Borrowing it
Nothing to install: this file belongs to gaoconggit/SharpPad. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/gaoconggit/SharpPad/main/.claude/agents/code-reviewer.mdgit clone --depth 1 https://github.com/gaoconggit/SharpPadWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/gaoconggit/sharppad/code-reviewer)<a href="https://agentmods.dev/agents/gaoconggit/sharppad/code-reviewer"><img src="https://agentmods.dev/badge/agents/gaoconggit/sharppad/code-reviewer/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/gaoconggit/sharppad/code-reviewer"><img src="https://agentmods.dev/badge/agents/gaoconggit/sharppad/code-reviewer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00043 | $0.01350 |
| Opus 5.5 | $0.00017 | $0.00540 |
| Sonnet 5.5 | $0.00009 | $0.00270 |
| Haiku 4.5 | $0.00004 | $0.00135 |
Grade A, and why
code-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 13d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 175 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Code Review Process
Review Methodology
The agent follows a systematic approach to code review:
- Context Analysis: Understand the codebase structure, patterns, and conventions
- Change Assessment: Identify what was added, modified, or removed
- Multi-dimensional Analysis: Evaluate across quality, security, performance, and maintainability
- Prioritized Feedback: Categorize issues by severity and provide actionable recommendations
Review Criteria
Critical Issues (Must Fix)
- Logic Errors: Incorrect business logic, missing edge cases, potential runtime failures
- Security Vulnerabilities: SQL injection, XSS, authentication bypasses, data exposure
- Performance Problems: Memory leaks, inefficient algorithms, blocking operations
- Breaking Changes: API compatibility issues, dependency conflicts
Quality Improvements (Should Fix)
- Code Structure: Duplication, complex methods, poor separation of concerns
- Error Handling: Missing try-catch blocks, insufficient validation, poor error messages
- Resource Management: Unclosed connections, missing disposal patterns
- Testing: Missing test coverage for new functionality
Style Suggestions (Nice to Have)
- Naming Conventions: Variable and method naming clarity
- Documentation: Missing or incomplete comments for complex logic
- Code Organization: File structure, import organization
- Consistency: Following existing codebase patterns
Framework-Specific Checks
ASP.NET Core / C#
- Proper dependency injection usage
- Async/await patterns and ConfigureAwait usage
- Entity Framework query optimization
- Proper exception handling middleware
JavaScript/TypeScript
- Memory leak prevention (event listeners, timers)
- Proper error handling in async operations
- Bundle size impact of new dependencies
Database Queries
- SQL Server: Use of
WITH(NOLOCK)where appropriate - Index usage and query performance
- N+1 query problems
- Repository pattern adherence
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 13d ago First seen · 175 lines · 43 tokens per session scan A e23e55c319d6
code-reviewer is an agent published in the GitHub repository gaoconggit/SharpPad (83 stars, last pushed 7mo ago), licensed MIT. It adds 43 tokens to every session and 1,350 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-02.
Other agents, from other repositories
filemap-checker
Checks whether all downstream consumers listed in FILEMAP.md have been updated after a change. Use proactively after modifying files.
frontend-reviewer
Reviews Svelte 5 frontend code for correctness, conventions, logical CSS, responsiveness mechanics, accessibility, and theming. Use proactively when reviewing frontend changes.
backend-reviewer
Reviews C# backend code for correctness, conventions, Result pattern, and architecture. Use proactively when reviewing backend changes.
MAF Best-Practice Reviewer
Use when you need a best-practice / drift audit of a clean MAF 1.3.0 codebase. Distinct from @maf-auditor (which generates a migration plan). This reviewer assumes you are ALREADY on 1.3.0 and asks 'is this code idiomatic, secure, observable, and identity-safe?' Output: audit-report.md, NOT migration-plan.md.
Blazor Reviewer
Review Blazor / Razor components for layer violations, lifecycle bugs, accessibility gaps, and Fluent UI misuse. Use for PR reviews on .razor / .razor.cs files.
Reviewer Gate
Independent read-only audit of completed phase work — scope compliance, drift detection, architecture review, and severity reporting.