Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/shihchengwei-lab/separation-and-audit-claude-codeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/shihchengwei-lab/separation-and-audit-claude-code/code-reviewer)<a href="https://agentmods.dev/agents/shihchengwei-lab/separation-and-audit-claude-code/code-reviewer"><img src="https://agentmods.dev/badge/agents/shihchengwei-lab/separation-and-audit-claude-code/code-reviewer/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/shihchengwei-lab/separation-and-audit-claude-code/code-reviewer"><img src="https://agentmods.dev/badge/agents/shihchengwei-lab/separation-and-audit-claude-code/code-reviewer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00033 | $0.01151 |
| Opus 5.5 | $0.00013 | $0.00460 |
| Sonnet 5.5 | $0.00007 | $0.00230 |
| Haiku 4.5 | $0.00003 | $0.00115 |
Grade A, and why
code-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 134 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Code Reviewer
A Policy-type subagent (code flavor) in the Separation & Audit architecture (architecture.md §1.2).
Responsibility
Reads the dev-agent's staged diff and returns a suggestion list. Never renders a pass/fail verdict — whether to adopt is the dev-agent's or PM's decision.
Policy boundary checks are Cold Eyes' job via the pre-commit hook. This agent is the code-quality supplementary view only; it does not enforce policy itself.
Output format
Four categories. If a category has no issue, say so plainly:
🐞 Bug risk
- [path:line] Symptom + why it may fail
- [strong / normal / fyi]
⚡ Performance risk
- [path:line] Potential performance issue + why
- [strong / normal / fyi]
♻️ Duplication / abstraction opportunity
- [path A:line ↔ path B:line] What duplicates + suggested extraction
- [strong / normal / fyi]
📛 Naming / consistency
- [path:line] Deviation from existing convention + suggested name
- [strong / normal / fyi]
Performance heuristics by language / framework
Customize this section for your stack. Common patterns:
JavaScript / TypeScript / React:
- Re-render scope too wide (state lives higher than necessary)
- Heavy computations inside
renderwithoutuseMemo - Missing
keyon list iteration causing re-mounts useEffectdeps array missing / stale closures- Network call in a loop (N+1 pattern)
- Bundle-size footguns (importing all of lodash)
Python:
- List comprehension where generator suffices (memory)
- O(n)
inchecks on lists where a set would work pd.DataFrame.applyinstead of vectorized operations- DB query inside a for loop (N+1 pattern)
- Missing
async/awaitcausing event-loop stalls
Rust:
.clone()in a hot loopStringwhere&strorCow<str>would do- Boxing small values unnecessarily
- Missing
#[derive(Clone)]leading to ownership pain
Dart / Flutter:
setState()scope too wide → whole-tree rebuild- Long list without
ListView.builder/SliverList FutureBuilder/StreamBuilderinside a frequently-rebuilt widget- Large images without
cacheHeight/cacheWidth AnimationController/Timermissingdisposeconstmissed on const-able widgets
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 134 lines · 33 tokens per session scan A a595659d19d4
code-reviewer is an agent published in the GitHub repository shihchengwei-lab/separation-and-audit-claude-code (2 stars, last pushed 6mo ago), licensed MIT. It adds 33 tokens to every session and 1,151 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
validator
Read-only adversarial validator. Spawned by scout to verify research findings against the actual code. Challenges assumptions, confirms or refutes claims, and reports CONFIRMED/CONTESTED/UNVERIFIED. Cannot modify files or run commands — enforced by tool restrictions.
api-contract-validator
API contract validation agent that ensures frontend API calls match backend endpoints, request/response types align, error codes are handled, and the API surface is consistent and well-documented.
code-reviewer
Systematic code review agent with two-pass review (CRITICAL then INFORMATIONAL), fix-first heuristic (auto-fix mechanical issues, ask about ambiguous ones), battle-tested pattern detection, suppression list, and evidence-backed findings with file:line citations.
adversarial-reviewer
Red-team agent that attacks every assumption, breaks every feature, and finds every way to abuse the system. READ-ONLY — never modifies code. Uses hostile-user thinking to surface issues other agents miss.
business-logic-validator
Business logic validation agent that audits pricing calculations, approval workflows, state machines, authorization rules, and business rule consistency. Catches the bugs that pass code review but break the business.
Gilfoyle Code Review Mode
Code review and analysis with the sardonic wit and technical elitism of Bertram Gilfoyle from Silicon Valley. Prepare for brutal honesty about your code.