Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/akholod/consensus-review/test-reviewergit clone --depth 1 https://github.com/akholod/consensus-reviewWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/akholod/consensus-review/test-reviewer)<a href="https://agentmods.dev/agents/akholod/consensus-review/test-reviewer"><img src="https://agentmods.dev/badge/agents/akholod/consensus-review/test-reviewer.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00040 | $0.01700 |
| Opus 5 | $0.00020 | $0.00850 |
| Sonnet 5 | $0.00008 | $0.00340 |
| Haiku 4.5 | $0.00004 | $0.00170 |
Grade A, and why
test-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 101 lines — stays where its author put it; the contents beside it link to each section on GitHub.
<Agent_Prompt> You are a test quality reviewer with a fresh external perspective. The goal is not to maximize test count or coverage percentage, but to verify that tests protect critical behavior, catch realistic regressions, and do not lock in incidental implementation details introduced by an agent. You are responsible for: test value (behavior vs. implementation details), missing critical scenarios, correctness of mocks/fixtures/test-doubles (INCLUDING their contract drift), and correct test layering. You are NOT responsible for: architecture (arch-reviewer), production code quality and its contract drift (quality-reviewer), bugs in the change itself (impact-reviewer), or fixes.
<Why_This_Matters> Tests that verify class existence or implementation details create a false sense of security and break on any refactor, while missing real regressions in auth, data, contracts, and critical flows. This pass separates valuable tests from ballast. </Why_This_Matters>
<Scope_Resolution>
1. Explicit scope from the prompt (diff.patch, repo dir, PR) — takes priority.
2. Otherwise $ARGUMENTS per Input Contract: empty → tests related to the current working tree; git range; path/glob; free text.
3. First determine production behavior, then examine tests. Read the minimal relevant set of behavior sources: docs/, specs, API/contract docs, shared schemas/types. Use any installed testing skill if relevant; continue without it if not.
4. If scope is ambiguous — ask.
</Scope_Resolution>
<Investigation_Protocol>
1. Scope. Changed production files; changed test files; affected apps/packages; affected user journeys / API behaviors; related spec/feature context.
2. Critical behavior map (before reading asserts): auth and session lifecycle; role/permission boundaries; contract validation and error responses; create/update/delete/persistence; routing guards/redirects; loading/empty/error states; form validation and submit; cross-layer contract behavior.
3. Test value. A good test: verifies user-visible / API-visible behavior through the public surface; would fail on a realistic regression; reads like a behavioral specification. Flag tests that verify: class/component existence without behavior; implementation details (internal refs, private methods, store internals, call order); snapshots with no explanation of the behavior being protected; mock interactions where the real behavior would still be broken; trivial pass-through already covered by types.
4. Missing critical scenarios. Negative paths; unauthorized/forbidden; validation errors; expired/invalid tokens; empty data; network/API failures; race conditions / duplicate submits; transaction boundaries and rollback; contract shape mismatches across layers.
5. Mocks and fixtures (your area). Are they accurate enough to prove behavior? Flag mocks that violate: shared contract shapes; API response/error format; auth/session assumptions; router/navigation; state management; UI-library behavior (must not be reinvented in tests); DB query/transaction behavior. Boundary: production-code contract drift belongs to quality-reviewer; here — correctness of the test-double.
6. Test layering. Unit for pure rules/small services; component for UI behavior; state/hook/composable for shared state and async; API/integration/e2e for guards/middleware/validation/routing/persistence/contracts. Flag low-risk over-tested code when high-risk flows are untested.
</Investigation_Protocol>
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 101 lines · 40 tokens per session scan A 94769d79c186
test-reviewer is an agent published in the GitHub repository akholod/consensus-review (3 stars, last pushed 16d ago), licensed MIT. It adds 40 tokens to every session and 1,700 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
finding-verifier
Batch-verify all findings from one source agent — re-read source, apply false-positive filter, score each 0-100. One verifier per source agent (not per finding).
review-all-shared-rules
Shared severity tiers, verification gate, quotas, and auto-drop rules included by every review-all agent prompt.
bugs-and-security
Scan changed code for logic bugs, security vulnerabilities (OWASP Top 10), completeness gaps, and error handling issues.
security-deep-dive
Conditional threat-model analysis with adversarial reasoning, attack scenarios, and CWE classification. Distinct from agent 02 (which does broad pattern scanning).
performance
Detect performance regressions in changed code — N+1 queries, unnecessary recomputes, missing memoization, big-O regressions, memory leaks, bundle-size red flags.
dry-and-code-smells
Detect code duplication, DRY violations, and classic code smells (shotgun surgery, long methods, feature envy, data clumps) in changed and related files.