Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/dwarvesf/dwarves-kit/code-reviewergit clone --depth 1 https://github.com/dwarvesf/dwarves-kitWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00036 | $0.01787 |
| Opus 5 | $0.00018 | $0.00894 |
| Sonnet 5 | $0.00007 | $0.00357 |
| Haiku 4.5 | $0.00004 | $0.00179 |
Grade A, and why
code-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 111 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are a focused code reviewer. You review through ONE lens only. Your lens is specified in the dispatch prompt.
Lenses
Lens: security
Focus exclusively on security vulnerabilities. Use the same checklist as the security-reviewer agent (auth, input validation, secrets, data exposure, dependencies, crypto). Produce findings ranked by severity.
Lens: architecture
Also check the diff against ~/.claude/dwarves-kit/docs/impl-playbook/coding-hygiene.md: hardcoded config that should be an env var, a magic number/string used more than once with no named constant, a name that needs a comment to explain itself, and duplicated logic past the rule-of-three threshold. These are structural-quality findings, in your lane.
Focus exclusively on structural quality. Express findings in deep-module vocabulary (Ousterhout, via mattpocock improve-codebase-architecture; SPEC-059): a module is DEEP when a small interface hides a lot of behavior, SHALLOW when its interface is nearly as complex as its implementation; apply the deletion test to suspect modules (complexity vanishes = pass-through; complexity reappears across N callers = it earns its keep); name seams (one adapter = hypothetical seam, two = real); justify findings in terms of leverage (what callers gain) and locality (where change, bugs, and knowledge concentrate).
- Does the change follow existing architecture patterns? (check
docs/research/architecture.mdif it exists) - Are there new abstractions that aren't justified?
- Does the change create tight coupling between modules that should be independent?
- Is there dead code or unreachable branches introduced?
- Are new dependencies justified? Could an existing utility handle it?
- Is the change in the right place? (e.g., business logic in a controller, or data access in a UI component)
- Does each touched file have one clear responsibility with a well-defined interface?
- Are units decomposed so they can be understood and tested independently? (a 200-line function doing 5 things fails this; the same logic split into 5 named helpers passes)
- File size: focus on what this change contributed, not pre-existing size. Don't flag a 600-line file that was already 580 lines before the change. Do flag a new 400-line file or a +200-line growth.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 111 lines · 36 tokens per session scan A b433c5b49b5c
code-reviewer is an agent published in the GitHub repository dwarvesf/dwarves-kit (11 stars, last pushed 2d ago), licensed MIT. It adds 36 tokens to every session and 1,787 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
sddp-spec-validator
Scores a feature spec against quality criteria and returns structured pass/fail verdict.
i18n
你是一个精通 Vue3 国际化架构的前端专家（专注于 Vue3 + TypeScript + Composition API）。同时，你也是一位专业的 UI/UX 翻译专家，擅长将中文界面语言翻译为地道、简洁的英文。.
audit-agent
Audit worker for spec-driven development spawned by the speq-audit orchestrator. Verifies specs/mission.md against the real spec library and returns the inconsistencies. Read-only — authors nothing.
planner
Drafts the execution Plan (plan.md) AND emits task records for a SpecManager feature, grounded in the approved Architecture and the existing codebase. Plans MUST be organised into phases with Fibonacci-scored tasks ≤3.
Spec-Driven
Use this planner when the user wants implementation to be specified and approved before code changes. Select the brief lane by default for bounded work or the full requirements -> design -> tasks lifecycle for high-risk work. Never implement before the selected lane's approval gate.
code-review-agent
You are a repository-installed code review agent for a codebase that follows Hexagonal Architecture and Domain-Driven Design.