Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add tobihagemann/turbo --skill evaluate-findingsgit clone --depth 1 https://github.com/tobihagemann/turboWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/tobihagemann/turbo/evaluate-findings)<a href="https://agentmods.dev/skills/tobihagemann/turbo/evaluate-findings"><img src="https://agentmods.dev/badge/skills/tobihagemann/turbo/evaluate-findings/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/tobihagemann/turbo/evaluate-findings"><img src="https://agentmods.dev/badge/skills/tobihagemann/turbo/evaluate-findings.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00063 | $0.03567 |
| Opus 5 | $0.00032 | $0.01784 |
| Sonnet 5 | $0.00013 | $0.00713 |
| Haiku 4.5 | $0.00006 | $0.00357 |
Grade A, and why
evaluate-findings scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 149 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Evaluate Findings
Assess external feedback (code reviews, AI suggestions, PR comments) with adversarial verification. Triage findings into actionable verdicts. Do not apply fixes.
Step 1: Assess Each Finding
If you already assessed a finding earlier in this session and recorded a verdict of Skip or Escalate — for example when an iterating loop re-runs review and the same finding resurfaces — do not re-adjudicate it from scratch. When the re-reported finding matches one you already judged (same location and substance) and presents no new evidence beyond what your recorded reason already accounts for, keep that verdict and reason without re-reading the code, re-verifying, or routing it to the Devil's Advocate in Step 2. Assess fresh only when the finding raises materially new evidence, or when you have not judged it before in this session.
When several findings rest on a shared premise — for example a source-of-truth choice — verify that premise once before adjudicating them individually. Findings whose premise holds proceed through normal per-finding verification; when it fails, they are all Skip, citing the refuted premise.
When a plan governs the work, re-read the decisions it records before adjudicating. Having read it earlier in the session does not count: once it falls out of context, a recorded decision is indistinguishable from no decision at all.
For each finding:
- Read the referenced code at the mentioned location — include the full function or logical block, not just the flagged line
- Check whether the code has diverged — if the finding references code that no longer exists or has since changed, skip it and note the divergence.
- Determine scope — clarify whether the issue was introduced by the PR/changeset or is pre-existing.
- Pre-existing issues in earlier commits on the same feature branch are in-scope by default — the entire branch is one coherent unit of work. Judge these on their merits like any in-scope finding.
- Findings genuinely outside the branch's work are the user's call to include. Assign Escalate so the user decides whether to widen the changeset. Reserve Skip for changes whose cost wildly dwarfs the benefit.
- Verify the claim against the actual code — does the issue genuinely exist?
- When the finding offers a concrete example as evidence — a claimed mishandled input, a claimed wrong output — verify that example independently: a finding can hold in substance while its example does not. Keep the finding and record the correction beside it; drop it only when the claim rests on that example alone.
- When the finding asserts a compatibility property, establish two things before assigning Apply: what the existing check actually enforces, and what real counterparts produce today. A claim stronger than the check enforces is a premise error rather than a defect — Skip, citing what the check enforces, or narrow the finding to the property it does enforce and record the narrowing beside it. When neither can be established from the code, the artifacts, or authoritative documentation, keep the finding Escalate.
- When the finding cites a rule or convention, read the cited text, then look for a place that already applied it before this changeset — the same file, or the nearest files the rule also governs. Where the text alone leaves the reading open, read the rule the way that application reads it; where no such application exists, judge on the text alone.
- When the finding rests on a premise that reading the source cannot settle — what a platform API returns at runtime, or what a value measures once the system runs — establish that premise before assigning Apply, using a targeted search or count over the source, or a measurement from a surface already running in this session. A premise of this kind reads as sound whether or not it holds, so confidence in the finding is no substitute. When nothing available settles it, keep the finding Escalate, naming the unverified premise.
- Assess severity:
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday Changed · +1 lines 9cb9fad96df4
- 4d ago Changed · +1 lines c3f7c8d12bbd
- 8d ago Changed · +2 lines b7b492818664
- 12d ago First seen · 145 lines · 63 tokens per session scan A fcbda7a125fb
evaluate-findings is a skill published in the GitHub repository tobihagemann/turbo (402 stars, last pushed 2d ago), licensed MIT. It adds 63 tokens to every session and 3,567 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
agentic-review
Deep multi-agent code review for local changes. Inspired by AmpCode's agentic review. Use when you want comprehensive analysis of staged changes, unstaged changes, specific commits, or branch differences. Spawns parallel specialized agents (security, performance, patterns, architecture) and synthesizes actionable…
qa
Full QA on all session changes using Codex as a second pair of eyes. Use when user says "QA", "full QA", "QA my changes", "QA all your changes", or "use codex to review". Runs git diff, sends changes to Codex for thorough review, and synthesizes findings.
refactor-advisor
A code review helper that finds common design and maintenance problems in a codebase and suggests ways to restructure the code.
zh-code-reviewer
A Chinese-language code-review specialist that produces a structured review report. It examines coding style, possible bugs, performance, security, and design choices.
review-implementing
Process and implement code review feedback systematically. Use when user provides reviewer comments, PR feedback, code review notes, or asks to implement suggestions from reviews.
code-auditor
Performs comprehensive codebase analysis covering architecture, code quality, security, performance, testing, and maintainability. Use when user wants to audit code quality, identify technical debt, find security issues, assess test coverage, or get a codebase health check.