Getting it into your agent
This one installs as part of its plugin. Adding the marketplace and installing the plugin brings it with everything else the plugin ships.
/plugin marketplace add artemnovichkov/skills/plugin install sdlcWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/artemnovichkov/skills/review)<a href="https://agentmods.dev/commands/artemnovichkov/skills/review"><img src="https://agentmods.dev/badge/commands/artemnovichkov/skills/review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/commands/artemnovichkov/skills/review"><img src="https://agentmods.dev/badge/commands/artemnovichkov/skills/review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00023 | $0.00528 |
| Opus 5 | $0.00012 | $0.00264 |
| Sonnet 5 | $0.00005 | $0.00106 |
| Haiku 4.5 | $0.00002 | $0.00053 |
Grade A, and why
review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Stage 5 — Review the same way every time
Every change gets the same passes, so human attention can go to intent and risk instead of to naming and formatting.
Workflow
1. Ensure a review policy exists
If REVIEW.md is absent, draft it from ${CLAUDE_PLUGIN_ROOT}/templates/REVIEW.md, adapted to this repo:
- Passes: bugs and logic errors; security and vulnerabilities; compliance with the spec, the plan, and the repo's stated principles.
- Important vs Nit: define the line explicitly. Style and naming are nits. Cap the number of nits reported.
- Exclusions: generated paths, vendored code, and anything CI already enforces — commenting on those wastes the review.
Show it to the user for correction and offer the commit. REVIEW.md is policy: it is worth arguing over once so it does not have to be argued in every PR.
2. Run the review
Reuse the existing reviewer rather than writing another one:
- If the
code-reviewplugin is installed, run/code-reviewand passREVIEW.mdas the policy the review must apply, along withsdlc/spec/<slug>.mdandsdlc/plan/<slug>.mdfor the compliance pass. - Otherwise, review the diff yourself against each
REVIEW.mdpass in turn, one pass at a time. Report findings ranked by severity, and drop anything that is only style.
The compliance pass is the one a generic reviewer cannot do: does the diff actually implement the accepted spec, and does it match the accepted plan? Name the divergences.
3. Close the loop
- Any finding that is a repeat of an earlier correction goes into
CLAUDE.md— that is what stops it recurring. - If the diff departs from the plan, update
sdlc/plan/<slug>.md. - For a GitHub PR, the user can tag
@claudeon review comments to have them addressed on the branch.
4. Boundary
You do not approve your own work. Present findings and let the user decide what merges. If asked to merge, say plainly that the merge decision is theirs and wait for an explicit go-ahead.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 40 lines · 23 tokens per session scan A 1ff2239edb08
review is a command published in the GitHub repository artemnovichkov/skills (36 stars, last pushed yesterday), licensed MIT. It adds 23 tokens to every session and 528 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-07.
Other commands, from other repositories
check-pr
Check a PR's CI status, reviews, comments, and merge readiness.
review
Review the current branch's changes for quality, bugs, and best practices.
refactor
Identify code smells and apply safe refactoring with tests verification.
speckit.analyze
Perform a non-destructive cross-artifact consistency and quality analysis across spec.md, plan.md, and tasks.md after task generation.
review-arch
Review app architecture: components, data flows, risks, and prioritized improvements.
autofix-pr
Monitor a pull request and fix code review and CI issues automatically.