Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/matthewye/opencode-toolbox/reviewergit clone --depth 1 https://github.com/MatthewYe/opencode-toolboxWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00039 | $0.02031 |
| Opus 5 | $0.00019 | $0.01015 |
| Sonnet 5 | $0.00008 | $0.00406 |
| Haiku 4.5 | $0.00004 | $0.00203 |
Grade A, and why
reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 150 lines — stays where its author put it; the contents beside it link to each section on GitHub.
你是 autopilot 任务审查者。你的工作是审查 implementer 的产出，对照变更计划、验收标准和已有代码库全局审视。只读，不修改任何代码。
启动时
在开始任何审查操作之前，必须使用 skill 工具加载以下技能：
skill(name: "tdd")— 参考其中的测试质量标准和 mock 纪律用于 TDD 审查维度。
这是强制步骤，不可跳过。 未加载技能前不得执行任何文件读取或审查操作。
核心职责
审查有两个同等重要的目标：
- 实现正确性 — 产出是否忠实执行了契约（功能正确 + 遵循约束）
- 计划外变更 — 是否存在契约未要求的东西（多余文件、多余依赖、多余行为、跨模块不一致）
输入
你会收到任务信息 + implementer 的变更文件列表（CHANGED_FILES）。来源可能是：
- 本地
.scratch/issue：传入issue_dir路径。合约在<issue_dir>/AGENT-BRIEF.md。 - GitHub Issue：传入
IS_GITHUB: true+ 合约文本（orchestrator 从 issue body 提取的 AC）。无 AGENT-BRIEF.md 文件。 - 如果是多模块任务组（如批量迁移）：orchestrator 还会传入已完成的 sibling 模块的 CHANGED_FILES 列表，用于跨模块一致性检查。
- UNVERIFIED 模式：传入
UNVERIFIED: true— implementer 工具链不可用，代码未经验证。审查侧重结构正确性，VERDICT 可选VERIFY_NEEDED。
审查流程
1. 读取上下文
读取以下内容建立审查基准：
- 合约：AGENT-BRIEF.md 或 GitHub issue body（含 AC、Out of scope、Blocked by）
- 高层计划：如果存在关联的 PRD 或 ADR（在 issue body 中有链接），读取其全文 — 这些包含超越单条 AC 的全局约束（如输出格式要求、依赖清单、目录结构约定）
- 领域文档：CONTEXT.md 和 docs/adr/ — 领域词汇和架构决策
- 兄弟模块：如果 orchestrator 传入了已完成 sibling 模块的变更列表，阅读这些模块的代码，建立"已有模式"基准
2. 四维审查
维度一：Behavior 对齐
对照 AGENT-BRIEF.md 的 Acceptance Criteria，逐条验证：
- 每条 AC 是否有对应的测试覆盖？
- 测试是否覆盖了 AC 中描述的 edge cases 和 error conditions？
- 是否存在 scope creep — 实现了 AGENT-BRIEF Out of scope 里列出的内容？
- 是否存在 scope gap — 漏掉了某条 AC 或只部分实现？
维度二：TDD 纪律
参考 tdd 技能中的测试质量标准：
- 是否存在没有对应 failing test 的生产代码？
- 测试是否通过公共接口验证行为，而非测试内部实现细节？
- 是否 mock 了内部模块/自己控制的类？
- Mock 是否仅在系统边界（外部 API、DB、时间、文件系统）？
- 是否能区分 "通过测试" 和 "测试正确"（假绿色）？
维度三：代码质量
对照项目 CONTEXT.md 和 docs/adr/：
- 命名是否使用项目领域词汇（CONTEXT.md）？
- 新代码是否遵循项目已有模式，而非引入新风格？
- 接口是否小、是否可测试（接口即测试面）？
- 是否引入了未在 AGENT-BRIEF 中声明的依赖？
- 是否与现有 ADRs 冲突？
维度四：计划忠实度与跨模块一致性
对照合约和所有上层计划文档（PRD、ADR），检查：
- 实现是否满足计划中声明的全局约束？如：输出格式要求（byte-identical、结构等价）、运行时约束、依赖白名单
- 是否存在约束降级 — 计划要求 A 但实现只做了 A'（如要求 byte-identical 但仅做了结构等价）？
- 是否引入了计划白名单外的依赖（package.json、import 语句）？
- 文件是否放在了计划指定的位置，而非自创目录？
- 工程约定是否一致 — 入口检测方式、import 风格（静态/动态）、错误处理模式、日志格式？
- 是否有不在任何合约中的新文件（孤儿脚本、未声明的测试文件、临时文件）？
- 是否有合约/计划明说要删除但尚未删除的文件？
- 是否引入了合约未声明的新行为（如悄悄加了 UX 优化、额外校验、额外日志）？
- 是否有未在合约中声明的副作用（自动创建目录、修改全局配置、静默改写其他模块的文件）？
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 150 lines · 39 tokens per session scan A 97dfb6ad00eb
reviewer is an agent published in the GitHub repository MatthewYe/opencode-toolbox (5 stars, last pushed 2mo ago), licensed MIT. It adds 39 tokens to every session and 2,031 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
Demonstrate
Agent for demonstrating VS Code features.
playwright-test-generator
Use this agent when you need to create automated browser tests using Playwright Examples: Context: User wants to generate a test for the test plan item.
.NET-Notebook-Migration-Agent
Expert .NET and documentation transformation agent that migrates Polyglot Jupyter notebooks into clean Markdown and companion .NET sample code.
AVM Owner Triage
Triage open GitHub issues across the Azure Verified Modules (AVM) repos an owner maintains. Splits the backlog into a Copilot-delegatable pile and a human pile, produces a report with a delegation ratio, and never comments or assigns without explicit user approval.
Ultimate Transparent Thinking Beast Mode
Agent "Ultimate Transparent Thinking Beast Mode" from github/awesome-copilot, covering quantum cognitive architecture, phase 2: adversarial intelligence & red-team analysis, phase 3: implementation & iterative refinement and phase 4: comprehensive verification & completion.
code-reviewer
Performs thorough code reviews for the Notebooks in the Cookbook repo, focusing on Python/Jupyter best practices, and project-specific standards. Use this agent proactively after writing any significant code changes, especially when modifying notebooks, Github Actions, and scripts.