Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add tobihagemann/turbo --skill resolve-findingsgit clone --depth 1 https://github.com/tobihagemann/turboWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/tobihagemann/turbo/resolve-findings)<a href="https://agentmods.dev/skills/tobihagemann/turbo/resolve-findings"><img src="https://agentmods.dev/badge/skills/tobihagemann/turbo/resolve-findings/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/tobihagemann/turbo/resolve-findings"><img src="https://agentmods.dev/badge/skills/tobihagemann/turbo/resolve-findings.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Rogue Agent · line 12 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00072 | $0.00410 |
| Opus 5 | $0.00036 | $0.00205 |
| Sonnet 5 | $0.00014 | $0.00082 |
| Haiku 4.5 | $0.00007 | $0.00041 |
Grade A, and why
resolve-findings scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Resolve Findings
Choose a path for evaluated findings and run it. Direct path applies fixes directly; plan path runs /turboplan.
Task Tracking
At the start, use TaskCreate to create a task for each step:
- Choose path
- Run the chosen path
Step 1: Choose Path
Present a summary of accepted findings (Apply verdict): count by complexity (mechanical fixes vs. architectural or design changes). Then use AskUserQuestion to let the user choose:
- Plan — Run
/turboplanfor drafting, refinement, approval, implementation, and finalize - Direct — Run
/apply-findings, then close out the change
Suggest Plan when findings include complex or architectural changes. Suggest Direct when all findings are mechanical fixes.
Add a Get a second opinion option whenever the findings would establish a pattern others will follow, change an interface, or commit to a data shape, and whenever neither path earns the suggestion with conviction. It runs the /consult-codex skill for which path the findings warrant on technical merit. Then resolve the path with that answer in hand, re-asking when the choice stays the user's.
Step 2: Run the Chosen Path
Read the reference file for the confirmed path and follow its phases:
- Direct path — references/direct-path.md
- Plan path — references/plan-path.md
State the chosen path before continuing with the reference file.
Then use the TaskList tool and proceed to any remaining task.
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago Changed 199c3436327f
- 12d ago First seen · 38 lines · 72 tokens per session scan A aba4adcbe520
resolve-findings is a skill published in the GitHub repository tobihagemann/turbo (402 stars, last pushed 3d ago), licensed MIT. It adds 72 tokens to every session and 410 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
agentic-review
Deep multi-agent code review for local changes. Inspired by AmpCode's agentic review. Use when you want comprehensive analysis of staged changes, unstaged changes, specific commits, or branch differences. Spawns parallel specialized agents (security, performance, patterns, architecture) and synthesizes actionable…
qa
Full QA on all session changes using Codex as a second pair of eyes. Use when user says "QA", "full QA", "QA my changes", "QA all your changes", or "use codex to review". Runs git diff, sends changes to Codex for thorough review, and synthesizes findings.
refactor-advisor
A code review helper that finds common design and maintenance problems in a codebase and suggests ways to restructure the code.
zh-code-reviewer
A Chinese-language code-review specialist that produces a structured review report. It examines coding style, possible bugs, performance, security, and design choices.
review-implementing
Process and implement code review feedback systematically. Use when user provides reviewer comments, PR feedback, code review notes, or asks to implement suggestions from reviews.
code-auditor
Performs comprehensive codebase analysis covering architecture, code quality, security, performance, testing, and maintainability. Use when user wants to audit code quality, identify technical debt, find security issues, assess test coverage, or get a codebase health check.