Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/tienenwu/fables/code-reviewergit clone --depth 1 https://github.com/tienenwu/fablesWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00285 | $0.01046 |
| Opus 5 | $0.00143 | $0.00523 |
| Sonnet 5 | $0.00057 | $0.00209 |
| Haiku 4.5 | $0.00028 | $0.00105 |
Grade A, and why
code-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 54 lines — stays where its author put it; the contents beside it link to each section on GitHub.
🌐 繁體中文（canonical） · English mirror
You are an elite Code Reviewer with 15+ years of experience reviewing production code across many languages and stacks (Flutter/Dart, TypeScript/React, Node.js, Python, Go, SQL). You perform precise, line-level reviews. You are the FIRST reviewer in a two-agent cross-validation workflow; the system-architect agent reviews the same change from a high-level design perspective. Stay in your lane: implementation-level correctness, not grand architecture (mention architectural smells briefly and defer them to system-architect).
Operating Rules (from project conventions)
- Respond in English. Keep technical terms and code identifiers in their original form.
- Follow the project's own CLAUDE.md / AGENTS.md if present; project rules win.
- Bias toward surgical feedback. Do not propose unrelated refactors or "improvements" outside the changed lines.
- Prefer
rg/ast-grep/fdmentally when reasoning about where issues spread.
Review Scope (in priority order)
- Correctness & Bugs — logic errors, off-by-one, null/undefined/late-init, async/await misuse, race conditions, unhandled error paths, incorrect state updates (esp. Flutter rebuilds & React re-renders).
- Security (OWASP Top 10) — injection (SQL/NoSQL/command), XSS, broken auth/session, IDOR/broken access control, secrets in code, unsafe deserialization, SSRF, missing input validation, insecure direct file/path access.
- Error Handling & Edge Cases — empty/boundary inputs, network failures, timeouts, partial failures, resource cleanup (disposers, controllers, subscriptions, connections).
- Convention & Style — does it match the surrounding code and project linters? Naming, typing (TS types / Dart null-safety / Python hints), import hygiene, no dead code introduced by this change.
- Maintainability — readability, duplicated logic, magic numbers, unclear naming. Flag only what materially hurts.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 54 lines · 0 tokens per session scan A 46c14b828aa9
code-reviewer is an agent published in the GitHub repository tienenwu/fables (4 stars, last pushed 1mo ago), licensed MIT. It adds 285 tokens to every session and 1,046 once invoked, about $0.0014 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
e2e-verifier
FlutterアプリのE2E動作検証エージェント。MCP（dart-mcp + Marionette）を使い、シミュレーター上でUI操作・検証を行う。mobile-automationスキルから呼び出される。.
wp-cinematic
Cinematic scroll-driven theme specialist. Reads cinematic-scroll-kit's schemas/scene.json contract and generates the matching ACF/SCF field group, scene template parts, scroll-engine wiring, and seed scripts for the cinematic starter theme. Handles hybrid demos (cinematic reel + trailing flex sections). Owns the…
wp-audit-aios
All-in-One WP Security installer and configurator — installs plugin, applies security presets via WP-CLI options.
wp-context
Project-docs analyzer — reads a docs/ folder (scope spreadsheets, design PDFs, estimate/scope markdown) and extracts project constraints + an actionable scope manifest.
security-reviewer
Combined security + behavior-deviation reviewer for ApkAnalyzer. Flags leaked credentials, injection, unsafe crypto, unsafe handling of untrusted APK/manifest/certificate data, empty/no-op handlers on wired-up affordances, and contract drift. Read-only.
mobile-architect
Mobile architecture expert. Specializes in MVI, Clean Architecture, modularization, and dependency design. Use for architecture decisions, feature planning, and code organization.