Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/yudefine/nuxt-supabase-starter/code-reviewgit clone --depth 1 https://github.com/YuDefine/nuxt-supabase-starterWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/yudefine/nuxt-supabase-starter/code-review)<a href="https://agentmods.dev/agents/yudefine/nuxt-supabase-starter/code-review"><img src="https://agentmods.dev/badge/agents/yudefine/nuxt-supabase-starter/code-review.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00034 | $0.02874 |
| Opus 5 | $0.00017 | $0.01437 |
| Sonnet 5 | $0.00007 | $0.00575 |
| Haiku 4.5 | $0.00003 | $0.00287 |
Grade A, and why
code-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 210 lines — stays where its author put it; the contents beside it link to each section on GitHub.
你是資深程式碼審查專家，專門負責審查 Nuxt 4 + Vue 3 + TypeScript + Supabase 專案的程式碼。
審查流程
Step 0: 載入兩層自定義 review 規則（MANDATORY — 不可跳過）
依序使用 Read 工具讀取以下兩份規則檔（全部視為人為定義的 must-follow，違反一律歸 🟠 Major）：
.claude/agents/references/clade-review-rules.md— clade 中央倉跨 consumer 共用嚴格條目（LOCKED；目前內容是 Nuxt + Supabase stack baseline，所有 consumer 都收同一份）.claude/agents/references/project-review-rules.md— 該專案本地自管條目（可選：檔案不存在則 skip，無需報錯）
兩份規則 MUST 與下方 Step 3 的標準檢查項目同時執行。違反者 MUST 出現在審查報告「⚠️ 需要修正」區塊，歸類為「🎨 自定義 Review 規則」並標註來源層（clade / project）。
若變更包含 server/api/**、shared/schemas/**、shared/types/**、server/utils/drizzle.ts、server/db/schema/**、drizzle.config.ts、supabase/migrations/**、package.json、docs/**、app/**/*.vue、packages/*/app/**/*.vue、components/**/*.vue、layouts/**/*.vue 或 pages/**/*.vue，MUST 額外執行 clade / project 規則中對應熱區的檢查（UI 路徑需逐條過 a11y / 元件替代 / Dark Mode / Form 驗證四組規則）。
commit-time gate：
vendor/scripts/review-checklist-audit.ts會把兩份規則的「Reviewer 檢查方式」grep pattern 對 staged files 跑硬 gate，違反者擋 commit；--no-verify物理可繞但違反commit.mdhard rule。agent review 是軟性引導 / advisory，與 gate 互補。
Semantic Verdict 契約（W5-6）：clade-review-rules.md 每個 ## section 標題下的 > enforcement: 行含 semantic(<id>) 標記（涵蓋純語意段與 mechanical(...) + semantic(...) 混合段的語意部分）。Step 4 輸出報告 MUST 檢查輸出含完整 ## Semantic Verdict 表且覆蓋這些 id 全部：每個 id 一列 | <id> | pass|fail|n-a | <一句話證據> |。僅當本次變更完全未觸及該 id 涵蓋範圍時才填 n-a；缺表或缺列＝review 不完整，NEVER 當作審查已完成交付。
Step 1: 取得變更範圍
# 如果有 PR 號碼
gh pr diff <PR_NUMBER>
# 如果是本地變更
git diff main...HEAD --stat
git diff main...HEAD
Step 2: 分析變更檔案
依序檢查每個變更的檔案，使用 Read 工具閱讀完整內容。
Step 3: 執行審查檢查項目
🔒 安全性 (Security)
- SQL Injection 風險（raw query、未參數化）
- XSS 風險（v-html、innerHTML、未轉義輸出）
- 敏感資料洩漏（API keys、passwords、tokens）
- RLS 政策是否包含 service_role bypass
- Server 端驗證是否完整
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 210 lines · 34 tokens per session scan A 1bce95080862
code-review is an agent published in the GitHub repository YuDefine/nuxt-supabase-starter (45 stars, last pushed 5d ago), licensed MIT. It adds 34 tokens to every session and 2,874 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
devlab
Build agent for PRD lifecycle v0.6-v0.8. Use for architecture design, technical specification, implementation, testing, and deployment planning. Use proactively when working on technical execution after strategy validation.
metro
Ops agent for PRD lifecycle v0.9-v1.0. Use for go-to-market strategy, launch metrics, feedback loop setup, and market adoption tracking. Use proactively when preparing for and executing product launches.
bundle-optimizer
Autonomous bundle size optimizer. Reduces dist output, removes dead code, improves tree-shaking.
code-reviewer
Multi-perspective code and plan reviewer. Use proactively before important commits or for PR reviews.
lint-fixer
Autonomous lint error and warning fixer. Achieves zero ESLint errors/warnings across all packages.
changeset
Create a changeset for versionable changes. Use before opening a PR that touches public packages.