standards

boshu2/agentops

Load only relevant standards for a change, then report concrete findings with paths and line numbers.

What is standards?

Standards is a focused code-review skill that loads the smallest set of engineering standards justified by the caller's files, language, and risks. Use it to check security-sensitive changes, bulk rewrites, and language-specific conventions against cited references without preloading the entire corpus.

Loads only matching language and risk-specific standards references, never the full corpus
Reports findings with exact file paths and line numbers (e.g., `cli/internal/auth/token.go:18`)
Discloses checked and not-checked scope explicitly in every report
Surfaces load-bearing conventions inline when the caller is about to write code
Checks bulk rewrites against mutation-safety standards: audited chokepoint, hash-witnessed backups, and scope gates

How to install standards

npx skills add https://github.com/boshu2/agentops --skill standards

Claude Code

Cursor

Windsurf

Cline

How to use standards

1.Supply the changed file paths, programming language, and change type (e.g., security-sensitive, bulk rewrite)
2.Optionally note risk cues (e.g., authentication, SQL, LLM integration)
3.The skill loads `common-standards.md` plus only the matching language or checklist references
4.Review the returned findings, which cite exact paths and line numbers
5.Check the disclosed `checked` and `not_checked` scope to understand coverage

Use cases

Good for

Review a security-sensitive change in Go by loading common standards plus Go reference only
Audit a bulk formatter or codemod run to verify single mutation chokepoint and backup hashes
Check a TypeScript refactor against language conventions and race-condition checklist
Validate SQL changes against SQL safety checklist with concrete line-number findings
Assess LLM integration code for trust-boundary violations

Who it's for

Code reviewers checking security-sensitive or high-risk changes
Engineers auditing bulk rewrites, migrations, or generated code
Teams enforcing language-specific conventions and standards
Security-focused development teams validating trust boundaries and mutation safety

standards FAQ

Does this skill edit or validate code?

No. It provides context and findings only. It does not edit, validate, retry, approve, commit, release, or decide continuation.

Why load only matching standards instead of the full corpus?

Loading the smallest justified set keeps the context focused and decision-useful. Inline imperative rules (not reference links) measurably improve code-generation behavior.

What are mutation-safety standards?

Three standards for bulk rewrites: (1) single audited mutation chokepoint, (2) hash-witnessed backups before rewrite, (3) self-administered ambition gate stating what is deliberately not touched.

How are findings reported?

Each finding cites a path and line number when possible (e.g., `cli/internal/auth/token.go:18`), and the report discloses both checked and not-checked scope.

Which languages and checklists are supported?

Go, Python, Rust, TypeScript, JavaScript, Shell, JSON, YAML, Markdown, plus SQL safety, race conditions, LLM trust boundaries, skill structure, and test strategy references.

Full instructions (SKILL.md)

Source of truth, from boshu2/agentops.

name: standards description: 'Load only the standards relevant to a caller-supplied change, then report concrete findings. Triggers: "check standards", "which standards apply".' practices:

pragmatic-programmer
clean-code hexagonal_role: supporting consumes: [] produces:
stdout context_rel: [] skill_api_version: 1 metadata: capabilities: [standards] effects: [] canonical_status: canonical disposition: keep_specialist tier: knowledge dependencies: [] output_contract: cited standards and factual findings

Standards — focused engineering guidance

Load the smallest set of standards justified by the caller's files, language, and risks. Do not preload the entire reference corpus.

Prompt

Check standards for the changed files in fleet-router PR #214: cli/internal/auth/token.go and cli/internal/auth/token_test.go, Go, a security-sensitive change. Load only the matching references and report cited findings with path and line plus checked and not-checked scope.

It's working if

The report loads common-standards.md plus only the matching Go reference, never the full reference corpus.
Every finding cites a path and line, e.g. cli/internal/auth/token.go:18.
The response discloses checked and not_checked scope explicitly, even when not_checked is empty.
git diff --stat shows no test, gate, or fixture file changed; standards reports findings only.

Procedure

Record the supplied paths, language, change type, and risk cues.
Load common-standards.md plus only the matching language or checklist references.
Compare the supplied artifact to those sources.
Return cited findings with path and line when possible, plus checked and not-checked scope.
Stop.

This skill provides context and findings. It does not edit, validate, retry, approve, commit, release, deliver, or decide continuation.

Load-bearing conventions for produced code (MEASURED)

When the caller is about to WRITE code (not only review it), surface the matching language rules INLINE in the working context — a behind-the-link reference does not change behavior; an inline imperative does. The Go core:

Wrap every propagated error with context: fmt.Errorf("doing X: %w", err) — never return a bare inner error.
Multi-case functions get TABLE-DRIVEN tests ([]struct cases + t.Run per case), asserting exact expected values including the error cases.

For other languages, pull the matching reference below and inline its top rules the same way.

Measured 2026-08-04, probe standards-go-conventions (gpt-5.6-luna, N=2, directional): control produced the %w-wrapped + table-driven shape in 1/2 runs; with these rules inline, 2/2. Inline-imperative beats reference-link — the graphify probe measured a linked doc instruction obeyed 0/2. Ledger: evals/skill-probes/LEDGER.md.

Mutation-safety standards

When the supplied change rewrites existing files in bulk — formatters, codemods, migration scripts, generators pointed at hand-written sources — check it against three standards and report each as a finding when absent:

Single audited mutation chokepoint. All rewrites flow through one named command or script whose inputs, outputs, and dry-run mode can be inspected. Edits scattered across ad-hoc one-liners and manual touch-ups are the diffuse mutation failure mode: no single point can be audited, re-run, or blamed. Finding: name every mutation path outside the chokepoint.
Hash-witnessed backups before rewrite. Before the chokepoint runs, the originals are preserved with content hashes recorded (a committed baseline counts), so "the rewrite changed only what it claims" is checkable byte-for-byte, not asserted. Finding: a bulk rewrite with no verifiable before-state.
Self-administered ambition gate. The change states what it deliberately does not touch, and the diff respects it. A formatter run that also renames, a codemod that also refactors, is the scope-creep rewrite failure mode. Finding: any file class in the diff outside the change's own stated scope.

Stop condition for this check: all three standards have an explicit pass or finding; a bulk-rewrite review that reports style nits but skips these is incomplete.