Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/systemfsoftware/comment-checker/comment-checker-setupnpx skills add systemfsoftware/comment-checker --skill comment-checker-setupgit clone --depth 1 https://github.com/systemfsoftware/comment-checkerWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00087 | $0.01843 |
| Opus 5 | $0.00044 | $0.00922 |
| Sonnet 5 | $0.00017 | $0.00369 |
| Haiku 4.5 | $0.00009 | $0.00184 |
Grade A, and why
comment-checker-setup scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 139 lines — stays where its author put it; the contents beside it link to each section on GitHub.
comment-checker-setup
Install and verify the comment-checker PostToolUse hook so every edit is checked. A hook that cannot resolve its binary checks nothing: it must either find comment-checker on PATH or reach it through the direnv bridge, and the whole chain must be proven with the bundled doctor, never by eyeballing a shell.
When to Activate
- id: A1
title: Activate on setup or repair intent
do: activate when the task is installing, wiring, or diagnosing the comment-checker hook, or when 'comment-checker did not run' appears on edits
dont: activate for comment-style feedback on code you are writing, or for generic hook debugging unrelated to comment-checker
check: the request names the hook, the binary, or the 'did not run' symptom
- id: A2
title: Boundary - do not activate for comment writing advice
do: for advice about which comments to write or remove, note that comment-checker itself (called as the hook) is the authority and stop
dont: apply this skill's setup workflow to comment-content questions
check: the ask is about wiring, not about a specific comment's merits
Workflow: provision and verify
- id: W1
title: Run the doctor first
do: run `./scripts/doctor.ts [project-dir]` from a clean environment (no ambient dev-shell PATH), and let its output drive the fix
dont: skip the doctor and hand-edit PATH or directories on suspicion; a resolution failure is traced, not guessed
check: the doctor exits 0, or each broken check carries a fix hint you applied
- id: W2
title: Resolve binary on PATH first
do: ensure `comment-checker` resolves on PATH (npm global install, or a dev shell that provides it); `command -v comment-checker` from a clean shell must print a path
dont: rely on a dev shell you are not provably inside; hook subprocesses do not inherit your interactive shell's direnv state
check: `env -i PATH=/usr/bin:/bin sh -c 'command -v comment-checker'` finds it, or the direnv bridge covers the gap
- id: W3
title: Wire the direnv bridge when the repo is flake-based
do: when the project has a flake.nix that provides the binary, add `.envrc` containing `use flake` and run `direnv allow`; the hook falls back to `direnv exec` when PATH misses
dont: stop at `direnv allow` -- a blocked .envrc loads nothing, so verify with `direnv exec . command -v comment-checker`
check: the doctor's direnv bridge check reports [ok]
- id: W4
title: Prove the exit-code contract
do: feed a restating-comment payload and a clean payload to the binary and assert exit 2 and exit 0 respectively (the doctor does this)
dont: accept 'the binary runs' as 'the hook works' -- presence is not the contract
check: the doctor's exit-code contract check reports [ok]
- id: W5
title: Name the real provider in the final report
do: state which provider the project uses (npm global, direnv+flake, or nix develop) and that the doctor verified it end-to-end
dont: leave the resolution mechanism implicit or report 'verified' without the doctor run
check: the report names the provider and cites the doctor exit code
What ships with it
5 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 139 lines · 0 tokens per session scan A 2adf28f66c44
comment-checker-setup is a skill published in the GitHub repository systemfsoftware/comment-checker (1 stars, last pushed 2d ago), licensed Apache-2.0. It adds 87 tokens to every session and 1,843 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
wakaru
Turn minified, bundled, or transpiled JavaScript back into readable modules. Use when you encounter unreadable production JS — a webpack/esbuild/Metro/Rollup bundle, a minified vendor script, Babel/TypeScript/SWC-transpiled output, or a single mangled .js file — and need to read, audit, debug it, or recover a…
flutter-app
Bootstrap a new Flutter mobile app with clean architecture, Riverpod, FVM-pinned SDK, current packages, and no deprecated APIs. Use when the user wants to start, scaffold, or set up a new Flutter app, a cross-platform mobile app, an Android or iOS app in Dart, or asks to "create a new flutter app". Handles BYOK LLM…
api-testing
HTTP API testing for TypeScript (Supertest) and Python (httpx, pytest). Test REST APIs, GraphQL, request/response validation, authentication, and error handling.
api-response-optimization
Optimizes API performance through payload reduction, caching strategies, and compression techniques. Use when improving API response times, reducing bandwidth usage, or implementing efficient caching.
market-pulse
Summarize what's moving in the market right now using the AlphaAI MCP. Use when the user asks "what's moving?", "what's the big story today?", "anything breaking?", "market pulse", or wants a fast read on the current tape rather than one specific ticker.
stock-brief
Produce a situational brief on a single stock/ticker — its recent high-relevance news, insider activity, and what to watch next — using the AlphaAI MCP. Use when the user asks to "brief me on ", "what's going on with ", "catch me up on NVDA", or wants a quick read on one name.