code-review

A read-only review procedure for a completed multi-file code change. It looks for problems that file-by-file checks can miss, such as inconsistent parallel code paths or writes that appear successful without changing anything.

In plain words
What is it for?
Use it after changes that cross files or system boundaries. It traces the diff, checks affected code paths and data flows, and produces a grade from A to F.
Why use it?
It helps find cross-file behaviour gaps before a change is committed, without changing the repository.

Agent

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add agents/vindm/dotclaude/code-review
Clone the repo
git clone --depth 1 https://github.com/vindm/dotclaude
Per session 65 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 1,603 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00065 $0.01603
Opus 5 $0.00032 $0.00801
Sonnet 5 $0.00013 $0.00321
Haiku 4.5 $0.00006 $0.00160

Measured yesterday against content hash c26869bccebb, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

code-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

plugins/core/agents/code-review.md · 88 lines

How it starts

The opening of the file, as written. The whole thing — 88 lines — stays where its author put it; the contents beside it link to each section on GitHub.

You are a second pair of eyes on a specific change (not the whole repo). You grep-trace the change and report gaps a careful per-file review would still miss. You do not review style or formatting — linters/formatters own that; re-reviewing indentation wastes your reasoning budget.

The value is in what one-file-at-a-time tools cannot catch: parallel-path drift (two paths updating the same table / calling the same API / handling the same event, one with guards the other lacks), trust-boundary no-ops (a write that returns success-shaped but silently did nothing), cascade-through-valid (a bad value enters five layers upstream and propagates through valid-shaped ops until something finally asserts), cache-invalidation gaps (a mutation updates X but forgets to invalidate the keys that read it), and implicit-guarantee violations (a comment says "never null"; the code returns null).

Run these five phases, in order

  1. Understand the change. Read git diff --stat and git diff; for each touched file read enough surrounding code to state the change's purpose in one sentence. If you can't, that unclear intent is itself a finding.
  2. Blast-radius analysis. For every changed function / hook / type / table / constant, grep for direct callers, other references to the identifier, and sibling modules touching the same external resource. Output a "who depends on this" graph. This is the highest-leverage step — skip it and parallel-path bugs are invisible.
  3. Parallel-path detection (your signature move). For every operation the change performs (a write, a call, a job enqueue, a cache invalidation), search for OTHER code paths doing the same operation, and ask: will the new code keep the same guarantees? Red flags: two paths writing the same table with different field sets; different filtering on the same query; one path handles errors, the other swallows; one invalidates caches, the other forgets; one retries, the other gives up; conditional logic one place that the sibling lacks.
  4. Consistency checks. Walk: data-flow (required fields, cache invalidation, error handling), error-type propagation, type-safety (as unknown as / any / unchecked casts), trust-boundary (permission-scoped writes actually verified).
  5. Graded report. A single S/A/B/C/D/F grade plus the structured sections below.

Read the full file on GitHub · 88 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday First seen · 88 lines · 65 tokens per session scan A c26869bccebb

Subscribe to this mod's changes

code-review is an agent published in the GitHub repository vindm/dotclaude (1 stars, last pushed 5d ago), licensed MIT. It adds 65 tokens to every session and 1,603 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Related

Other agents, from other repositories

coder-reviewer

Use this agent for code quality review of completed implementations — assessing maintainability, performance, test coverage, and standards compliance as the final quality gate before security review. For example: reviewing a finished frontend/backend feature and producing prioritized findings…

wesammustafa/Claude-Code-Everything-You-Need-to-Know · 66 tokens

frontend-engineer

Use this agent to implement user-facing features — transforming UX designs and technical specifications into responsive, accessible, high-performance user interfaces with API integration and tests. Delegate frontend build work such as UI components, styling, client-side state and data handling, or web performance…

wesammustafa/Claude-Code-Everything-You-Need-to-Know · 57 tokens

ux-designer

Use this agent for UX and UI design work — user research, journey maps, wireframes, interactive prototypes, design systems, and WCAG-compliant design specifications ready for development handoff. Delegate when designs need to be created or validated before technical architecture and implementation begin.

wesammustafa/Claude-Code-Everything-You-Need-to-Know · 58 tokens

tech-lead-architect

Use this agent for technical architecture design, technology stack decisions, and system design specifications — engage after UX/design requirements are established but before detailed implementation begins. For example: planning the architecture for an event management dashboard from completed UX designs, choosing…

wesammustafa/Claude-Code-Everything-You-Need-to-Know · 74 tokens

project-manager

Use this agent for comprehensive project planning, cross-functional team coordination, progress tracking, and delivery management of development initiatives. For example: planning a 6-week user authentication project across a UX designer, backend developer, and QA tester, or regaining control of a project facing…

wesammustafa/Claude-Code-Everything-You-Need-to-Know · 62 tokens

refactor-expert

Code refactoring specialist focused on clean architecture, SOLID principles, and technical debt reduction. Use proactively for code quality improvements and architectural refactoring.

alirezarezvani/claude-code-tresor · 34 tokens