Getting it into your agent
This one installs as part of its plugin. Adding the marketplace and installing the plugin brings it with everything else the plugin ships.
/plugin marketplace add UiPath/coder_eval/plugin install coder-evalWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/uipath/coder_eval/ci)<a href="https://agentmods.dev/skills/uipath/coder_eval/ci"><img src="https://agentmods.dev/badge/skills/uipath/coder_eval/ci/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/uipath/coder_eval/ci"><img src="https://agentmods.dev/badge/skills/uipath/coder_eval/ci.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00045 | $0.02501 |
| Opus 5.5 | $0.00018 | $0.01000 |
| Sonnet 5.5 | $0.00009 | $0.00500 |
| Haiku 4.5 | $0.00005 | $0.00250 |
Grade A, and why
ci scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 232 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Wire coder-eval into GitHub Actions
The user's request is: $ARGUMENTS
Step 1 — Check the repository
Find the repository's task tree by following
${CLAUDE_PLUGIN_ROOT}/reference/repo-layout.md, and check whether .github/workflows/
exists. The paths you resolve here become args: entries in the workflow in step 3 — that
input is written from discovery, never from a fixed guess.
If there is no .github/ directory at all, say that this skill targets GitHub Actions
and stop — do not invent an equivalent for another CI system unless the user asks.
If a workflow already runs coder-eval (grep the workflows for coder_eval), do not add a
second one. Show what is there and offer to update it.
Step 2 — Choose the trigger
Ask, or infer from the request:
- On pull request — gate changes to the tasks or to whatever they exercise.
- On a schedule — the skill-drift case: re-run the suite weekly against the current model so a skill that quietly stops triggering surfaces before users hit it. This is the trigger most repositories actually want, and the one they forget. If the suite is an activation suite, the environment note in step 3 is not optional for this trigger — without it the scheduled run reports total drift every week regardless of whether anything drifted.
- Both, which is fine — one workflow, two
on:keys.
Step 3 — Emit the workflow
The composite action installs the coder-eval CLI and nothing else: it is
agent-agnostic and installs no coding-agent runtime. A task using the default
claude-code agent therefore needs Node plus the Claude CLI provided by the job first,
or the run dies on a missing claude binary. There is no Marketplace install step for
the action itself, but those two prerequisite steps are not optional.
name: Coder Eval
on:
pull_request:
schedule:
- cron: "0 6 * * 1" # Mondays 06:00 UTC — catches model/skill drift
# Least privilege: this job runs agent-generated code, so it gets no write scope.
permissions:
contents: read
jobs:
eval:
runs-on: ubuntu-latest
timeout-minutes: 30
steps:
- uses: actions/checkout@v6
with:
# Do not leave a credentialed .git/config in a workspace where
# agent-generated code runs.
persist-credentials: false
# The action installs no coding-agent runtime — provide it here.
- uses: actions/setup-node@v4
with:
node-version: "20"
- run: npm install -g @anthropic-ai/claude-code
- id: eval
uses: UiPath/coder_eval@v0
with:
run-dir: runs/ci
args: |
tasks/**/*.yaml
--model
claude-haiku-4-5-20251001
env: |
ANTHROPIC_API_KEY=${{ secrets.ANTHROPIC_API_KEY }}
- if: always()
run: cat "${{ steps.eval.outputs.run-md-path }}" >> "$GITHUB_STEP_SUMMARY"
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · -2 lines 66e5a28b678d
- 1mo ago First seen · 234 lines · 45 tokens per session scan A 7ead73404028
ci is a skill published in the GitHub repository UiPath/coder_eval (151 stars, last pushed today), licensed Apache-2.0. It adds 45 tokens to every session and 2,501 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
mcore-create-issue
Investigate a failing GitHub Actions run or job and create a GitHub issue for the failure.
ci-cd-pipeline-authoring
Use when a repository needs CI/CD - author GitHub Actions workflows so TaskTrooper's pipeline auto-detects your validate/build/test jobs and stage/preprod/prod deploys, and so a dispatch delivery profile can dispatch the production deploy.
data-pipeline-orchestration
Use when adding or changing a scheduled data or ML pipeline — Dagster assets, Prefect flows, Airflow DAGs or a cron'd entrypoint — idempotent partitioned stages, retries, backfills, quality gates, and testing the pipeline without the scheduler.
e2e-automation-project
Maintain a dedicated automation test project per repository - separate from the product's unit tests - with API, worker, and UI suites written scenario-first.
app-store-deploy
Use when a mobile app needs a release pipeline - fastlane GitHub Actions to TestFlight (iOS) and Play internal track (Android), with code signing and the release naming that maps to TaskTrooper's prod deploy.
cloud-deploy-gcp-aws
Use when a backend or worker service needs a cloud deploy - container-first GitHub Actions deploys to Google Cloud Run (WIF) or AWS ECS/App Runner (OIDC), with migrate-before-deploy and a health-check gate.