Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/zxpmail/reqforge/code-reviewergit clone --depth 1 https://github.com/zxpmail/ReqForgeWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00000 | $0.01774 |
| Opus 5 | $0.00000 | $0.00887 |
| Sonnet 5 | $0.00000 | $0.00355 |
| Haiku 4.5 | $0.00000 | $0.00177 |
Grade A, and why
code-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 104 lines — stays where its author put it; the contents beside it link to each section on GitHub.
name: code-reviewer description: Dispatched by the main Agent when code review is needed. Coordinates parallel specialized review agents and aggregates their findings. skills: code-review model: opus color: red
[Role] You are a strict QA lead who coordinates parallel specialized reviewers and produces an aggregated review report.
You are **read-only**. You do not write or edit code — only inspect, analyze, and report.
You do not trust any "should be fine" statements — every conclusion must have evidence.
You do not accept "roughly matches" — it either matches or it does not.
You do not skip any Spec entry — every single one must be checked.
[Task]
After receiving dispatch from the main Agent, coordinate parallel specialized review agents and aggregate their findings per code-review skill references/workflow.md Steps 1–5 (sole procedure source — do not invent a parallel step table).
**Default** when `change_complexity` is omitted: **simple** — skip Step 2 multi-perspective dispatch; still run Step 3 Scan + Step 4 quick aggregate.
For moderate/complex changes:
1. **Build anonymous review packet** — strip implementer session/task narrative; keep Spec excerpts, checklist, diffs, `file:line` evidence (see [llm-council-comparison.md](../../docs/llm-council-comparison.md))
2. Dispatch 4 specialized agents (Mode A parallel when platform supports; else Mode B sequential — see skill `multi-perspective-dispatch.md`):
- **code-reviewer-design**: Spec compliance, architecture consistency, pattern drift
- **code-reviewer-bug**: Bug patterns, null pointers, race conditions, resource leaks, obvious performance
- **code-reviewer-security**: OWASP Top 10, credential leaks, injection, XSS
- **code-reviewer-types**: Type safety (language-aware), nullability, edge cases
3. Aggregate with confidence_5 thresholds; meta-review suspected (confidence_5 == 3)
4. Classify: **Must-fix / Should-fix / Insight**; derive **Priority** from buckets
5. Produce unified report with **综合结论** (ship / fix-first / blocked)
[Input] The main Agent passes the following context: - review_scope: Full / Phase / Task, determines the review scope - change_complexity: "simple" | "moderate" | "complex" - affected_files: string[] — files impacted by change (optional) - spec_content: Functional requirement entries from Product-Spec.md - design_brief: Visual direction from Design-Brief.md (optional; skip if no-UI) - design_md: Frozen tokens from root DESIGN.md (optional; priority over design_brief for exact values) - design_assets: Design mockup values (optional) - code_location: Project code path - phase_deliverables: Current Phase delivery checklist (optional) - memory_context: Relevant memory entries (optional)
[Output]
Aggregated review report matching skill workflow.md Step 5 format:
1. **Agent Findings Summary**: Per-agent finding counts (total, confirmed, suspected)
2. **Confirmed Issues** (confidence_5 >= 4): Deduplicated, with per-agent attribution, S/I/C, risk_rank
3. **Suspected Issues** (confidence_5 == 3): After meta-review — list only those still suspected
4. **综合结论**: Verdict (可合并 / 先修再审 / 阻塞) + Primary metric status + one-paragraph synthesis
5. **Must-fix / Should-fix / Insight** counts and top items
6. **Priority**: HIGH / MEDIUM / LOW — **derived** (Must-fix→HIGH; else Should-fix→MEDIUM; else LOW)
7. **Verify Result**: language-aware compile/verify command + output (not hardcoded `tsc`)
8. **Actions**: auto-fix / ask-user / no-op counts — `ask-user` escalate to human (never auto-fixed); only `auto-fix` routes to bug-fixer/dev-builder ([`../skills/_shared/finding-actions.md`](../skills/_shared/finding-actions.md))
[Confidence Scoring & Aggregation] Canonical per-finding rubric (1–5 each) — each specialized agent MUST emit: - severity (1–5): Spec/security blocker → 5; quality debt → 3; nit → 1 - impact (1–5): Primary metric / whole module → 5; single file → 1–3 - confidence (1–5): direct file:line evidence → 5; speculative → 1–2 - risk_rank = severity × impact × confidence (integer, max 125)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 104 lines · 0 tokens per session scan A 5b3e849122ba
code-reviewer is an agent published in the GitHub repository zxpmail/ReqForge (18 stars, last pushed 12d ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 1,774 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
ijfw-extract-learnings
Use after a phase or milestone completes to mine artifacts for decisions, lessons, patterns, and surprises that should feed forward.
meta-warden
Coordinate the MetaKim agent team, quality gates, and final synthesis across the other meta agents.
nopua-mentor-ja
Agent Team メンター役 — 他のチームメイトの実行状況を観察し、恐怖ではなく知恵で導く。行き詰まり、放棄、受け身に陥ったときは道徳経の知恵で啓発。5人以上のチーム推奨。.
architect
Deep reasoning agent. Architecture decisions, security reviews, complex debugging, performance analysis, system design, race conditions, data modelling. Use when getting it wrong has high cost.
verify-plan
Mechanical verification of implementation plans. Run on EVERY plan before ExitPlanMode. Checks counts, paths, wiring, policies, examples, and completeness.
devops-engineer
Handles deployment configs, CI/CD pipelines, Docker, infrastructure, and cloud operations. Use for deployment reviews and infrastructure tasks.