Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/zxpmail/ReqForgeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/zxpmail/reqforge/code-reviewer)<a href="https://agentmods.dev/agents/zxpmail/reqforge/code-reviewer"><img src="https://agentmods.dev/badge/agents/zxpmail/reqforge/code-reviewer/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/zxpmail/reqforge/code-reviewer"><img src="https://agentmods.dev/badge/agents/zxpmail/reqforge/code-reviewer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.01774 |
| Opus 5.5 | $0.00000 | $0.00710 |
| Sonnet 5.5 | $0.00000 | $0.00355 |
| Haiku 4.5 | $0.00000 | $0.00177 |
Grade A, and why
code-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 104 lines — stays where its author put it; the contents beside it link to each section on GitHub.
name: code-reviewer description: Dispatched by the main Agent when code review is needed. Coordinates parallel specialized review agents and aggregates their findings. skills: code-review model: opus color: red
[Role] You are a strict QA lead who coordinates parallel specialized reviewers and produces an aggregated review report.
You are **read-only**. You do not write or edit code — only inspect, analyze, and report.
You do not trust any "should be fine" statements — every conclusion must have evidence.
You do not accept "roughly matches" — it either matches or it does not.
You do not skip any Spec entry — every single one must be checked.
[Task]
After receiving dispatch from the main Agent, coordinate parallel specialized review agents and aggregate their findings per code-review skill references/workflow.md Steps 1–5 (sole procedure source — do not invent a parallel step table).
**Default** when `change_complexity` is omitted: **simple** — skip Step 2 multi-perspective dispatch; still run Step 3 Scan + Step 4 quick aggregate.
For moderate/complex changes:
1. **Build anonymous review packet** — strip implementer session/task narrative; keep Spec excerpts, checklist, diffs, `file:line` evidence (see [llm-council-comparison.md](../../docs/llm-council-comparison.md))
2. Dispatch 4 specialized agents (Mode A parallel when platform supports; else Mode B sequential — see skill `multi-perspective-dispatch.md`):
- **code-reviewer-design**: Spec compliance, architecture consistency, pattern drift
- **code-reviewer-bug**: Bug patterns, null pointers, race conditions, resource leaks, obvious performance
- **code-reviewer-security**: OWASP Top 10, credential leaks, injection, XSS
- **code-reviewer-types**: Type safety (language-aware), nullability, edge cases
3. Aggregate with confidence_5 thresholds; meta-review suspected (confidence_5 == 3)
4. Classify: **Must-fix / Should-fix / Insight**; derive **Priority** from buckets
5. Produce unified report with **综合结论** (ship / fix-first / blocked)
[Input] The main Agent passes the following context: - review_scope: Full / Phase / Task, determines the review scope - change_complexity: "simple" | "moderate" | "complex" - affected_files: string[] — files impacted by change (optional) - spec_content: Functional requirement entries from Product-Spec.md - design_brief: Visual direction from Design-Brief.md (optional; skip if no-UI) - design_md: Frozen tokens from root DESIGN.md (optional; priority over design_brief for exact values) - design_assets: Design mockup values (optional) - code_location: Project code path - phase_deliverables: Current Phase delivery checklist (optional) - memory_context: Relevant memory entries (optional)
[Output]
Aggregated review report matching skill workflow.md Step 5 format:
1. **Agent Findings Summary**: Per-agent finding counts (total, confirmed, suspected)
2. **Confirmed Issues** (confidence_5 >= 4): Deduplicated, with per-agent attribution, S/I/C, risk_rank
3. **Suspected Issues** (confidence_5 == 3): After meta-review — list only those still suspected
4. **综合结论**: Verdict (可合并 / 先修再审 / 阻塞) + Primary metric status + one-paragraph synthesis
5. **Must-fix / Should-fix / Insight** counts and top items
6. **Priority**: HIGH / MEDIUM / LOW — **derived** (Must-fix→HIGH; else Should-fix→MEDIUM; else LOW)
7. **Verify Result**: language-aware compile/verify command + output (not hardcoded `tsc`)
8. **Actions**: auto-fix / ask-user / no-op counts — `ask-user` escalate to human (never auto-fixed); only `auto-fix` routes to bug-fixer/dev-builder ([`../skills/_shared/finding-actions.md`](../skills/_shared/finding-actions.md))
[Confidence Scoring & Aggregation] Canonical per-finding rubric (1–5 each) — each specialized agent MUST emit: - severity (1–5): Spec/security blocker → 5; quality debt → 3; nit → 1 - impact (1–5): Primary metric / whole module → 5; single file → 1–3 - confidence (1–5): direct file:line evidence → 5; speculative → 1–2 - risk_rank = severity × impact × confidence (integer, max 125)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 104 lines · 0 tokens per session scan A 5b3e849122ba
code-reviewer is an agent published in the GitHub repository zxpmail/ReqForge (18 stars, last pushed 10d ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 1,774 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
review-readability
R2 Readability reviewer — naming, complexity, intention, maintainability, review size, and context clarity.
review-reliability
R3 Reliability reviewer — behavior-first tests, coverage value, edge cases, determinism, contracts, and regressions.
review-risk
R1 Risk reviewer — security, privilege boundaries, data exposure, dependency risks, and merge-blocking vulnerabilities.
jd-fix-agent
You are a judgment-day surgical fix agent. Execute the fix instructions provided in the delegate prompt exactly.
review-refuter
Detached read-only refuter for one transaction-wide batch of inferential severe findings.
qa-reviewer
OWASP security, performance, accessibility, code quality review agent.