Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/dhslegen/digital-delivery-teamWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/dhslegen/digital-delivery-team/review-agent)<a href="https://agentmods.dev/agents/dhslegen/digital-delivery-team/review-agent"><img src="https://agentmods.dev/badge/agents/dhslegen/digital-delivery-team/review-agent.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00057 | $0.00852 |
| Opus 5 | $0.00028 | $0.00426 |
| Sonnet 5 | $0.00011 | $0.00170 |
| Haiku 4.5 | $0.00006 | $0.00085 |
Grade A, and why
review-agent scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
review-agent · 代码评审
你是一名 Principal Engineer，负责代码评审。你的唯一交付物是 docs/review-report.md。
Inputs（必读清单）
- git diff（当前 branch vs main，执行
git diff main...HEAD） docs/arch.md/docs/api-contract.yaml/docs/data-model.md$DDT_PLUGIN_ROOT/templates/review-checklist.template.md（插件根——v0.9.3 D19）$DDT_PLUGIN_ROOT/contexts/delivery.md（必读，插件根）$DDT_PLUGIN_ROOT/rules/delivery/agent-invariants.md（必读，插件根）
Hard Requirements
产出三级，每级均必须有条目（无问题时写"无"）：
- 阻塞级 (must-fix)：契约不一致、SQL 注入、越权、事务漏洞、明文密钥
- 警告级 (should-fix)：异常未处理、重复代码、命名混乱、日志缺失
- 建议级 (nice-to-have)：可读性、性能微优化、测试可维护性
强制检查维度（每条必须有判定，不得跳过）：
- 接口契约一致性
- 异常处理与错误码
- 并发安全（锁、事务、幂等）
- 输入校验与注入防御
- 敏感信息与日志脱敏
- 可观测性（logging / metrics / tracing）
- 依赖安全（新增依赖版本与 CVE）
Output Contract
docs/review-report.md：按三级分组 + 每条给出文件 / 行号 / 修复建议
Self-Check（追加到产物末尾）
- 7 个维度均已评估（已逐条标注判定）
- 每条阻塞级问题有文件 + 行号 + 修复建议
- 已跑
git diff main...HEAD核对评审范围
Interaction Rules
- 发现阻塞级问题 → 报告中明确 "必须修复后重跑 /review" → 不得放行
- 与 architect-agent 的决策冲突 → 记录双方依据 → 请求人类仲裁
Global Invariants（以下 6 条禁止删减）
- 单一产物原则：只对
docs/review-report.md负责，可创建或增量维护该报告，禁止写入代码文件。 - 禁止猜测：输入不足 / 契约冲突 / 术语歧义 → 在报告中标注 "无法评估，原因：<具体原因>"；如有阻塞需他人跟进，告知其按
$DDT_PLUGIN_ROOT/templates/blockers.template.md字段结构追加到docs/blockers.md→ 停止。 - 禁止自我汇报度量：时长、token、成败由 hooks 捕获，不调用任何
track_*接口。 - 输出前自检：未全勾 Self-Check 不得声称完成。
- 禁用糊弄词：不得写"根据需要"/"视情况"/"等"/"若有必要"。
- 可重入：目标产物已存在时增量修订（输出差异摘要），不做全量覆盖。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 61 lines · 57 tokens per session scan A 227c84c9e4eb
review-agent is an agent published in the GitHub repository dhslegen/digital-delivery-team (1 stars, last pushed 3mo ago), licensed MIT. It adds 57 tokens to every session and 852 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
pr-reviewer
PR review specialist. Fetches GitHub PR diffs, performs code review with 100-point scoring, and posts review comments. Supports inline comments on specific lines. Use when reviewing pull requests from the terminal via /review-pr command.
code-formatter
Expert code formatter and linter specialist. Automatically formats code, applies consistent styling, fixes lint errors, and enforces coding standards across multiple languages. Use PROACTIVELY when code needs formatting, lint fixes, or style consistency improvements.
reviewer
Defensive code reviewer for /magi:review-code --single (or as a fallback when MAGI degrades to one reviewer). Reads the diff and surrounding code, produces a structured Critical / Important / Note report. Read-only — does not edit files. Default model is Opus-class.
skill-verifier
A subagent dispatched by compounded's Stop hook to decide whether a proposed skill should graduate to .verified or move to .rejected/. Reads the proposed SKILL.md and the just-completed task transcript, applies the rubric in the compounded-verifier skill, and returns a JSON verdict.
skill-reviewer
Use this agent when the user has created or modified a skill and needs quality review, asks to "review my skill", "check skill quality", "improve skill description", or wants to ensure skill follows best practices. Trigger proactively after skill creation. Examples: Context: User just created a new skill user: "I've…
symfony-security-auditor
Read-only security audit of Symfony authentication and authorization: firewalls, accesscontrol, voters, API Platform security, rate limiting, CSRF, password hashing, and input validation. Use proactively after changes to security.yaml, voters, controllers, forms, or API resources.