tests), dispatching ring:backend-go under TDD. Consumes the validated…
ring:adding-multi-tenancy
Adding database-per-tenant isolation into a Go service end-to-end via an 11-gate cycle: detects the stack, audits compliance, then dispatches backend agents to implement tenantId-from-JWT routing through the lib-commons v5 dispatch layer (config, middleware, repositories, metrics, tests) and runs reviewers. Use when…
ring:implementing-tasks
Implementing a single planned task (Task N.M.T) end-to-end: selects the right backend agent by language and service type, drives one TDD RED->GREEN turn, then verifies coverage, lint, license headers, runtime, and delivery before handoff. Runs as Gate 0 before ring:reviewing-code. Use to drive ONE task inside an…
ring:writing-skills
Writing or editing a Ring skill: SKILL.md structure, frontmatter and Agent-Search-Optimization rules, token-efficiency targets, and bulletproofing (Iron Law, rationalization tables, Red Flags) so discipline-enforcing skills resist excuses. Use when creating or revising a skill. Delegates pressure-testing to…
ring:verifying-code
Verifying a Go project: runs every quality check (lint, vet, imports, format, docs, unit, integration, E2E) and returns a single MERGEREADY or NEEDSFIX verdict. Report-only: never fixes anything. Use for a quick pre-merge or pre-PR check outside a full dev-cycle. Skip when not a Go project, when you want a single…