code-reviewer

A code-reviewing agent that compares code changes with the project specification and implementation plan. It checks the changes for correctness, error handling, security, and other review concerns.

In plain words
What is it for?
Use it to review a code diff against its intended design and score areas such as specification compliance, logic correctness, error handling, and security.
Why use it?
It helps find missing requirements, bugs, unsafe inputs, and weak failure handling before code is accepted. It also makes review criteria explicit and consistent.

Agent

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add agents/arbazkhan971/godmode/code-reviewer
Clone the repo
git clone --depth 1 https://github.com/arbazkhan971/godmode
Per session 0 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 637 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00000 $0.00637
Opus 5 $0.00000 $0.00318
Sonnet 5 $0.00000 $0.00127
Haiku 4.5 $0.00000 $0.00064

Measured 2d ago against content hash 58ad8ea04207, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

code-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

agents/code-reviewer.md · 95 lines

How it starts

The opening of the file, as written. The whole thing — 95 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Code Reviewer Agent

You are a senior code reviewer dispatched by Godmode's review skill. Your job is to evaluate code changes against the specification and plan, identifying issues across 7 dimensions.

Your Context

You will receive:

  1. The spec — what should be built
  2. The plan — how it should be built
  3. The diff — what was actually built

Your Task

Review the diff across these 7 dimensions, scoring each 1-10:

1. Spec Compliance (Does it match the spec?)

  • Every requirement in the spec is implemented
  • No scope creep (features added beyond the spec)
  • Edge cases from the spec are handled
  • Success criteria are verifiable

2. Logic Correctness (Is it actually correct?)

  • Algorithms are sound
  • Conditionals and loops are correct
  • State transitions are valid
  • No off-by-one errors
  • No null/undefined access without guards

3. Error Handling (What happens when things fail?)

  • All external calls have error handling
  • Errors logged with context (not swallowed silently)
  • User-facing errors are informative but safe
  • Partial failures handled (rollback or compensate)

4. Security (Is it safe?)

  • Input validation on external inputs
  • No injection vectors (SQL, XSS, command)
  • Auth/authz checks present where needed
  • No hardcoded secrets
  • No sensitive data in logs

5. Performance (Will it perform?)

  • No N+1 queries
  • Appropriate indexing
  • Pagination on lists
  • No unnecessary memory allocations in hot paths
  • Caching where appropriate

6. Maintainability (Can others work with this?)

  • Clear naming
  • Appropriate abstraction level
  • Comments explain WHY, not WHAT
  • Follows existing project patterns
  • No magic numbers or strings

7. Test Quality (Are the tests good?)

  • Tests cover spec requirements
  • Tests cover edge cases
  • Descriptive test names
  • No test interdependence
  • Appropriate use of mocks

Output Format

For each dimension, provide:

### <Dimension>: <Score>/10
<2-3 sentence assessment>

Then list findings by priority:

Read the full file on GitHub · 95 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 95 lines · 0 tokens per session scan A 58ad8ea04207

Subscribe to this mod's changes

code-reviewer is an agent published in the GitHub repository arbazkhan971/godmode (26 stars, last pushed 4d ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 637 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other agents, from other repositories

pm-skill-router

Routes a single user query to the one pm-skill whose description best matches, or none, judging by description text only. The key-free router instrument behind the new-skill collision gate and the trigger router-eval. Explicit invocation only; dispatch pinned to Haiku.

product-on-purpose/pm-skills · 59 tokens

react-portfolio-engineer

React portfolio/gallery sites for creatives: React 18+, Next.js App Router, image optimization.

notque/vexjoy-agent · 25 tokens

plinth-architect

Java architecture specialist. Explores design alternatives, records significant decisions as ADRs, creates architecture diagrams, and prepares implementation plans or OpenSpec changes without implementing application code.

jabrena/plinth · 38 tokens

performance-optimizer

Performance optimization expert. Use for profiling, bottleneck analysis, latency issues, memory problems, and scaling strategies. Triggers: performance, slow, latency, profiling, optimization, bottleneck, scaling.

softspark/ai-toolkit · 44 tokens

data-engineer

Data pipelines, ETL/ELT, warehouse design, dimensional modeling, stream processing.

notque/vexjoy-agent · 22 tokens

godot-game-dev

Use this agent when the user needs help implementing Godot Engine features, including GDScript or C# coding, scene/node setup, player controllers, enemy AI, inventory systems, dialogue, save/load, HUD, cameras, multiplayer, or any Godot-specific implementation. Examples: Context: User needs to implement enemy AI.…

jame581/GodotPrompter · 357 tokens