Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add tmj-90/gaffer --skill submit-reviewgit clone --depth 1 https://github.com/tmj-90/gafferWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/tmj-90/gaffer/submit-review)<a href="https://agentmods.dev/skills/tmj-90/gaffer/submit-review"><img src="https://agentmods.dev/badge/skills/tmj-90/gaffer/submit-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/tmj-90/gaffer/submit-review"><img src="https://agentmods.dev/badge/skills/tmj-90/gaffer/submit-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00105 | $0.01135 |
| Opus 5.5 | $0.00042 | $0.00454 |
| Sonnet 5.5 | $0.00021 | $0.00227 |
| Haiku 4.5 | $0.00011 | $0.00113 |
Grade A, and why
submit-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 22d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 79 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Handing a ticket to review (runner-owned)
You do not submit your own work. In the Gaffer factory the runner owns delivery
bookkeeping: after your run it applies the gates (tests, lint, hygiene, minimalism),
records the delivery, moves the ticket to in_review, and — only when the operator has
enabled PR creation (GAFFER_CREATE_PR=1, off by default) — pushes the branch and opens
a PR. Submission is deterministic and happens only once the gates
are green. Your job ends at a clean commit plus true evidence.
A ticket that reaches review with an AC that no test exercises, or with a test that never
reaches the AC's own path, comes straight back — the reviewer maps every AC to a test
(the review-ticket skill). Check that before you stop.
What YOU do (then stop)
- Confirm self-review is done. The
self-reviewskill has been run on the final diff: every AC maps to a hunk and a test that exercises its own behaviour (AC <id> → <test file>::<test name>), and the smallest-change line is recorded. - Confirm the gates are green in this session, on the final diff: tests
(
run-tests), lint (run-lint), and any coverage threshold the ticket requires (run-coverage). Fix anything red; never hand over stale green. - Commit on the ticket branch. Run
git status --porcelainand make sure only intended files are staged — no build output, coverage reports, temp or lock files, editor files, or anything secret-shaped. Then commit with a message referencing the ticket, as the brief specifies:git add -A && git commit -m "deliver #<n>: <summary>". An uncommitted edit is not a delivery. The runner auto-commits leftovers as a safety net, but that commit carries whatever is in the tree — commit yourself. - Evidence every AC with the
record-evidenceskill: callget_ticket(Dispatch MCP), then onerecord_ac_evidenceper AC with a true summary — the command you ran, the test name that proves the AC, the result. Evidence must describe what you actually ran in this session. - Stop. Do not push, open a PR, or call
submit_ticket_for_review. If you cannot finish (an open question, a missing dependency, a broken environment), callmark_ticket_blockedwith a clear reason instead of leaving half-done work. (On a resumed delivery both calls are refused — follow the resume note inrecord-evidence.)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 22d ago Changed · +26 lines · +10 tokens per session d69abdf9917d
- 1mo ago First seen · 53 lines · 95 tokens per session scan A 5825d3774e42
submit-review is a skill published in the GitHub repository tmj-90/gaffer (2 stars, last pushed 23d ago), licensed Apache-2.0. It adds 105 tokens to every session and 1,135 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
dedup
Dedupe-only pass for BASESHA..HEAD: remove duplicate code introduced by the diff or reuse existing shared utils; applies changes + commits.
plan-critique-loop
Critique and revise an existing plan doc up to 3 iterations, using accept/reject triage and stopping early when no important feedback remains. Use when refining a plan/.md before implementation.
code-review-loop
Iterative review+fix loop for BASESHA..HEAD: generate findings, apply accepted fixes, run checks, commit, and re-review up to 3 iterations or until clean.
besimple-tiny-broccoli
Small-change wrapper: implement → run repo checks → atomic commit → run dedup (BASESHA..HEAD).
claude-simplify-wrapper
Run Claude's built-in /simplify skill on BASESHA..HEAD, validate checks, and commit.
cc-autopilot
Run cc-autopilot, a perpetual autonomous AUDIT/GENERATE→TRIAGE→BATCH→FIX→VERIFY→REVIEW→COMMIT loop that holds every change to a configured quality bar through a judge panel. Its fixers each own a file-disjoint slice of the tree so no two can ever touch the same file, and nothing unverified reaches git. Works on a web…