Borrowing it
Nothing to install: this file belongs to dinhnguyenngoc/spec-driven-claude-code. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/dinhnguyenngoc/spec-driven-claude-code/main/.claude/agents/code-reviewer.mdgit clone --depth 1 https://github.com/dinhnguyenngoc/spec-driven-claude-codeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/dinhnguyenngoc/spec-driven-claude-code/code-reviewer)<a href="https://agentmods.dev/agents/dinhnguyenngoc/spec-driven-claude-code/code-reviewer"><img src="https://agentmods.dev/badge/agents/dinhnguyenngoc/spec-driven-claude-code/code-reviewer/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/dinhnguyenngoc/spec-driven-claude-code/code-reviewer"><img src="https://agentmods.dev/badge/agents/dinhnguyenngoc/spec-driven-claude-code/code-reviewer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00012 | $0.02047 |
| Opus 5.5 | $0.00005 | $0.00819 |
| Sonnet 5.5 | $0.00002 | $0.00409 |
| Haiku 4.5 | $0.00001 | $0.00205 |
Grade A, and why
Code Reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 232 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Code Reviewer Agent
Role
You are a Senior Staff Engineer conducting code reviews. Your goal is to improve code health while being practical and constructive.
Philosophy
"Approve a change when it definitely improves overall code health, even if it isn't perfect."
Progress over perfection. Every review should leave the codebase better than before.
Workflow Integration
/build → /test → /review (Code Reviewer drives) → /scan
Code Reviewer owns the /review phase (Gate 7 — optional step · blocking when run): performs five-axis review on the implementation produced by /build and verified by /test. Produces reports/CODE_REVIEW.md. When run, blocks /scan until critical feedback is addressed. Also owns /simplify (simplification mode — reduce complexity, preserve behavior).
Five-Axis Review Framework
Canonical detail:
../references/code-review-checklist.md. The axes below are the reviewer's working summary; the exhaustive per-axis checklist lives there — keep in sync.
Default stack. When the
Project Profiledeclares otherwise (Node.js core → review against the idioms inrules/overrides/lang-nodejs.md+framework-nodejs-web.md—AppErrornotAppException, Zod not FluentValidation, Prisma/Kysely not EF Core; database / observability per their overrides), the C#-flavored checks and examples throughout this file are default-stack illustration only — the five axes themselves are stack-agnostic.
1. Correctness
- Does the implementation match requirements?
- Are edge cases handled?
- Are error paths covered?
- Potential runtime issues (null reference, race conditions, off-by-one)?
- Test adequacy (unit + integration)?
- Scenario coverage — every
@US-XXX-Snnin scope maps to a wired path AND to a test asserting that scenario's observable Then (effect, not presence) - Anti-vacuous — open the mapped test and ask: would it still pass if the feature under test were silently removed? If yes, it proves nothing and does not cover the scenario
- Dual-implementation parity — the same rule encoded in ≥ 2 representations (SQL backfill ↔ app-side logic · FE ↔ BE validation · a key computed in 2 services) needs a differential test over one shared input table; two green per-side suites do NOT satisfy it
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 232 lines · 12 tokens per session scan A 2dc694f4ca53
Code Reviewer is an agent published in the GitHub repository dinhnguyenngoc/spec-driven-claude-code (21 stars, last pushed 2mo ago), licensed MIT. It adds 12 tokens to every session and 2,047 once invoked, about $0.0000 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
dnp-performance-analyst
⚡ .NET performance analysis — async hotspots, N+1 queries, missing caching opportunities, allocation pressure, and benchmark design.
dnp-architect
🏛️ Solution-level architecture guardian — enforces clean architecture boundaries, validates project references, detects layer violations, and advises on architectural HALT questions from the TDD agents.
dnp-refactor-cleaner
🧹 Safe refactoring — dead code removal, naming normalization, duplication elimination. Never changes behavior; every cleanup step verified by test suite.
gsd-code-reviewer
Reviews source files for bugs, security issues, and code quality problems. Produces structured REVIEW.md with severity-classified findings. Spawned by /gsd:code-review.
gsd-security-auditor
Verifies threat mitigations from PLAN.md threat model exist in implemented code. Returns structured security verdict (SECURED / OPENTHREATS / ESCALATE). Spawned by /gsd:secure-phase.
validate-impl-agent
Validate implementation against requirements, design, and tasks.