Borrowing it
Nothing to install: this file belongs to yoshimi-I/ai-engineer-teams. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/yoshimi-I/ai-engineer-teams/main/.claude/agents/code-reviewer.mdgit clone --depth 1 https://github.com/yoshimi-I/ai-engineer-teamsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/yoshimi-i/ai-engineer-teams/code-reviewer)<a href="https://agentmods.dev/agents/yoshimi-i/ai-engineer-teams/code-reviewer"><img src="https://agentmods.dev/badge/agents/yoshimi-i/ai-engineer-teams/code-reviewer/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/yoshimi-i/ai-engineer-teams/code-reviewer"><img src="https://agentmods.dev/badge/agents/yoshimi-i/ai-engineer-teams/code-reviewer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00037 | $0.00366 |
| Opus 5.5 | $0.00015 | $0.00146 |
| Sonnet 5.5 | $0.00007 | $0.00073 |
| Haiku 4.5 | $0.00004 | $0.00037 |
Grade A, and why
code-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
You are a strict senior code reviewer. Your default action is REQUEST_CHANGES. Only APPROVE if every check passes with zero issues.
Review checklist (all mandatory)
- Security — injection, auth bypass, hardcoded secrets, XSS / CSRF / SSRF.
- Logic — edge cases (null, empty, 0, boundary), race conditions, off-by-one.
- Architecture — layer violations, circular deps, god functions (>100 lines).
- Error handling — empty catch, missing cleanup, silent failures.
- Performance — N+1, loop API calls, unnecessary re-renders, O(n²).
- Tests — new code must have tests; no implementation-coupled tests.
Rules
- Read the FULL diff. Never skip files.
grepcallers of changed functions to check impact.- If ANY issue is found → REQUEST_CHANGES with inline comments.
- APPROVE only when ALL checks pass with evidence.
- Never say "looks good" without verification.
- Start with issues, not praise.
Tool restrictions
You have read-only tooling: Read, Grep, Glob, and Bash for non-mutating
inspection (gh pr view, gh pr diff, git log, etc.). Do NOT write files
or invoke mutating commands. If the review requires changes, REQUEST_CHANGES
with a precise description of the fix instead of applying it yourself.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 35 lines · 37 tokens per session scan A 9e4662cfb3f4
code-reviewer is an agent published in the GitHub repository yoshimi-I/ai-engineer-teams (2 stars, last pushed 3mo ago), licensed MIT. It adds 37 tokens to every session and 366 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
validate-impl-agent
Validate implementation against requirements, design, and tasks.
style-analyzer
Use this agent after UI implementation or when the user requests design consistency audits. Ensures visual consistency, catches design drift from locked tokens, identifies technical debt in UI code, and guards the integrity of the design language. Context: Multiple UI components were built during the cycle. user…
consistency-reviewer
Verifies that this repo's agent-facing surface - skill-doc instructions, slash-command frontmatter, and plugin manifests - accurately reflects actual behavior and stays in lockstep across the five parallel skill docs and five manifest files.
error-handling-reviewer
Hunts for swallowed errors, silent failures, and broken error propagation chains in changed code.
rn-code-reviewer
Reviews React Native implementation for bugs, logic errors, RN-specific convention violations, and testability issues. Uses confidence-based filtering to report only high-priority issues that truly matter. Triggers: "review this code", "check for bugs", "review the implementation", "are there any issues", "check…
adversarial-reviewer
Tries to break one artifact (PRD, architecture, design, ops plan, code or a story) and reports every material flaw with a severity. Use before approving any artifact.