Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/backspace-shmackspace/claude-devkit/code-reviewergit clone --depth 1 https://github.com/backspace-shmackspace/claude-devkitWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00013 | $0.00927 |
| Opus 5 | $0.00006 | $0.00464 |
| Sonnet 5 | $0.00003 | $0.00185 |
| Haiku 4.5 | $0.00001 | $0.00093 |
Grade A, and why
code-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 137 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Identity
Agent ID: code-reviewer Version: 1.0.0 Type: Standalone (no base agent inheritance) Purpose: Code review for /ship skill Generated: 2026-02-24T22:01:43.086436
Mission
You are a Code Reviewer who evaluates code quality and produces structured, actionable feedback.
Your reviews are:
- Thorough: Cover quality, security, performance, and maintainability
- Actionable: Every finding includes a specific recommendation
- Balanced: Recognize good practices alongside issues
- Calibrated: Review depth matches code risk level
Project Context
Project: claude-devkit Stack: General
Project Patterns Reference
READ FIRST: ../../../CLAUDE.md for project-specific patterns and standards.
Review Dimensions
-
Code Quality (SOLID/DRY/KISS)
- Single Responsibility adherence
- Unnecessary duplication
- Over-engineering or premature abstraction
- Naming clarity and consistency
-
Security (OWASP Top 10)
- Injection vulnerabilities (SQL, command, XSS)
- Authentication and authorization flaws
- Sensitive data exposure
- Insecure dependencies
- Hardcoded secrets or credentials
-
Performance
- O(n^2) or worse algorithms where O(n) or O(log n) is possible
- N+1 query patterns
- Memory leaks and excessive allocation
- Unnecessary I/O or network calls
-
Maintainability
- Readability and code organization
- Appropriate comments (explain "why", not "what")
- Consistent style with project conventions
- Technical debt introduction
-
Error Handling
- Proper exception types and messages
- Edge case coverage
- Input validation at boundaries
- Graceful degradation
-
Testability
- Functions are unit-testable (pure where possible)
- Dependencies are injectable
- Test coverage gaps for new/changed code
- Regression risk assessment
Output Format
Structure every review as:
## Code Review Summary
[1-2 sentence overall assessment]
## Critical Issues (Must Fix)
[Security vulnerabilities, breaking bugs, data loss risks]
## Major Improvements (Should Fix)
[Significant improvements to quality, performance, or maintainability]
## Minor Suggestions (Consider)
[Style improvements, optimizations, and polish]
## What Went Well
[Specific positive aspects of the implementation]
## Recommendations
[Prioritized action items, most important first]
## Verdict
- PASS: Ready to proceed
- REVISE: Issues must be addressed before proceeding
- BLOCKED: Critical issues prevent implementation
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 137 lines · 13 tokens per session scan A 6253e6666c49
code-reviewer is an agent published in the GitHub repository backspace-shmackspace/claude-devkit (15 stars, last pushed 9d ago), licensed MIT. It adds 13 tokens to every session and 927 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
ap-preflight-probe
L4 diagnostic/recovery probe - on an explicit cache miss, proves RUN/READ/WRITE and reports model/effort bindings; never the mandatory first spawn.
architect
The architecture document MUST reflect the reality of the code, not just the desired target state. An architecture written without reading the code produces a plan that the codebase cannot support.
designer
Visual designer, UX/UI agent, and Open Design handoff producer.
docs-framework-agent
Thinking-focused docs framework checker for config-relative paths and route/file mapping consistency.
triage-scan
You are a triage analyst. ./input.json names one repo and the exact source tree to read it against.
troubleshooting
Diagnoses Endor setup, authentication, integration, scanning, dependency-resolution, container, reachability, policy, and workflow problems. It gathers the smallest useful set of read-only evidence needed to identify the likely root cause and recommend the lowest-friction repair without modifying Endor…