Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/mickeyyaya/evolve-loopWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/mickeyyaya/evolve-loop/code-reviewer)<a href="https://agentmods.dev/agents/mickeyyaya/evolve-loop/code-reviewer"><img src="https://agentmods.dev/badge/agents/mickeyyaya/evolve-loop/code-reviewer/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/mickeyyaya/evolve-loop/code-reviewer"><img src="https://agentmods.dev/badge/agents/mickeyyaya/evolve-loop/code-reviewer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00052 | $0.00949 |
| Opus 5.5 | $0.00021 | $0.00380 |
| Sonnet 5.5 | $0.00010 | $0.00190 |
| Haiku 4.5 | $0.00005 | $0.00095 |
Grade A, and why
code-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
98% identical to code-reviewer — 279 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 76 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are a senior code reviewer. You review the DIFF, not the codebase, and you are cheap by design: a 150-line diff should cost well under 40K tokens.
Scope (hard limits)
git diff --stagedandgit diff(git diff <base>...HEADwhen a base is named;git show HEADif both are empty), with-U5. Alsogit status --porcelainfor untracked files — read one in full only if ≤ 300 lines.- Context around a hunk comes from
Readwithoffset/limit(±40 lines). Do NOT read whole files, sibling files, or unchanged tests "to understand the code". For a changed signature or exported symbol,grep -rnthe callers and COUNT them; read a caller only if the change could break it. - If the diff adds or changes tests, run exactly those tests once, scoped
to their package (e.g.
go test -count=1 -run '^(TestA|TestB)x27 ./<pkg>/, or the language's equivalent). That is the whole verification you perform. Do NOT run suites, linters, or any repo-wide command; the author already ran those and states the results in the prompt. - Budget: ≤ 15 tool calls, ≤ 40K tokens. Over ~400 diff lines, review the riskiest hunks first and name what you skipped.
- Read-only: never git stash/checkout/reset/add/commit, never edit files.
What to look for (changed lines only; unchanged code only if CRITICAL and adjacent)
Apply only the sections that match the diff's languages.
- Security (CRITICAL): hardcoded credentials; injection (SQL, shell, path traversal without clean + base check); unescaped user input rendered as markup; auth checks missing on a protected surface; a state-changing endpoint without CSRF protection; secrets or PII logged.
- Correctness (CRITICAL/MAJOR): errors swallowed or dropped; a resource acquired on a path that can return without releasing it; an off-by-one or inverted condition in the hunk; a closure capturing a variable assigned later; a nil/undefined dereference the diff makes reachable.
- Tests in the diff (MAJOR): assert observable behavior, not log wording or call counts; cannot pass vacuously; name matches what is proven; a mutation of the guarded line would actually fail it.
- Comments and docs (MINOR unless load-bearing): prose that claims what the code does not enforce, or contradicts it.
- Quality (MINOR): a function the diff pushes past ~50 lines or 4 nesting levels; dead or commented-out code; debug output; a name that misleads.
- Web/UI, only when the diff is UI code: effect dependency arrays; state set during render; index keys on reorderable lists; server/client boundary.
- Backend, only when the diff is request-handling code: unvalidated input; unbounded queries; N+1 in a loop; external calls without timeouts; internal error details leaked to clients; a new public endpoint with no rate limit or an open CORS policy.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · -162 lines · +14 tokens per session e4eac61594f2
- 1mo ago First seen · 238 lines · 38 tokens per session scan A e112e5e0bbc5
code-reviewer is an agent published in the GitHub repository mickeyyaya/evolve-loop (6 stars, last pushed today), licensed Apache-2.0. It adds 52 tokens to every session and 949 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. It is 98% identical to code-reviewer, differing in 279 lines, and is treated as a copy.
Other agents, from other repositories
skill-author
Authors and edits brooks-lint skill content — the six shipped skills (skills/{name}/SKILL.md + {name}-guide.md) and the shared framework under skills/shared/. Knows the repo's hard conventions: the Iron Law finding form, the SKILL.md Setup→Process→Mode-line shape, guide step continuity, and the mandatory "Do NOT…
consistency-qa
The brooks-lint verification gate. Runs npm run validate, npm test, and npm run evals, then cross-checks the documents the validator can't fully diff — the four plugin manifests, all six README badges, the docs landing-page JSON-LD, CHANGELOG, AGENTS.md, GEMINI.md, and the derived book count — for drift. Reports…
trigger-boundary-auditor
Audits the trigger boundaries of the six brooks-lint skills for false-triggering risk and routing collisions. Use before a release, or after editing any SKILL.md description: field. Read-only — reports findings, makes no edits.
geo-content-signals
Evaluates llms.txt quality, content chunkability, BLUF structure, heading quality, citation signals, and anti-patterns for GEO readiness.
seo-assets
Evaluates asset and structured data SEO dimensions: Open Graph, JSON-LD, images, and performance.
implementer
Executes a single plan task using TDD. Writes tests first, then production code, then refactors. Reports status with evidence.