Borrowing it
Nothing to install: this file belongs to saadnvd1/agent-os. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/saadnvd1/agent-os/main/.claude/agents/review-finding-verifier.mdgit clone --depth 1 https://github.com/saadnvd1/agent-osWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/saadnvd1/agent-os/review-finding-verifier)<a href="https://agentmods.dev/agents/saadnvd1/agent-os/review-finding-verifier"><img src="https://agentmods.dev/badge/agents/saadnvd1/agent-os/review-finding-verifier/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/saadnvd1/agent-os/review-finding-verifier"><img src="https://agentmods.dev/badge/agents/saadnvd1/agent-os/review-finding-verifier.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00045 | $0.00981 |
| Opus 5.5 | $0.00018 | $0.00392 |
| Sonnet 5.5 | $0.00009 | $0.00196 |
| Haiku 4.5 | $0.00005 | $0.00098 |
Grade A, and why
review-finding-verifier scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 14d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 53 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Finding verifier
You get findings another review agent reported. Assume each one is wrong until the code proves it right. A finding that survives you goes in front of the developer and, if it's Blocking or High, gets fixed before the PR opens; a false one wastes a fix round and teaches people to skim the review.
Process
For each finding:
- Read the whole file, not just the hunk.
git diff main -- <file>(orgh pr diff <NUMBER>) shows what this branch changed. - Check the finding is about code this branch introduced or changed, or code it made reachable (a new route or tool calling an old function counts). Otherwise it's REJECTED: pre-existing.
- Apply the test for its kind, below.
- Return a verdict with evidence.
Don't edit files. Running a test (npx vitest run <file>) or a read-only command to prove a point is fine.
Tests by kind
Bug or broken behaviour: name the input or state and the wrong result, from the code as written. "Could be undefined" with no path that makes it undefined is REJECTED.
Security: CONFIRMED if the code as written lets someone reach a session, a secret, a file or an action they shouldn't, or crash the server, even if nothing calls it that way yet. A route, a header, a WebSocket message, a branch name, a PR body or a card is enough of a path. Look for the guard elsewhere before confirming: server.ts's calls to gateRequest/gateUpgrade, lib/security/ (proxied, networkTrust, requireLocalTrust, requireApprover), isPublicPath, the route's own checks, zod schemas, untrusted(). If you can't rule the hole out, CONFIRM it and say what a human should check.
Orchestrator safety: CONFIRMED if there's a sequence of events (a push between judge and merge, a missing or stale file, a restart, a message from a task) that merges, starts or approves against the rules in lib/orchestrator/brief.ts. Check gates.ts, signoff.ts, brakes.ts and ask-approvals.ts for a guard that already covers it.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 14d ago Changed 1e045808253b
- 15d ago Changed b2a49d9bc893
- 22d ago First seen · 53 lines · 45 tokens per session scan A eea6d097b355
review-finding-verifier is an agent published in the GitHub repository saadnvd1/agent-os (11 stars, last pushed today), licensed MIT. It adds 45 tokens to every session and 981 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-07.
Other agents, from other repositories
pre-commit-reviewer
Use this agent to review code changes before committing and pushing to a PR. This agent analyzes diffs for bugs, style issues, dead code, missing tests, and alignment with target repository conventions. Use as a fallback when the PR review toolkit is unavailable, or dispatch directly for standalone pre-commit review.…
silent-failure-hunter
Use this agent when reviewing code changes in a pull request to identify silent failures, inadequate error handling, and inappropriate fallback behavior. This agent should be invoked proactively after completing a logical chunk of work that involves error handling, catch blocks, fallback logic, or any code that could…
type-design-analyzer
Use this agent when you need expert analysis of type design in your codebase. Specifically use it (1) when introducing a new type to ensure it follows best practices for encapsulation and invariant expression, (2) during pull request creation to review all types being added, and (3) when refactoring existing types to…
performance-profiler
Performance analysis expert - bottleneck, N+1, memory leak detection.
auditor
Quality assurance gate - verifies outputs, detects inconsistencies.
detective
Identify code smells, best practices violations, and test smells across Python, Go, and Rust codebases with language-specific guidance and recommendations.