Borrowing it
Nothing to install: this file belongs to bladeofgod/flutter-ai-harness. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/bladeofgod/flutter-ai-harness/main/.claude/commands/fix-review-findings.mdgit clone --depth 1 https://github.com/bladeofgod/flutter-ai-harnessWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/bladeofgod/flutter-ai-harness/fix-review-findings)<a href="https://agentmods.dev/commands/bladeofgod/flutter-ai-harness/fix-review-findings"><img src="https://agentmods.dev/badge/commands/bladeofgod/flutter-ai-harness/fix-review-findings/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/commands/bladeofgod/flutter-ai-harness/fix-review-findings"><img src="https://agentmods.dev/badge/commands/bladeofgod/flutter-ai-harness/fix-review-findings.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00015 | $0.01144 |
| Opus 5.5 | $0.00006 | $0.00458 |
| Sonnet 5.5 | $0.00003 | $0.00229 |
| Haiku 4.5 | $0.00002 | $0.00114 |
Grade A, and why
fix-review-findings scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 50 lines — stays where its author put it; the contents beside it link to each section on GitHub.
只在用户明确要求修复时执行。读取 $ARGUMENTS 指向的 Review 报告、对应 diff、任务卡和验证证据；没有有效报告路径时停止，不猜测修复范围。先根据报告的 task slug 判断所属任务是否位于 docs/tasks/done/：已归档任务的报告是不可变历史快照，不得直接进入下述修复或复审步骤；必须通过 plan-tasks 创建新的活动任务，并由新任务生成独立的 Review、Security Review 和 Evidence。
修复
- 按 P0、P1、用户明确选择的 P2 顺序处理。
- 优先回到原任务 frontmatter 指定的 Executor；Android/iOS 单平台修复分别使用
android-engineer、ios-engineer，Dart/Flutter 修复使用task-executor，缺测试可以由test-writer补充，架构不明确时先使用architect。 - 修复同时跨越 Wire Contract 或多个 Runtime 时由
bridge-engineer协调，并保持各平台实现 所有权和独立复审；不得让协调者取代平台 Agent。 - 保护无关工作树改动，不扩大 Review 已确认的范围。
- 不采纳或需要外部决策的问题必须在报告中记录原因。
- 先汇总本轮全部适用 P0/P1，再进行一个修复批次。每轮修复后只运行与任务验收、
workKinds和实际 diff 影响面相符的格式、分析、测试和仓库门禁；共享契约或公共行为变化时扩大范围。每个实际重跑的 自动化 Gate 使用原任务稳定的 canonical lowercase kebab-casegate-id通过 Evidence 采集器更新， 同一候选批次中命令只执行一次。未重跑 Gate、人工验收、外部环境和未验证限制不得生成机器 Evidence。 - Harness 修复通过
make harness-test-focus显式提供受影响HARNESS_FIXTURE_CASES或HARNESS_FIXTURE_PATHS，并在 Evidence/报告中记录选择条件、实际 case 数和 ID；缺失、非法、未知或 零匹配选择器必须失败。新增规则优先写所属领域 Dart Fixture，只有改变既有 Legacy Shell 场景或执行 完整性迁移时才重采集 inventory/catalog。影响面无法可靠收窄时必须升级全量，不能用聚焦结果掩盖范围 不确定性。
复审
每轮修复和验证后，根据普通聚合报告的 ownerProfile 把发现交还对应的 code-reviewer、
harness-reviewer 或 contract-reviewer。另外只重新运行审查输入或语义被本轮修改实际影响的普通
Profile；任务范围、验收标准或权威契约变化时扩大到所有受影响 Profile。security-*.md 使用
security-reviewer，且仅在其 implementationFiles 内容变化或修复新增/改变安全边界时重新审查。
Evidence 追加、报告状态更新或与结论无关的生成适配同步本身不得使全部 Profile 失效。
Harness 任务全部 P0/P1、聚焦 Gate 和适用复审清零后，最终准备归档的候选必须执行一次无过滤的
make harness-test 并记录 full Harness Gate；聚焦 Gate 不能替代它。完整回归失败时只修复实际失败区域、
重新执行受影响 Gate/Profile，并在形成新的最终候选后再次执行完整回归。CI、make check 和发版检查始终
全量。
只有原报告所属任务仍处于活动状态时，才在唯一的 docs/reviews/execute-<task-slug>.md 聚合报告追加
“复审”章节，记录本轮 Gate/Profile/Security 失效判断与理由，并同步更新各 Profile 结论以及 frontmatter
的聚合 status、p0、p1；reviewProfiles 顺序和集合继续与任务 workKinds 映射完全一致。已归档
报告不得追加或更新，新活动任务必须写入自己的报告。普通修复引入或改变认证、敏感数据、攻击者可控输入、
原生权限、供应链或 Agent 执行能力时，必须运行 Security Review；存在活动任务卡时先补
securityReview: required。复审彼此独立，不向一个 Reviewer 提供另一个 Reviewer 的结论。修复执行者
的自审不能作为最终结论。最多自动修复三轮；P0/P1 仍未清零或需要外部决策时停止并报告，不继续扩大修改。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2mo ago First seen · 50 lines · 15 tokens per session scan A a7ed8408d152
fix-review-findings is a command published in the GitHub repository bladeofgod/flutter-ai-harness (115 stars, last pushed 1mo ago), licensed MIT. It adds 15 tokens to every session and 1,144 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other commands, from other repositories
refactor-clean
Refactor provided code for cleanliness, maintainability, and alignment with SOLID principles and modern best practices — no over-engineering.
deep-audit.skeleton
Description: This section is populated by Bootstrap with manifest data. Required manifest fields: project.description, stack.primary, project.structure, project.subprojects, stack.orm, stack.authmethod Example output.
harness:audit
Cross-dimensional codebase audit orchestrator — classify repo shape, fan out parallel read-only audit agents, dedup and severity-rank findings against existing issues, publish grouped tracking issues.
modify
Command "modify" from MartyBonacci/specswarm, covering user input, flag parsing, parse flags from arguments, mode routing and goal.
prism-graph
Export Prism's graph of this repository and summarise it.
hotfix
Ship a fast branch-based P0 hotfix — diagnose, implement, open a ready-for-review PR, then verify + review after (deferred by design).