Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add tobihagemann/turbo --skill polish-codegit clone --depth 1 https://github.com/tobihagemann/turboWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/tobihagemann/turbo/polish-code)<a href="https://agentmods.dev/skills/tobihagemann/turbo/polish-code"><img src="https://agentmods.dev/badge/skills/tobihagemann/turbo/polish-code/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/tobihagemann/turbo/polish-code"><img src="https://agentmods.dev/badge/skills/tobihagemann/turbo/polish-code.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Rogue Agent · line 10 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00067 | $0.04818 |
| Opus 5.5 | $0.00027 | $0.01927 |
| Sonnet 5.5 | $0.00013 | $0.00964 |
| Haiku 4.5 | $0.00007 | $0.00482 |
Grade A, and why
polish-code scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 138 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Polish Code
Task Tracking
At the start of every invocation (including re-runs from Step 7), use TaskCreate to create a task for each step:
- Run
/stageskill - Run
/run-checksskill - Run
/review-codeskill - Run
/evaluate-findingsskill - Run
/apply-findingsskill - Run
/smoke-testskill - Re-run
/polish-codeskill if changed
Step 1: Run /stage Skill
Run the /stage skill.
Step 2: Run /run-checks Skill
Run the /run-checks skill.
Stage all changes made in this step before continuing.
Step 3: Run /review-code Skill
Run the /review-code skill on the staged changes. The diff command is git diff --cached.
Step 4: Run /evaluate-findings Skill
Run the /evaluate-findings skill on the results from Step 3.
Step 5: Run /apply-findings Skill
Record the staged tree with git write-tree before applying anything, and use TaskUpdate to add the tree ID it prints to this run's Step 7 task description.
Run the /apply-findings skill on the evaluated results.
When a defect this run fixes, in this step or in Step 6, is a further instance of a class of defect an earlier iteration already fixed, stop patching the individual instance and instead encode the root-cause invariant structurally — a shared guard or type, or a regression test that pins the class against the worked failures it must prevent. For a finding, make that the fix /apply-findings applies for it, so that skill's checks run on it. Recognize a class by its failure and what triggers it, so a further instance in another function or file counts as the class recurring. Count a defect that swings to the opposite failure after its fix, such as a check found too strict in one round and too lax in the next, as the same class recurring. In the same pass, audit the existing code against the newly encoded invariant and fix every instance it catches, including code written before it existed. When the recurring instance sits in code outside the changeset and so reaches the user as an escalated finding, make the invariant and that audit the remedy offered for it, with a fix to the individual instance as the narrower alternative. Treat recurrence on a new axis of the same invariant as a signal that the invariant is incomplete: widen it to cover the new axis rather than assuming the latest fix failed.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago Changed 37080d5802fc
- 6d ago Changed 39b76e42c2e5
- 16d ago Changed bd665dd466f0
- 17d ago Changed · +3 lines 3ff7adf8b91e
- 19d ago Changed 3757535a224e
- 20d ago Changed · +2 lines d8e8be622f21
- 21d ago Changed 6843090f0fa7
- 22d ago Changed c1199c923d35
- 25d ago Changed 878899a0685b
- 27d ago First seen · 133 lines · 67 tokens per session scan A 85d29e4a7cfe
polish-code is a skill published in the GitHub repository tobihagemann/turbo (416 stars, last pushed 2d ago), licensed MIT. It adds 67 tokens to every session and 4,818 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
doubt-driven-development
Subjects every non-trivial decision to a fresh-context adversarial review before it stands. Use when you want every assumption cross-examined before proceeding, when stress-testing a plan for hidden failure modes, when correctness matters more than speed, when working in unfamiliar code, when stakes are high…
check
Reviews diffs, PRs, release readiness, and publishing follow-through. Use when asked to review, triage issues or PRs, or ship. Not for debugging root causes or prose.
ego-lite-simplify
Find and implement evidence-backed simplifications in the ego-lite repository. Use when reviewing the codebase for dead code, duplicated state or APIs, speculative abstractions, unnecessary compatibility layers, hand-written infrastructure, excessive tests or documentation, or when the user asks to reduce code size or…
audit
Project health audit and health check — architecture, performance, tests, dependencies, code quality. Use when assessing overall project health, before releases, or after refactors.
code-review-web
Review web application code for bugs, security issues, performance problems, and stack-specific anti-patterns. Use this skill whenever the user wants to review code, debug a production issue, investigate a build failure, audit security, or check a PR before merging. Triggers on code review, review my code, debug…
code-assessment
Detect, review, and fix code-quality and correctness issues in an AEM as a Cloud Service project — locally, with no external services or network calls. Use whenever a user wants to check, review, assess, audit, scan, modernize, upgrade, or fix AEM Java, Sling Models, OSGi, or Maven code — for example: "check my Sling…