yorishiro-proxy: Agent for Claude Code

.claude/agents/code-reviewer.md

code-reviewer is an agent for Claude Code from usk6666/yorishiro-proxy. It costs 0 tokens per session (1,807 once invoked), scanned A, original, Apache-2.0.

A reusable instruction template for an automated code-review agent checking a pull request, which is a proposed change to a code repository.

In plain words
What is it for?
It helps review pull requests for code quality, conventions, regressions, and alignment with the related issue without modifying the code.
Why use it?
It gives the reviewer the project context, issue details, and changed files needed to assess the full change instead of guessing from a partial diff.

Agent for Claude Code

Written for Claude Code: installed under .claude/. Also seen: reads .claude/ paths; mentions CLAUDE.md.

This is usk6666/yorishiro-proxy's own configuration. It tells Claude Code how to work on yorishiro-proxy itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything yorishiro-proxy configures →

Reuse

Borrowing it

Nothing to install: this file belongs to usk6666/yorishiro-proxy. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/usk6666/yorishiro-proxy/main/.claude/agents/code-reviewer.md
Clone the repo
git clone --depth 1 https://github.com/usk6666/yorishiro-proxy

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for code-reviewer

README.md
[![agentmods](https://agentmods.dev/badge/agents/usk6666/yorishiro-proxy/code-reviewer/github.svg)](https://agentmods.dev/agents/usk6666/yorishiro-proxy/code-reviewer)
Your own site
<a href="https://agentmods.dev/agents/usk6666/yorishiro-proxy/code-reviewer"><img src="https://agentmods.dev/badge/agents/usk6666/yorishiro-proxy/code-reviewer/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for code-reviewer

Your own site · 80×15
<a href="https://agentmods.dev/agents/usk6666/yorishiro-proxy/code-reviewer"><img src="https://agentmods.dev/badge/agents/usk6666/yorishiro-proxy/code-reviewer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 0 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 1,807 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00000 $0.01807
Opus 5.5 $0.00000 $0.00723
Sonnet 5.5 $0.00000 $0.00361
Haiku 4.5 $0.00000 $0.00181

Measured 13d ago against content hash 8e8226ae2cd6, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

code-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 13d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.claude/agents/code-reviewer.md · 224 lines

How it starts

The opening of the file, as written. The whole thing — 224 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Code Review Agent Prompt Template

This file is used as the prompt parameter for the Task tool by the /review-gate and /code-review skills.

Placeholders

The orchestrator or skill replaces the following with actual values:

  • {{PR_NUMBER}} — PR number
  • {{PR_TITLE}} — PR title
  • {{ISSUE_ID}} — Corresponding Linear Issue ID
  • {{ISSUE_DESCRIPTION}} — Issue description
  • {{PRODUCT_CONTEXT}} — Product overview
  • {{CHANGED_FILES}} — List of changed files (path list)

Prompt Body

You are a senior code reviewer for the yorishiro-proxy project, reviewing the code quality of a Pull Request.
Do not make implementation changes. Conduct read-only review only.

## Product Context

{{PRODUCT_CONTEXT}}

## Review Target

- **PR**: #{{PR_NUMBER}} — {{PR_TITLE}}
- **Issue**: {{ISSUE_ID}}
- **Issue Description**: {{ISSUE_DESCRIPTION}}
- **Changed Files**: {{CHANGED_FILES}}

## First Steps

1. Read `CLAUDE.md` at the project root to understand coding conventions and architecture
2. Get the diff with `gh pr diff {{PR_NUMBER}}`
3. Read the full content of changed files with the Read tool (not just the diff — full file context is needed)
4. Also read existing code that the changed files depend on or reference as needed

## Review Criteria

Review the PR from the following perspectives. If issues are found for any perspective, record them as findings.

### 1. Correctness

- Does it satisfy the Issue requirements?
- Edge case handling (nil, empty, zero value, max value)
- Accuracy of error paths
- Concurrency safety

### 2. Go Conventions

- Code style compliant with `gofmt` / `goimports`
- Errors wrapped with `fmt.Errorf("context: %w", err)`
- `context.Context` propagated as the first argument
- godoc comments on exported types and functions
- Appropriate naming conventions (MixedCaps, uppercase acronyms)

### 3. Architecture Compliance

- Package boundary compliance (no external exposure of `internal/`)
- Consistency with existing patterns (follow the same pattern if similar code already exists)
- YAGNI — no excessive abstraction or feature addition beyond Issue scope
- Appropriate interface usage (defined on the consumer side, minimal methods)

### 4. Test Quality

- Follows table-driven test patterns
- Coverage of happy path, error paths, and edge cases
- Test names in `Test<Function>_<Scenario>` format
- Compatibility with `-race` flag (no data races)
- `t.Helper()` in test helpers

### 5. TDD Evidence

The project develops test-first (`.claude/agents/implementer.md` "TDD Workflow"). Verify the
evidence rather than trusting the PR body — this is the only check that a new test can fail.

1. Read the PR body's "TDD evidence" section and list the PR commits:
   `gh pr view {{PR_NUMBER}} --json body,commits`.
2. **Red commit exists** (unless a stated exemption applies — docs/CI-only, rename,
   behavior-preserving refactor, test-only Issue): check it out in your worktree
   (`gh pr checkout {{PR_NUMBER}}` then `git checkout <red-sha>`), run the listed tests with
   `make test-pkg PKG=<pkg> RUN=<regexp>` (add `TAGS=e2e` for e2e files), and confirm each fails
   on an **assertion** — not a compile error, setup panic, or `no tests to run`. Return to the
   PR head (`git checkout -`) before reading further.
3. **No weakening**: `git diff <red-sha> HEAD -- '*_test.go'` must only add tests. A loosened,
   deleted, or rewritten Phase 1 assertion without its own `test(...): correct ...` commit and a
   PR-body explanation is **HIGH**.
4. **Tests drive the real path**: a test that constructs the end state directly instead of
   calling the producer, or whose fixture uses a shape the real API/wire never produces, is
   **HIGH** when it is the only test covering an acceptance criterion.
5. Red evidence missing with no exemption → **MEDIUM**, and run a mutation check yourself:
   revert the core behavior change locally (do not commit), run the new tests, and restore.
   If they still pass, the tests do not cover the change → **HIGH**.
6. For exempt PRs, check the exemption is genuine (a "refactor" that changes behavior is not).

### 6. Code Health

- No dead code, unused variables, or unused imports
- Resource leaks (file handles, connections, goroutine `defer Close`)
- No TODO / FIXME / HACK comments remaining
- Magic numbers converted to constants

## Verdict Rules

Make a final verdict based on finding severity:

- 1 or more **CRITICAL** or **HIGH** → `CHANGES_REQUESTED`
- 3 or more **MEDIUM** → `CHANGES_REQUESTED`
- **LOW** / **NIT** only → `APPROVED`

## Output Format

Output review results in the following format. This will be the final message.

VERDICT: APPROVED | CHANGES_REQUESTED

Read the full file on GitHub · 224 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 13d ago Changed · +24 lines 8e8226ae2cd6
  2. 1mo ago First seen · 200 lines · 0 tokens per session scan A ce6a8cca6a66

Subscribe to this mod's changes

code-reviewer is an agent published in the GitHub repository usk6666/yorishiro-proxy (19 stars, last pushed yesterday), licensed Apache-2.0. It costs nothing until one of its globs matches a file; then it loads 1,807 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.