Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add tmj-90/gaffer --skill ruby-conventionsgit clone --depth 1 https://github.com/tmj-90/gafferWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/tmj-90/gaffer/ruby-conventions)<a href="https://agentmods.dev/skills/tmj-90/gaffer/ruby-conventions"><img src="https://agentmods.dev/badge/skills/tmj-90/gaffer/ruby-conventions/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/tmj-90/gaffer/ruby-conventions"><img src="https://agentmods.dev/badge/skills/tmj-90/gaffer/ruby-conventions.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00126 | $0.02122 |
| Opus 5.5 | $0.00050 | $0.00849 |
| Sonnet 5.5 | $0.00025 | $0.00424 |
| Haiku 4.5 | $0.00013 | $0.00212 |
Grade A, and why
ruby-conventions scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 16d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 126 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Write idiomatic Ruby (and Rails)
Ruby's expressiveness helps readers when objects are small, named well and follow the idioms the repo already uses; it hurts when metaprogramming hides behaviour or Rails conventions are fought. For the builder and the reviewer of a Ruby diff; the repo's config and existing code win over it.
Procedure
- Discover the repo's conventions first. Call
search_lorefor Ruby conventions. Read.ruby-version/.tool-versions,GemfileandGemfile.lock,.rubocop.yml(andinherit_from/inherit_gem: Standard,rubocop-rails-omakase, a.rubocop_todo.yml),.standard.yml, type tooling (sorbet/,sig/for RBS),.rspecortest/,config/application.rb(load_defaults), the job adapter and the CI workflow. Identify the service/query/form object patterns and factories. Copy a sibling class and its spec. - Pin the exact commands from CI or
bin/scripts (therun-testsandrun-lintskills). Use the defaults below only when the repo defines none. Never add offences to.rubocop_todo.ymlto pass. - Write the change with the idioms below, then walk the concurrency section for every shared object, record update, job, file and outbound call you touched.
- Test each acceptance criterion's own behaviour. One request/model/job spec (or
Minitest test) per AC that fails without your change, plus its error path. If the AC
involves shared state or persistence, add a test that runs N threads against it (each
with its own connection via
ActiveRecord::Base.connection_pool.with_connection, and transactional fixtures disabled for that test) and asserts the invariant. - Verify, then stop. Done when: RuboCop/Standard is clean, the suite is green, a new
migration migrates and rolls back, and every AC has a test. Record the output with the
record-evidenceskill; the runner submits the work.
Commands
- Gems are already installed; never run
bundle install/bundle update/bundle add(installs need human approval; the hook does not catch these, the rule still holds). A missing gem goes in the evidence. - Lint:
bundle exec rubocop(orbin/rubocop,bundle exec standardrb). - Tests:
bundle exec rspec(one:bundle exec rspec spec/x_spec.rb:42) orbin/rails test(one:bin/rails test test/x_test.rb:42). - Migrations:
bin/rails db:migratethenbin/rails db:rollbackand migrate again, only against the local development/test database; with none reachable, say so in the evidence. - Security and types where configured:
bundle exec brakeman,bundle exec bundle-audit check,bundle exec srb tcorbundle exec steep check.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 16d ago Changed · +53 lines · +17 tokens per session c7259907ba82
- 19d ago First seen · 73 lines · 109 tokens per session scan A cfeff52baaff
ruby-conventions is a skill published in the GitHub repository tmj-90/gaffer (2 stars, last pushed 17d ago), licensed Apache-2.0. It adds 126 tokens to every session and 2,122 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-28.
Other skills, from other repositories
sota-ruby
State-of-the-art Ruby engineering rules (supported Ruby releases) that Claude applies when writing or auditing Ruby. Covers modern idioms (frozen string literals, pattern matching, Data/Struct, RBS/Sorbet/Steep typing), security (SQL injection via ActiveRecord/Sequel, ERB/XSS escaping, mass assignment, CSRF…
rubyllm
Build and maintain Ruby or Rails applications with the RubyLLM AI framework. Use for chats, agents, tools, MCP servers, structured output, judgments, evaluations, media generation, transcription, OCR, moderation, embeddings, reranking, tracing, Rails integration, and RubyLLM upgrades; not for contributing to the…
dspy-ruby
This skill should be used when working with DSPy.rb, a Ruby framework for building type-safe, composable LLM applications. Use this when implementing predictable AI features, creating LLM signatures and modules, configuring language model providers (OpenAI, Anthropic, Gemini, Ollama), building agent systems with…
dhh-rails-style
This skill should be used when writing Ruby and Rails code in DHH's distinctive 37signals style. It applies when writing Ruby code, Rails applications, creating models, controllers, or any Ruby file. Triggers on Ruby/Rails code generation, refactoring requests, code review, or when the user mentions DHH, 37signals…
andrew-kane-gem-writer
This skill should be used when writing Ruby gems following Andrew Kane's proven patterns and philosophy. It applies when creating new Ruby gems, refactoring existing gems, designing gem APIs, or when clean, minimal, production-ready Ruby library code is needed. Triggers on requests like "create a gem", "write a Ruby…
ruby-patterns
Ruby/Rails: blocks, metaprogramming, ActiveRecord, Sidekiq, RSpec, Sorbet, Hanami. Triggers: Ruby, Rails, ActiveRecord, Sidekiq, RSpec, Gemfile, bundler, Hanami, Sorbet.