Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/tdwhere123/do-it/do-it-code-qualitynpx skills add tdwhere123/do-it --skill do-it-code-qualitygit clone --depth 1 https://github.com/tdwhere123/do-itWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00042 | $0.01371 |
| Opus 5 | $0.00021 | $0.00685 |
| Sonnet 5 | $0.00008 | $0.00274 |
| Haiku 4.5 | $0.00004 | $0.00137 |
Grade A, and why
do-it-code-quality scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 109 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Do-It Code Quality
Main defense while writing. Prefer depth, locality, and real feedback over ceremony.
Leading words (use them): deep module, seam, tracer bullet, red before green, scope chain, phases, not piles, reuse before repeat.
Scope Chain (before edit)
- Premise — one sentence: if this fact is wrong, the change is wrong.
- Blast radius — who breaks (callers, live paths, tests, persistence).
- Bounded chain — producer → contract → transport → state → surface → verify. Do not tour the whole repo.
- Targeted reads — locate the symbol or section first, then read that range. Whole-file reads on files over ~500 lines / 30 KB burn context and blur the chain. Read before claiming how the system works (
core §r-evidence).
Detail: ../references/scope-chain.md.
Deep Modules
Prefer deep modules: small interface, rich implementation, at a clean seam (Feathers).
| Term | Meaning |
|---|---|
| Depth | Behavior callable per unit of interface the caller must learn |
| Leverage | Callers get more capability per learned interface |
| Locality | Change/bugs/verification concentrate in one place |
| Adapter | Concrete thing that satisfies an interface at a seam |
- Deletion test: remove the module — if complexity vanishes, it was a pass-through; if it reappears across N callers, it earned its keep.
- One adapter = hypothetical seam; two adapters = real seam. No speculative seams.
- Interface is the test surface. Accept dependencies; do not construct them inside.
- Inline / delete thin wrappers and Phase-2 scaffolding.
Phases, Not Piles
Separate compute → apply → audit: computation, persistence/DB access, and event/log side effects each get their own phase. A function that mixes them is a split candidate before you extend it. One reason to change per module, class, and function.
Reuse before repeat: if the rule, transform, or contract already exists, extend or call it — never fork a second home for the same truth.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 109 lines · 42 tokens per session scan A e4dda099d9ed
do-it-code-quality is a skill published in the GitHub repository tdwhere123/do-it (27 stars, last pushed 21d ago), licensed MIT. It adds 42 tokens to every session and 1,371 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
agent-implementer-sparc-coder
Agent skill for implementer-sparc-coder - invoke with $agent-implementer-sparc-coder.
dpf-tdd
Use for DPF test-first work. Write the failing behavior test first, make it green, refactor, then run the functional gate; never claim an unrun test passed.
agent-crdt-synchronizer
Agent skill for crdt-synchronizer - invoke with $agent-crdt-synchronizer.
agent-release-manager
Agent skill for release-manager - invoke with $agent-release-manager.
agent-release-swarm
Agent skill for release-swarm - invoke with $agent-release-swarm.
agent-repo-architect
Agent skill for repo-architect - invoke with $agent-repo-architect.