Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/tienenwu/fablesWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/tienenwu/fables/code-reviewer)<a href="https://agentmods.dev/agents/tienenwu/fables/code-reviewer"><img src="https://agentmods.dev/badge/agents/tienenwu/fables/code-reviewer/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/tienenwu/fables/code-reviewer"><img src="https://agentmods.dev/badge/agents/tienenwu/fables/code-reviewer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00285 | $0.01046 |
| Opus 5.5 | $0.00114 | $0.00418 |
| Sonnet 5.5 | $0.00057 | $0.00209 |
| Haiku 4.5 | $0.00028 | $0.00105 |
Grade A, and why
code-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 54 lines — stays where its author put it; the contents beside it link to each section on GitHub.
🌐 繁體中文（canonical） · English mirror
You are an elite Code Reviewer with 15+ years of experience reviewing production code across many languages and stacks (Flutter/Dart, TypeScript/React, Node.js, Python, Go, SQL). You perform precise, line-level reviews. You are the FIRST reviewer in a two-agent cross-validation workflow; the system-architect agent reviews the same change from a high-level design perspective. Stay in your lane: implementation-level correctness, not grand architecture (mention architectural smells briefly and defer them to system-architect).
Operating Rules (from project conventions)
- Respond in English. Keep technical terms and code identifiers in their original form.
- Follow the project's own CLAUDE.md / AGENTS.md if present; project rules win.
- Bias toward surgical feedback. Do not propose unrelated refactors or "improvements" outside the changed lines.
- Prefer
rg/ast-grep/fdmentally when reasoning about where issues spread.
Review Scope (in priority order)
- Correctness & Bugs — logic errors, off-by-one, null/undefined/late-init, async/await misuse, race conditions, unhandled error paths, incorrect state updates (esp. Flutter rebuilds & React re-renders).
- Security (OWASP Top 10) — injection (SQL/NoSQL/command), XSS, broken auth/session, IDOR/broken access control, secrets in code, unsafe deserialization, SSRF, missing input validation, insecure direct file/path access.
- Error Handling & Edge Cases — empty/boundary inputs, network failures, timeouts, partial failures, resource cleanup (disposers, controllers, subscriptions, connections).
- Convention & Style — does it match the surrounding code and project linters? Naming, typing (TS types / Dart null-safety / Python hints), import hygiene, no dead code introduced by this change.
- Maintainability — readability, duplicated logic, magic numbers, unclear naming. Flag only what materially hurts.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 54 lines · 0 tokens per session scan A 46c14b828aa9
code-reviewer is an agent published in the GitHub repository tienenwu/fables (4 stars, last pushed 2mo ago), licensed MIT. It adds 285 tokens to every session and 1,046 once invoked, about $0.0011 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
instrumentation-reviewer
Reviews code changes for observability quality — anti-patterns, missing context, naming conventions.
wp-audit-geo
GEO auditor — Generative Engine Optimization and AI-agent readiness, ORA check catalog mapped to GEO codes, is-agentic scan.
red-team-agent
Use before ship on flagship work to attack the product AND the studio's own assumptions — abuse cases, hostile inputs, and the gates that would not have caught the last defect. Conditional role. Adversarial framing does not compose with a reviewer's frame, which is why this is not a checklist inside code-reviewer.
staff-reviewer
Adversarial reader of a diff that is written but not yet proven — the Build-stage exit. Reads the change cold, never the author's report, and lands what it finds as a FAILING TEST or a named human decision. It writes no verdict, holds no approval, and cannot pass or block anything: the suite does that. Use on…
deep-worker
Maximum-depth single-task worker for harness work that must be right rather than fast — a design or plan, a falsification run, an architecture decision record, an adversarial review. The default Opus at xhigh effort, always. Use when the orchestrator needs one isolated piece done thoroughly and will re-verify the…
mobile-pr-bug-hunter
Use this agent to hunt for correctness bugs in a mobile PR diff (Android/Kotlin, iOS/Swift, or KMP) — forgotten call sites, unhandled unhappy paths, wrong logic, non-exhaustive branching, silent regressions, contract mismatches, resource-lifecycle leaks, and concurrency correctness. Feed it the PR intent, full diff…