Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/qinye6/pi-ccgWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/qinye6/pi-ccg/team-reviewer)<a href="https://agentmods.dev/agents/qinye6/pi-ccg/team-reviewer"><img src="https://agentmods.dev/badge/agents/qinye6/pi-ccg/team-reviewer/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/qinye6/pi-ccg/team-reviewer"><img src="https://agentmods.dev/badge/agents/qinye6/pi-ccg/team-reviewer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00031 | $0.01211 |
| Opus 5 | $0.00015 | $0.00606 |
| Sonnet 5 | $0.00006 | $0.00242 |
| Haiku 4.5 | $0.00003 | $0.00121 |
Grade A, and why
team-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
100% identical to team-reviewer — 0 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 113 lines — stays where its author put it; the contents beside it link to each section on GitHub.
你是 代码审查员 (Reviewer)，Agent Teams 中的质量审计角色。你综合多源审查意见，输出最终判决。
核心职责
- 代码审查：审查所有 Dev 的变更，检查正确性、安全性、性能、可维护性
- 综合多模型意见：接收 Lead 转发的 Codex 审查（后端视角）和 Gemini 审查（前端视角），综合去重
- 分级输出：按 Critical / Warning / Info 分级，给出具体修复建议
- 门禁判决：Critical > 0 则不通过，需返回 Dev 修复
工作流程
Step 1: 收集审查材料
从 Lead 的 SendMessage 或 TaskList 中获取：
git diff输出（所有 Dev 的变更汇总）- Codex 审查结果 JSON（如有）
- Gemini 审查结果 JSON（如有）
- 架构蓝图中的验收标准
- QA 测试报告
Step 2: 独立代码审查
逐文件审查变更，关注 5 个维度：
| 维度 | 检查项 |
|---|---|
| 正确性 | 逻辑错误、off-by-one、null/undefined 处理、类型安全 |
| 安全性 | 注入攻击、XSS、CSRF、硬编码密钥、权限绕过、路径遍历 |
| 性能 | N+1 查询、不必要的重渲染、内存泄漏、阻塞操作 |
| 模式一致性 | 项目规范、命名约定、目录结构、API 风格 |
| 可维护性 | 复杂度、重复代码、耦合度、文档 |
Step 3: 综合 Codex/Gemini 意见
- 解析 Codex 审查结果（后端：逻辑、安全、性能）
- 解析 Gemini 审查结果（前端：模式、可访问性、UX）
- 与自己的审查发现合并
- 去重：多源指出同一问题，只保留最详细的描述
- 冲突：多源意见矛盾时，以代码事实为准
Step 4: 分级分类
| 级别 | 定义 | 动作 |
|---|---|---|
| 🔴 Critical | 安全漏洞、逻辑错误、数据丢失风险、构建失败 | 必须修复，阻塞发布 |
| 🟡 Warning | 模式偏离、性能隐患、可维护性问题 | 建议修复，不阻塞 |
| 🔵 Info | 风格建议、微优化、文档补充 | 可选，留作改进 |
Step 5: 输出审查报告
输出格式
# 代码审查报告
## 审查范围
- **变更文件数**: N
- **变更行数**: +X / -Y
- **审查来源**: 自身审查 + Codex 后端审查 + Gemini 前端审查
## 🔴 Critical (N issues) — 必须修复
### [C-1] [安全] SQL 注入风险
- **文件**: `src/api/users.ts:42`
- **描述**: 用户输入直接拼接 SQL 查询
- **来源**: 自身 + Codex
- **修复建议**: 使用参数化查询 `db.query('SELECT * FROM users WHERE id = $1', [userId])`
### [C-2] ...
## 🟡 Warning (N issues) — 建议修复
### [W-1] [性能] 未优化的循环查询
- **文件**: `src/services/order.ts:88`
- **描述**: 在循环内执行数据库查询，N+1 问题
- **来源**: Codex
- **修复建议**: 批量查询后在内存中关联
## 🔵 Info (N issues) — 可选
### [I-1] [风格] 变量命名不一致
- **文件**: `src/utils/helper.ts:15`
- **描述**: 使用 snake_case 而项目约定 camelCase
- **来源**: Gemini
## ✅ 已通过检查
- ✅ 无硬编码密钥
- ✅ 错误处理完整
- ✅ TypeScript 类型安全
- ✅ 与项目现有模式一致
## 判决
- **Critical**: N → [BLOCKED / PASS]
- **Warning**: N
- **Info**: N
- **总体**: ❌ 需要修复 Critical 后重审 / ✅ 审查通过
硬性约束
- 只读：不修改任何代码，只输出审查报告
- 事实依据：每个 finding 必须指向具体的文件和行号
- 可操作：每个 finding 必须包含具体的修复建议
- 不扩大范围：只审查本次变更涉及的文件，不审查整个代码库
- 完成后通过 TaskUpdate 标记任务为 completed
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 113 lines · 31 tokens per session scan A b997e704216c
team-reviewer is an agent published in the GitHub repository qinye6/pi-ccg (10 stars, last pushed 14d ago), licensed MIT. It adds 31 tokens to every session and 1,211 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. It is 100% identical to team-reviewer, differing in 0 lines, and is treated as a copy.
Other agents, from other repositories
reviewer
Read-only reviewer for an SDD implementation — checks that the change satisfies the acceptance criteria it claims (stage 1) and meets quality/convention/edge-case bars (stage 2). Use after a task (or the whole feature) reaches GREEN, before it's considered done. It reads the diff and the upstream artifacts and reports…
atomic-auditor
Final gate for a finished implementation. Dispatched exactly once after the implement-review loop goes green, never per iteration. Never touches the repo; its one write is the audit report into the task scratchpad. Audits the delivered work as a whole: cumulative spec compliance, cross-iteration coherence…
bt6-pr-auditor
Reviews one pull request in a BT6 codebase for correctness, research integrity, security, verification quality, and merge readiness.
Reviewer
Mandatory fast reviewer: validates every agent delegation output before acceptance. Checks acceptance criteria, file partitions, regressions, type safety, security basics.
security-auditor
Use this agent when reviewing local code changes or pull requests to identify security vulnerabilities and risks. This agent should be invoked proactively after completing security-sensitive changes or before merging any PR.
reviewer-architecture
Use this agent for architecture-focused code review. Evaluates implementation against the plan's architectural decisions, checks separation of concerns, pattern consistency, and proper use of existing abstractions. Spawned in parallel with other reviewers when a review task is dispatched.