Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add xzawed/claude-grok-build-plugin --skill maintainer-preflightgit clone --depth 1 https://github.com/xzawed/claude-grok-build-pluginWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/xzawed/claude-grok-build-plugin/maintainer-preflight)<a href="https://agentmods.dev/skills/xzawed/claude-grok-build-plugin/maintainer-preflight"><img src="https://agentmods.dev/badge/skills/xzawed/claude-grok-build-plugin/maintainer-preflight/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/xzawed/claude-grok-build-plugin/maintainer-preflight"><img src="https://agentmods.dev/badge/skills/xzawed/claude-grok-build-plugin/maintainer-preflight.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00061 | $0.01599 |
| Opus 5 | $0.00030 | $0.00800 |
| Sonnet 5 | $0.00012 | $0.00320 |
| Haiku 4.5 | $0.00006 | $0.00160 |
Grade A, and why
maintainer-preflight scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 136 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Maintainer preflight (claude-grok-build-plugin)
Run these before saying done. Evidence, not vibes.
A code fix also needs a Grok second opinion before done — the adversarial pass is step 5 of
"작업 수행 방법" in root CLAUDE.md, which owns the recipe (a review prompt that asks only for
prose never terminates). Read its verdict.md yourself, and verify any finding by measurement
before acting on it.
Always
cd mcp-server
npm ci # missing OR possibly-stale node_modules — see below
npm test
npm run typecheck
Both must pass. Report the real counts from this session's run — never summarize a run you did not execute.
npm ci is not only for a missing node_modules. A tree that is merely stale is worse
than a missing one, because the build succeeds and silently ships the wrong dependency. Measured
2026-08-09: node_modules held fast-uri 3.1.4 while the lockfile pinned 3.1.5, and
npm run build produced a dist/index.js with the v0.2.6 security patch (GHSA-7p8r-x3mc-p8w7)
removed — a clean-looking rebuild that reverted a shipped fix. Cheap check before trusting a
build:
node -e "console.log(require('./node_modules/<pkg>/package.json').version)" # vs package-lock.json
When in doubt, just run npm ci — it costs seconds and removes the whole class of error.
If you touched anything that changes the bundle
That means any of these — not just source:
mcp-server/src/**mcp-server/package-lock.jsonormcp-server/package.json(dependency bumps)
cd mcp-server
npm ci # required after a lockfile change
npm run build
git add dist/index.js dist/hook.js
Why the lockfile counts: build.mjs runs esbuild with bundle: true, so runtime
dependencies are inlined into dist/index.js (~805KB). A lockfile-only bump can therefore
change the committed bundle. This is not hypothetical — PR #27 and PR #49 (fast-uri) touched
no source file and still required a rebuild.
On Windows, git status lies about dist/ after a build. core.autocrlf=true rewrites the
checkout to CRLF while esbuild writes LF, so a rebuild that changed nothing still shows
M mcp-server/dist/index.js. git diff is the authority — empty output means the committed
bundle already reproduces, and there is nothing to commit. This is the same CRLF noise that keeps
CI's dist check Linux-only (.github/workflows/ci.yml).
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago Changed · +5 lines bf4fbe70c553
- 4d ago Changed · +8 lines 0b1561377665
- 9d ago First seen · 123 lines · 61 tokens per session scan A d448fa006fe3
maintainer-preflight is a skill published in the GitHub repository xzawed/claude-grok-build-plugin (1 stars, last pushed 3d ago), licensed MIT. It adds 61 tokens to every session and 1,599 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
pipeline-efficiency-benchmark
A repeatable benchmark for comparing different versions of a development pipeline. It runs the same public tasks in isolated workspaces and records scores, tokens, time, tool calls, and cost.
x-qdev
A compact development workflow for a small, clearly defined code change. It keeps the requirement, initially failing tests, implementation, and real verification results in one task document, following TDD, or test-driven development.
x-adversarial-risk
A focused adversarial review of a software specification. It tries to find small counterexamples that would expose incorrect implementations, such as invalid state changes, crashes, duplicate actions, permission mistakes, or concurrent events.
x-qa-gate
A quality-review gate for completed development tasks. It checks the code against the request, design, tests, verification evidence, and current changes, using different review rounds for different risk levels.
x-verify
A fact-checking gate that reruns the automated checks listed for a development task and reports which checks passed, failed, or still need a person. It is one step in a larger development process.
app-user-story-qa
End-to-end app feature inventory and user-story testing workflow with a canonical tracker. Use when the user asks to audit every feature, derive expected behavior from code, test user journeys, or explicitly fix and retest documented UX or logistical defects.