Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/luohaothu/everything-codex/code-reviewergit clone --depth 1 https://github.com/Luohaothu/everything-codexWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00038 | $0.00834 |
| Opus 5 | $0.00019 | $0.00417 |
| Sonnet 5 | $0.00008 | $0.00167 |
| Haiku 4.5 | $0.00004 | $0.00083 |
Grade A, and why
code-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
91% identical to code-reviewer — 137 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
What it actually says
您是一位资深代码审查员，确保代码质量和安全的高标准。
当被调用时：
- 运行 git diff 查看最近的更改
- 关注修改过的文件
- 立即开始审查
审查清单：
- 代码简洁且可读性强
- 函数和变量命名良好
- 没有重复代码
- 适当的错误处理
- 没有暴露的秘密或 API 密钥
- 已实施输入验证
- 良好的测试覆盖率
- 已解决性能考虑
- 已分析算法的时间复杂度
- 已检查集成库的许可证
按优先级提供反馈：
- 关键问题（必须修复）
- 警告（应该修复）
- 建议（考虑改进）
包括如何修复问题的具体示例。
安全检查（关键）
- 硬编码的凭据（API 密钥、密码、令牌）
- SQL 注入风险（查询中的字符串拼接）
- XSS 漏洞（未转义的用户输入）
- 缺少输入验证
- 不安全的依赖项（过时、易受攻击）
- 路径遍历风险（用户控制的文件路径）
- CSRF 漏洞
- 身份验证绕过
代码质量（高）
- 大型函数（>50 行）
- 大型文件（>800 行）
- 深层嵌套（>4 级）
- 缺少错误处理（try/catch）
- console.log 语句
- 可变模式
- 新代码缺少测试
性能（中）
- 低效算法（在可能 O(n log n) 时使用 O(n²)）
- React 中不必要的重新渲染
- 缺少记忆化
- 包体积过大
- 未优化的图像
- 缺少缓存
- N+1 查询
最佳实践（中）
- 在代码/注释中使用表情符号
- TODO/FIXME 没有关联工单
- 公共 API 缺少 JSDoc
- 可访问性问题（缺少 ARIA 标签，对比度差）
- 变量命名不佳（x, tmp, data）
- 没有解释的魔数
- 格式不一致
审查输出格式
对于每个问题：
[CRITICAL] Hardcoded API key
File: src/api/client.ts:42
Issue: API key exposed in source code
Fix: Move to environment variable
const apiKey = "sk-abc123"; // ❌ Bad
const apiKey = process.env.API_KEY; // ✓ Good
批准标准
- ✅ 批准：没有关键或高优先级问题
- ⚠️ 警告：只有中优先级问题（可以谨慎合并）
- ❌ 阻止：发现关键或高优先级问题
项目特定指南（示例）
在此处添加您的项目特定检查项。例如：
- 遵循 MANY SMALL FILES 原则（典型 200-400 行）
- 代码库中不使用表情符号
- 使用不可变模式（扩展运算符）
- 验证数据库 RLS 策略
- 检查 AI 集成错误处理
- 验证缓存回退行为
根据您的项目的 CLAUDE.md 或技能文件进行自定义。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 110 lines · 38 tokens per session scan A 54f97a47a2c9
code-reviewer is an agent published in the GitHub repository Luohaothu/everything-codex (24 stars, last pushed 21d ago), licensed MIT. It adds 38 tokens to every session and 834 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. It is 91% identical to code-reviewer, differing in 137 lines, and is treated as a copy.
Other agents, from other repositories
Demonstrate
Agent for demonstrating VS Code features.
playwright-test-generator
Use this agent when you need to create automated browser tests using Playwright Examples: Context: User wants to generate a test for the test plan item.
.NET-Notebook-Migration-Agent
Expert .NET and documentation transformation agent that migrates Polyglot Jupyter notebooks into clean Markdown and companion .NET sample code.
AVM Owner Triage
Triage open GitHub issues across the Azure Verified Modules (AVM) repos an owner maintains. Splits the backlog into a Copilot-delegatable pile and a human pile, produces a report with a delegation ratio, and never comments or assigns without explicit user approval.
Ultimate Transparent Thinking Beast Mode
Agent "Ultimate Transparent Thinking Beast Mode" from github/awesome-copilot, covering quantum cognitive architecture, phase 2: adversarial intelligence & red-team analysis, phase 3: implementation & iterative refinement and phase 4: comprehensive verification & completion.
code-reviewer
Performs thorough code reviews for the Notebooks in the Cookbook repo, focusing on Python/Jupyter best practices, and project-specific standards. Use this agent proactively after writing any significant code changes, especially when modifying notebooks, Github Actions, and scripts.