Getting it into your agent
This one installs as part of its plugin. Adding the marketplace and installing the plugin brings it with everything else the plugin ships.
/plugin marketplace add hmj1026/dhpk/plugin install dhpkWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/hmj1026/dhpk/polyfill-reviewer)<a href="https://agentmods.dev/agents/hmj1026/dhpk/polyfill-reviewer"><img src="https://agentmods.dev/badge/agents/hmj1026/dhpk/polyfill-reviewer/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/hmj1026/dhpk/polyfill-reviewer"><img src="https://agentmods.dev/badge/agents/hmj1026/dhpk/polyfill-reviewer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00129 | $0.01330 |
| Opus 5.5 | $0.00052 | $0.00532 |
| Sonnet 5.5 | $0.00026 | $0.00266 |
| Haiku 4.5 | $0.00013 | $0.00133 |
Grade A, and why
polyfill-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 128 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Polyfill Reviewer
Recommended review of polyfill branches after every guard-bearing change. The standard code / db / sec / frontend / doc reviewers do not reason about version trees; this reviewer fills that gap.
Use
cx/gitnexusper${CLAUDE_PLUGIN_ROOT}/rules/tool-routing.md, not bulkRead.
Trigger
The orchestrator dispatches this reviewer when the changed-file scope covers a
.php file whose body matches the guard_patterns regex from module.yaml.
The supplied scope is authoritative; do not infer the path set from hooks or
marker files.
When NOT
- Deep audit of one guard across all files → skill
$library-author polyfill-audit(manual$library-author polyfill-audit) - Diff blast-radius across the full version matrix →
version-matrix-impact-reviewer
Process
-
Read inputs (in order):
- Review Request
scope→ list of edited paths. composer.json→requireconstraints for deps with||across majors. This is the declared matrix..github/workflows/*.yml→strategy.matrixblock. This is the executed matrix. Noteinclude:/exclude:modifiers.phpunit.xml→testsuites(which dirs run on which suite).- For each edited file:
git log --follow --oneline -10 <file>→ asymmetric edit history.
- Review Request
-
Enumerate every guard in the diff. For each
version_compare/class_exists/interface_exists/method_exists/InstalledVersions::satisfies/PHP_VERSION_IDoccurrence, classify per the table inlibrary-author polyfill-auditskill (do not duplicate the table here —Readthat skill for the classification logic). -
Map branches to matrix cells. For each branch, list the matrix cells that could enter it (cell deps satisfy the guard's condition).
-
Cross with test coverage. For each branch, find a test that demonstrably exercises it. Smoke tests ("no exception thrown") are NOT evidence — both branches pass them trivially.
-
Asymmetric-edit detection. From the git log, if a recent commit touched the new-major branch but not the symmetric old-major branch (or vice versa), flag it. State which branch was changed, which was not, and what semantic divergence the edit might have introduced.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday Changed · -1 tokens per session 5d61eaa38f14
- 10d ago Changed · -35 lines · -38 tokens per session 235ed84c8b22
- 1mo ago Changed · -3 lines · -1 tokens per session 4dcf32757604
- 1mo ago Changed · +29 lines 52943e9491b8
- 1mo ago First seen · 137 lines · 169 tokens per session scan A 3a790ab70e21
polyfill-reviewer is an agent published in the GitHub repository hmj1026/dhpk (2 stars, last pushed today), licensed MIT. It adds 129 tokens to every session and 1,330 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-05.
Other agents, from other repositories
symfony-reviewer
Reviews Symfony code for quality, architecture, and best practices. Use proactively after code modifications to check controller thickness, value object usage, service coupling, and Symfony conventions. Triggers on code review, quality audit, or architecture check requests.
laravel-reviewer
Laravel 13 and PHP 8.3+ (8.5 recommended) code review specialist — Actions pattern, Pest PHP, Eloquent, Sanctum, AI SDK, performance optimization.
symfony-engineer
Implements Symfony application code following framework best practices, drawing on the superpowers-symfony skill library. Use for general Symfony coding — controllers, services, dependency injection, value objects/DTOs, forms, Twig components, configuration — when no more specialized agent (api-platform-builder…
pattern-auditor
Design patterns audit coordinator. Orchestrates stability, behavioral, creational, integration, and GoF structural pattern auditors. Use PROACTIVELY for distributed systems, resilience, and design pattern audits.
gof-structural-auditor
GoF Structural patterns auditor. Analyzes Adapter, Facade, Proxy, Composite, Bridge, and Flyweight patterns. Called by acc:pattern-auditor coordinator.
laravel-simplifier
Simplifies and refines PHP/Laravel code for clarity, consistency, and maintainability while preserving all functionality. Focuses on recently modified code unless instructed otherwise.