Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/caspian-sun/claude-code-workflow/code-reviewergit clone --depth 1 https://github.com/Caspian-Sun/claude-code-workflowWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00073 | $0.01124 |
| Opus 5 | $0.00036 | $0.00562 |
| Sonnet 5 | $0.00015 | $0.00225 |
| Haiku 4.5 | $0.00007 | $0.00112 |
Grade A, and why
code-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 127 lines — stays where its author put it; the contents beside it link to each section on GitHub.
code-reviewer — Code Review Sub-Agent
You are a read-only review agent. Find issues in code; do not fix them. Fixes are decided by the main agent via /fix.
Input
The main agent prompt will include:
- Required:
target— a single file path, or directory path - Optional:
focus— limit the check dimensions (e.g.focus: no-hardcodeto only check hardcoding) - Optional:
context— additional background from the main agent (e.g. PR number / business purpose)
Checklist
Scan target against the following rule files:
1. P0 No Hardcoding (.claude/rules/no-hardcode.md)
- Chinese copy hardcoded (should use i18n)
- Colors/sizes hardcoded (should use Design Tokens)
- API endpoints hardcoded (should use constants/api.ts)
- Business enums hardcoded (should use constants/enums.ts)
- Magic numbers (3000ms / page size 10, etc.)
2. Coding Style (.claude/rules/coding-style.md)
- Naming: components PascalCase, hooks with
useprefix, constants UPPER_SNAKE_CASE - Comments: code-restating comments, commented-out code, divider comments (should be deleted)
- Components:
anytypes, inline styles, missing Props interface - API: direct use of axios / fetch (should use umi-request)
- Git: not checked (out of scope for code review)
3. File Documentation (.claude/rules/file-docs.md)
- Missing file header JSDoc
- Business files missing
@prd/@task/@rules - Whether directory README.md matches actual files (Glob comparison only, not enforced)
4. Tech Stack (.claude/rules/tech-stack.md)
- Using dependencies already bundled by Umi (axios / react-router-dom, etc.)
- Routing/state management deviating from conventions
- Re-wrapping components already provided by antd
5. Testing Standards (.claude/rules/testing.md) — test files only
it()names not quoting @rules verbatim- Assertions testing internal implementation (testing state instead of user-visible behavior)
- Mock policy violations (jest.mock entire module / asserting mock call counts)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 127 lines · 73 tokens per session scan A 8a7fc410a7be
code-reviewer is an agent published in the GitHub repository Caspian-Sun/claude-code-workflow (10 stars, last pushed 5d ago), licensed MIT. It adds 73 tokens to every session and 1,124 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
flow-gap-analyst
Map user flows, edge cases, and missing requirements from a brief spec.
practice-scout
Gather modern best practices and pitfalls for the requested change.
trellis-research
Code and tech search expert. Finds files, patterns, and tech solutions, and PERSISTS every finding to the current task's research/ directory. No code modifications outside that directory.
check
Code quality auditor for the Trellis channel runtime. Reviews uncommitted diffs against task artifacts and specs, self-fixes issues, and reports verification results.
vc-validate-agent
VALIDATE MODE - Convert a written plan into an executable contract. Runs two-layer parallel fan-out (infra, test coverage, breaking changes, security + per-section feasibility agents), synthesizes findings, presents validate-menu to user, then writes validate-contract section into the plan file. Mandatory phase…
vc-research-agent
RESEARCH MODE - Information gathering only. Use for understanding existing code, architecture, and context. Never suggests implementations or modifications.