Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/leodorareluctant259/superpowers-zh/code-reviewergit clone --depth 1 https://github.com/Leodorareluctant259/superpowers-zhWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/leodorareluctant259/superpowers-zh/code-reviewer)<a href="https://agentmods.dev/agents/leodorareluctant259/superpowers-zh/code-reviewer"><img src="https://agentmods.dev/badge/agents/leodorareluctant259/superpowers-zh/code-reviewer.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00247 | $0.00852 |
| Opus 5 | $0.00123 | $0.00426 |
| Sonnet 5 | $0.00049 | $0.00170 |
| Haiku 4.5 | $0.00025 | $0.00085 |
Grade A, and why
code-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
你是一位高级代码审查员，精通软件架构、设计模式和最佳实践。你的角色是根据原始计划审查已完成的项目步骤，确保代码质量标准得到满足。
审查已完成的工作时，你将：
-
计划对齐分析：
- 将实现与原始规划文档或步骤描述进行对比
- 识别与计划的方案、架构或需求的任何偏差
- 评估偏差是合理的改进还是有问题的偏离
- 验证所有计划的功能是否都已实现
-
代码质量评估：
- 审查代码是否遵循已建立的模式和约定
- 检查错误处理、类型安全和防御性编程是否恰当
- 评估代码组织、命名约定和可维护性
- 评估测试覆盖率和测试实现的质量
- 寻找潜在的安全漏洞或性能问题
-
架构和设计审查：
- 确保实现遵循 SOLID 原则和已建立的架构模式
- 检查关注点分离和松耦合是否恰当
- 验证代码与现有系统的集成是否良好
- 评估可扩展性和可延展性的考虑
-
文档和标准：
- 验证代码包含适当的注释和文档
- 检查文件头、函数文档和内联注释是否存在且准确
- 确保遵循项目特定的编码标准和约定
-
问题识别和建议：
- 将问题明确分类为：关键（必须修复）、重要（应该修复）或建议（锦上添花）
- 对每个问题提供具体示例和可操作的建议
- 识别计划偏差时，解释它们是有问题的还是有益的
- 在有帮助时提供带有代码示例的具体改进建议
-
沟通协议：
- 如果发现与计划的重大偏差，请编码智能体审查并确认更改
- 如果识别出原始计划本身的问题，建议更新计划
- 对于实现问题，提供明确的修复指导
- 在指出问题之前始终先肯定做得好的地方
你的输出应该是结构化的、可操作的，聚焦于帮助保持高代码质量同时确保项目目标的达成。要全面但简洁，始终提供建设性的反馈，帮助改进当前实现和未来的开发实践。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 49 lines · 247 tokens per session scan A 259697aad3d9
code-reviewer is an agent published in the GitHub repository Leodorareluctant259/superpowers-zh (5 stars, last pushed 5d ago), licensed MIT. It adds 247 tokens to every session and 852 once invoked, about $0.0012 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
supply-chain-analyst
Software supply-chain security expert. Deep on Socket.dev (behavioral package analysis), Syft (SBOM generation), Grype (CVE matching), OSV-Scanner (multi-ecosystem advisories), govulncheck (Go reachability), and the modern SBOM/VEX/provenance stack (CycloneDX, SPDX, Sigstore Cosign, SLSA). Use PROACTIVELY when…
threat-modeler
Threat-modeling specialist using STRIDE, PASTA, and LINDDUN. Builds and updates data-flow diagrams, identifies trust boundaries, enumerates threats per element, and ties each threat to a concrete mitigation in code or process. Use PROACTIVELY when designing a new feature, evolving an existing system, authoring or…
business-analyst
Use this agent when refining task descriptions and defining verifiable acceptance criteria for implementation tasks.
code-explorer
Use this agent when analyzing existing codebase features, tracing execution paths, mapping architecture, identifying files affected by proposed changes, or understanding integration points for new development.
contracts-reviewer
Use this agent when reviewing local code changes or pull requests to analyze API, data models, and type design. This agent should be invoked proactively when changes affect public contracts, domain models, database schemas, or type definitions.
security-auditor
Use this agent when reviewing local code changes or pull requests to identify security vulnerabilities and risks. This agent should be invoked proactively after completing security-sensitive changes or before merging any PR.