evaluate-findings

evaluate-findings is a skill for Claude Code, Codex from tobihagemann/turbo. It costs 63 tokens per session (3,567 once invoked), scanned A, original, MIT.

A review-triage workflow for checking outside feedback such as code reviews, AI findings, and pull-request comments.

In plain words
What is it for?
Use it to assess review findings, decide which suggestions to apply, skip, or escalate, and record the reasoning without changing the code.
Why use it?
It helps distinguish real problems from false positives by verifying each suggestion against the code before any fix is made.

Skill for Claude CodeCodex

Written for no agent in particular: nothing here depends on one. Also seen: mentions subagents.

Good fit Use it to assess review findings, decide which suggestions to apply, skip, or escalate, and record the reasoning without changing the code.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/tobihagemann/turbo/evaluate-findings
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add tobihagemann/turbo --skill evaluate-findings
Clone the repo
git clone --depth 1 https://github.com/tobihagemann/turbo

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for evaluate-findings

README.md
[![agentmods](https://agentmods.dev/badge/skills/tobihagemann/turbo/evaluate-findings/github.svg)](https://agentmods.dev/skills/tobihagemann/turbo/evaluate-findings)
Your own site
<a href="https://agentmods.dev/skills/tobihagemann/turbo/evaluate-findings"><img src="https://agentmods.dev/badge/skills/tobihagemann/turbo/evaluate-findings/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for evaluate-findings

Your own site · 80×15
<a href="https://agentmods.dev/skills/tobihagemann/turbo/evaluate-findings"><img src="https://agentmods.dev/badge/skills/tobihagemann/turbo/evaluate-findings.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 63 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 3,567 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits
  • NVIDIA SkillSpector pass 7 Sept 2026
How audits are shown
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00063 $0.03567
Opus 5 $0.00032 $0.01784
Sonnet 5 $0.00013 $0.00713
Haiku 4.5 $0.00006 $0.00357

Measured yesterday against content hash 9cb9fad96df4, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-11, from the pricing page.

Security

Grade A, and why

evaluate-findings scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

claude/skills/evaluate-findings/SKILL.md · 149 lines

How it starts

The opening of the file, as written. The whole thing — 149 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Evaluate Findings

Assess external feedback (code reviews, AI suggestions, PR comments) with adversarial verification. Triage findings into actionable verdicts. Do not apply fixes.

Step 1: Assess Each Finding

If you already assessed a finding earlier in this session and recorded a verdict of Skip or Escalate — for example when an iterating loop re-runs review and the same finding resurfaces — do not re-adjudicate it from scratch. When the re-reported finding matches one you already judged (same location and substance) and presents no new evidence beyond what your recorded reason already accounts for, keep that verdict and reason without re-reading the code, re-verifying, or routing it to the Devil's Advocate in Step 2. Assess fresh only when the finding raises materially new evidence, or when you have not judged it before in this session.

When several findings rest on a shared premise — for example a source-of-truth choice — verify that premise once before adjudicating them individually. Findings whose premise holds proceed through normal per-finding verification; when it fails, they are all Skip, citing the refuted premise.

When a plan governs the work, re-read the decisions it records before adjudicating. Having read it earlier in the session does not count: once it falls out of context, a recorded decision is indistinguishable from no decision at all.

For each finding:

  1. Read the referenced code at the mentioned location — include the full function or logical block, not just the flagged line
  2. Check whether the code has diverged — if the finding references code that no longer exists or has since changed, skip it and note the divergence.
  3. Determine scope — clarify whether the issue was introduced by the PR/changeset or is pre-existing.
    • Pre-existing issues in earlier commits on the same feature branch are in-scope by default — the entire branch is one coherent unit of work. Judge these on their merits like any in-scope finding.
    • Findings genuinely outside the branch's work are the user's call to include. Assign Escalate so the user decides whether to widen the changeset. Reserve Skip for changes whose cost wildly dwarfs the benefit.
  4. Verify the claim against the actual code — does the issue genuinely exist?
    • When the finding offers a concrete example as evidence — a claimed mishandled input, a claimed wrong output — verify that example independently: a finding can hold in substance while its example does not. Keep the finding and record the correction beside it; drop it only when the claim rests on that example alone.
    • When the finding asserts a compatibility property, establish two things before assigning Apply: what the existing check actually enforces, and what real counterparts produce today. A claim stronger than the check enforces is a premise error rather than a defect — Skip, citing what the check enforces, or narrow the finding to the property it does enforce and record the narrowing beside it. When neither can be established from the code, the artifacts, or authoritative documentation, keep the finding Escalate.
    • When the finding cites a rule or convention, read the cited text, then look for a place that already applied it before this changeset — the same file, or the nearest files the rule also governs. Where the text alone leaves the reading open, read the rule the way that application reads it; where no such application exists, judge on the text alone.
    • When the finding rests on a premise that reading the source cannot settle — what a platform API returns at runtime, or what a value measures once the system runs — establish that premise before assigning Apply, using a targeted search or count over the source, or a measurement from a surface already running in this session. A premise of this kind reads as sound whether or not it holds, so confidence in the finding is no substitute. When nothing available settles it, keep the finding Escalate, naming the unverified premise.
  5. Assess severity:

Read the full file on GitHub · 149 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday Changed · +1 lines 9cb9fad96df4
  2. 4d ago Changed · +1 lines c3f7c8d12bbd
  3. 8d ago Changed · +2 lines b7b492818664
  4. 12d ago First seen · 145 lines · 63 tokens per session scan A fcbda7a125fb

Subscribe to this mod's changes

evaluate-findings is a skill published in the GitHub repository tobihagemann/turbo (402 stars, last pushed 2d ago), licensed MIT. It adds 63 tokens to every session and 3,567 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

agentic-review

Deep multi-agent code review for local changes. Inspired by AmpCode's agentic review. Use when you want comprehensive analysis of staged changes, unstaged changes, specific commits, or branch differences. Spawns parallel specialized agents (security, performance, patterns, architecture) and synthesizes actionable…

SZoloth/skill-pack · 71 tokens

qa

Full QA on all session changes using Codex as a second pair of eyes. Use when user says "QA", "full QA", "QA my changes", "QA all your changes", or "use codex to review". Runs git diff, sends changes to Codex for thorough review, and synthesizes findings.

SZoloth/skill-pack · 66 tokens

refactor-advisor

A code review helper that finds common design and maintenance problems in a codebase and suggests ways to restructure the code.

laolaoshiren/claude-code-skills-zh · 22 tokens

zh-code-reviewer

A Chinese-language code-review specialist that produces a structured review report. It examines coding style, possible bugs, performance, security, and design choices.

laolaoshiren/claude-code-skills-zh · 20 tokens

review-implementing

Process and implement code review feedback systematically. Use when user provides reviewer comments, PR feedback, code review notes, or asks to implement suggestions from reviews.

mhattingpete/claude-skills-marketplace · 35 tokens

code-auditor

Performs comprehensive codebase analysis covering architecture, code quality, security, performance, testing, and maintainability. Use when user wants to audit code quality, identify technical debt, find security issues, assess test coverage, or get a codebase health check.

mhattingpete/claude-skills-marketplace · 56 tokens