Getting it into your agent
This one installs as part of its plugin. Adding the marketplace and installing the plugin brings it with everything else the plugin ships.
/plugin marketplace add avelikiy/great_cto/plugin install great-ctoWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/avelikiy/great_cto/review)<a href="https://agentmods.dev/commands/avelikiy/great_cto/review"><img src="https://agentmods.dev/badge/commands/avelikiy/great_cto/review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/commands/avelikiy/great_cto/review"><img src="https://agentmods.dev/badge/commands/avelikiy/great_cto/review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00088 | $0.07475 |
| Opus 5 | $0.00044 | $0.03737 |
| Sonnet 5 | $0.00018 | $0.01495 |
| Haiku 4.5 | $0.00009 | $0.00747 |
Grade A, and why
review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 622 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are a senior engineering team conducting a 12-angle code review. Each angle is independent and focuses exclusively on its domain.
Trace mode (early branch — exits before review runs)
If $1 = trace → render the requirement → use-case → task → test traceability for the
supplied bd id or feature slug, then stop. This is a thin alias for the canonical /trace
command (governance Phase 4) — one engine (scripts/lib/trace.mjs): layered rationale +
impact + coverage gaps, not a raw bd dep tree dump.
if [ "$1" = "trace" ]; then
bd --help >/dev/null 2>&1 || { echo "bd not installed — traceability requires Beads."; echo "Fallback: grep '^- \\[ \\] REQ-' docs/architecture/ARCH-*.md"; exit 1; }
TARGET="${2:-}"
if [ -z "$TARGET" ]; then
echo "Usage: /review trace <bd-id|feature-slug> (alias of /trace)"
echo " /review trace bd-xyz # rationale + impact for this node"
echo " /review trace feature-checkout # coverage audit for the feature"
exit 0
fi
PD=${CLAUDE_PLUGIN_ROOT:-$(ls -d ~/.claude/plugins/cache/*/great_cto/*/ 2>/dev/null | sort -V | tail -1 | sed 's|/$||')}; [ -z "$PD" ] && PD=.
TRACE() { node "$PD/scripts/lib/trace.mjs" "$@" 2>/dev/null || node scripts/lib/trace.mjs "$@"; }
# feature-<slug> → coverage audit; otherwise node-centric trace.
if echo "$TARGET" | grep -q "^feature-"; then
TRACE feature "${TARGET#feature-}"
else
TRACE "$TARGET"
fi
exit $?
fi
Setup
source .great_cto/env.sh 2>/dev/null || export PATH="/opt/homebrew/bin:$HOME/.local/bin:/usr/local/bin:$PATH"
REVIEW_MODE=$(grep "^approval-level:" .great_cto/PROJECT.md 2>/dev/null | awk '{print $2}'); REVIEW_MODE=${REVIEW_MODE:-auto}
TYPE=$(grep "^primary:" .great_cto/PROJECT.md 2>/dev/null | awk '{print $2}')
ARCHETYPE=$(grep "^archetype:" .great_cto/PROJECT.md 2>/dev/null | awk '{print $2}'); ARCHETYPE=${ARCHETYPE:-web-service}
# Parse --deep flag (triage all P0/P1 angles, not just security/reliability)
DEEP_TRIAGE=false
DIFF_TARGET=""
for arg in "$@"; do
case "$arg" in
--deep) DEEP_TRIAGE=true ;;
--*) ;; # unknown flag, ignore
*) [ -z "$DIFF_TARGET" ] && DIFF_TARGET="$arg" ;;
esac
done
# Get diff scope
if [ -n "$DIFF_TARGET" ]; then
git diff main..."$DIFF_TARGET" --name-only 2>/dev/null | head -30
DIFF=$(git diff main..."$DIFF_TARGET" 2>/dev/null | head -2000)
else
BASE=$(git merge-base HEAD main 2>/dev/null || echo "HEAD~5")
git diff "$BASE"..HEAD --name-only 2>/dev/null | head -30
DIFF=$(git diff "$BASE"..HEAD 2>/dev/null | head -2000)
fi
echo "Files changed: $(git diff "$BASE"..HEAD --name-only 2>/dev/null | wc -l)"
echo "Deep triage mode: $DEEP_TRIAGE (triage ALL P0/P1 angles, not just 2/4/7/9)"
# Detect design system (for Angle 12)
DESIGN_SYSTEM="none"
grep -rl "MaterialTheme\|androidx.compose.material3" . --include="*.kt" 2>/dev/null | head -1 | grep -q . && DESIGN_SYSTEM="material3"
grep -rl "tailwind\|@apply\|className=" . --include="*.tsx" --include="*.jsx" --include="*.css" 2>/dev/null | head -1 | grep -q . && DESIGN_SYSTEM="tailwind"
grep -rl "SwiftUI\|\.foregroundStyle\|Color\.accentColor" . --include="*.swift" 2>/dev/null | head -1 | grep -q . && DESIGN_SYSTEM="swiftui"
grep -rl "StyleSheet\.create\|useTheme\|ThemeProvider" . --include="*.tsx" --include="*.ts" 2>/dev/null | head -1 | grep -q . && [ "$DESIGN_SYSTEM" = "none" ] && DESIGN_SYSTEM="rn-custom"
echo "Design system detected: $DESIGN_SYSTEM"
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago Changed d4c76e34f79f
- 3d ago Changed 9834f2992483
- 6d ago First seen · 622 lines · 88 tokens per session scan A cd135bc1cfe0
review is a command published in the GitHub repository avelikiy/great_cto (89 stars, last pushed yesterday), licensed MIT. It adds 88 tokens to every session and 7,475 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other commands, from other repositories
bugfix
TDD-driven bugfix workflow: tester writes failing test (RED) → developer fixes (GREEN) → developer refactors (REFACTOR) → reviewer validates. Accepts issue number, description, or both. Auto-creates PR unless --no-pr flag is passed.
fec-debug
Front-end problem diagnosis and repair: covering build failures, runtime errors, UI exceptions, and interface problems, using a unified diagnostic framework to classify problems by type.
fec-tdd
Use front-end TDD workflow to implement functions, fix bugs, or refactor logic: first write failing tests, then implement minimal code, and then refactor.
dead-code-scan
Scan for dead code, unused imports, duplicates, and zombie code across the project.
esp-debug
Help debug ESP32 crashes, hangs, and peripheral issues.
develop
Implement skill development issues with TDD-governed workflow.