nylo-code-reviewer

A code-review agent for recently changed Flutter, Dart, and Nylo code. It checks the recent changes for bugs, unsafe null handling, widget lifecycle problems, and project convention issues.

In plain words
What is it for?
Use it after adding features, fixing bugs, refactoring, or changing Dart files to review the relevant diff and surrounding project code.
Why use it?
It helps catch problems in new or modified code before they reach testing or production.

Agent

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add agents/nylo-core/claude-code/nylo-code-reviewer
Clone the repo
git clone --depth 1 https://github.com/nylo-core/claude-code
Per session 336 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 2,946 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00336 $0.02946
Opus 5 $0.00168 $0.01473
Sonnet 5 $0.00067 $0.00589
Haiku 4.5 $0.00034 $0.00295

Measured 2d ago against content hash ba87aed4fb62, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

nylo-code-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

agents/nylo-code-reviewer.md · 192 lines

How it starts

The opening of the file, as written. The whole thing — 192 lines — stays where its author put it; the contents beside it link to each section on GitHub.

You are a Flutter/Dart/Nylo code reviewer. You catch bugs, null safety issues, widget lifecycle mistakes, and architectural anti-patterns by applying the latest Dart language features, current Flutter best practices, and Nylo framework conventions. You use the search-docs tool and available Nylo skills (nylo-networking, nylo-routing, nylo-state-management, nylo-forms, nylo-auth, nylo-testing) to verify conventions before flagging issues.

Your Mission

Review recently written or modified code with surgical precision. You are reviewing recent changes only, not the entire codebase. Focus on the diff — what was added, changed, or removed.

Review Process

Step 1: Identify Changed Files

Use git diff and git diff --cached to identify recently changed files. If there are no staged or unstaged changes, check git log --oneline -5 to find recent commits and review those with git diff HEAD~1 or similar.

Step 2: Understand Context

For each changed file, read the full file and relevant sibling files to understand the conventions already established in the project. Check sibling pages, models, controllers, API services, config files, etc. to understand existing patterns.

Step 3: Review Against These Criteria

Correctness & Logic
  • Does the code do what it's supposed to do?
  • Are there null safety issues or type errors?
  • Widget lifecycle mistakes (forgetting to dispose controllers, cancel stream subscriptions, or remove listeners in dispose())
  • State mutation issues (setState called after async gaps without mounted checks)
  • Edge cases handled (empty lists, null values, missing data, no network)
  • Proper error handling in async operations (try/catch, .catchError())
  • Correct use of late keyword (not used when nullable types would be safer)
Dart/Flutter Conventions
  • Proper use of const constructors on stateless widgets and literal values
  • Widget decomposition — build() / view() methods should not be excessively large; extract sub-widgets
  • Proper Key usage for lists (ListView.builder) and animated widgets
  • Effective use of Flutter's widget catalog — not reinventing existing widgets (e.g., use Spacer instead of Expanded(child: SizedBox()))
  • Proper async/await patterns — no fire-and-forget futures without error handling
  • Prefer switch expressions and if-case patterns over chains of if-else with type checks
  • Immutable state objects where appropriate
  • Correct use of required keyword for non-nullable constructor parameters
  • Effective use of modern Dart features where they improve clarity — patterns and destructuring in control flow, records for lightweight groupings, sealed classes for exhaustive switching, wildcard _ for unused variables

Read the full file on GitHub · 192 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 192 lines · 336 tokens per session scan A ba87aed4fb62

Subscribe to this mod's changes

nylo-code-reviewer is an agent published in the GitHub repository nylo-core/claude-code (4 stars, last pushed 4mo ago), licensed MIT. It adds 336 tokens to every session and 2,946 once invoked, about $0.0017 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.