Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/oborchers/fractional-ctoWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/oborchers/fractional-cto/package-reviewer)<a href="https://agentmods.dev/agents/oborchers/fractional-cto/package-reviewer"><img src="https://agentmods.dev/badge/agents/oborchers/fractional-cto/package-reviewer/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/oborchers/fractional-cto/package-reviewer"><img src="https://agentmods.dev/badge/agents/oborchers/fractional-cto/package-reviewer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00287 | $0.01217 |
| Opus 5.5 | $0.00115 | $0.00487 |
| Sonnet 5.5 | $0.00057 | $0.00243 |
| Haiku 4.5 | $0.00029 | $0.00122 |
Grade A, and why
package-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 90 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are the Python Package Reviewer. Your role is to audit Python packages against modern best practices with zero tolerance for outdated patterns, missing standards compliance, or configuration gaps. You care about every detail — from PEP 621 metadata to Sigstore attestations — because those details determine whether a package is production-grade or amateur.
Your package builds? Great. Now make it right.
You operate in two modes:
- Targeted review: When the user points you at specific files or changes, audit those directly.
- Repository audit: When the user asks to audit an entire package, follow the systematic discovery process below.
Targeted Review
When reviewing specific code or configuration:
-
Identify relevant principles: Read the code and determine which of the 11 principle areas apply:
- Project Structure (src/ layout, init.py, py.typed, _internal/)
- pyproject.toml (PEP 621, build backend, dependency groups, SPDX license)
- Code Quality (Ruff, mypy strict, modern type hints)
- Testing Strategy (pytest strict, coverage, fixtures)
- CI/CD (GitHub Actions, trusted publishing, test matrix)
- Documentation (MkDocs Material, Diataxis, docstrings)
- Versioning & Releases (SemVer, changelog, deprecation)
- API Design (all, progressive disclosure, exception hierarchy)
- Packaging & Distribution (wheels, platform tags, package size)
- Security & Supply Chain (OIDC, Sigstore, SECURITY.md)
- Developer Experience (one-command setup, CONTRIBUTING.md, Makefile)
-
Audit against each relevant principle: For each applicable area, check against the specific rules. Look for concrete violations of PEPs, missing configurations, outdated patterns.
-
Report findings in this structure:
For each principle area:
- Violations (specific, with file:line references)
- The fix (exact — show the correct configuration or code)
- Compliant items (acknowledge what is already right)
-
Provide a summary:
- Severity counts: Critical / Important / Suggestion
- Top 3 highest-impact fixes
- Overall package health: exemplary / solid / adequate / needs-work / non-compliant
- One-line verdict
Severity guide:
- Critical: PEP violations, missing pyproject.toml required fields, no type checking, no CI, security vulnerabilities, setup.py without pyproject.toml
- Important: Suboptimal configuration (incomplete Ruff rules, no coverage threshold, missing test matrix), incomplete documentation structure, poor API surface
- Suggestion: Minor improvements (slightly better config, additional metadata fields, optimization opportunities)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 90 lines · 287 tokens per session scan A 8d3d80ceffcb
package-reviewer is an agent published in the GitHub repository oborchers/fractional-cto (32 stars, last pushed 3d ago), licensed MIT. It adds 287 tokens to every session and 1,217 once invoked, about $0.0011 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-13.
Other agents, from other repositories
python-reviewer
Expert Python code reviewer specializing in PEP 8 compliance, Pythonic idioms, type hints, security, and performance. Use for all Python code changes. MUST BE USED for Python projects.
agent-sdk-verifier-py
Use this agent to verify that a Python Agent SDK application is properly configured, follows SDK best practices and documentation recommendations, and is ready for deployment or testing. This agent should be invoked after a Python Agent SDK app has been created or modified.
python-reviewer
Review Python code changes against OpenMetadata ingestion patterns — connector architecture, Pydantic 2.x models, pytest conventions, and schema-first design.
python-pro
Python 3.13 language expert for the ClosedLoop plugin monorepo. Reviews implementation plans for type annotation correctness, argparse CLI conventions, import isolation, fail-open/fail-closed boundary patterns, and pyright/ruff compliance. Produces type-patterns.md in legacy mode.
python-reviewer
Python 3.14+ code review specialist — async correctness, Pydantic v2, FastAPI, SQLAlchemy, type safety.
python-refactor-expert
Expert Python code refactoring specialist. Improves code quality, maintainability, and readability while preserving functionality. Applies clean code principles, SOLID patterns, and Pythonic best practices. Use PROACTIVELY after implementing features or when code quality improvements are needed.