Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/KimYx0207/Kim_ServiceWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/kimyx0207/kim_service/kim-review)<a href="https://agentmods.dev/commands/kimyx0207/kim_service/kim-review"><img src="https://agentmods.dev/badge/commands/kimyx0207/kim_service/kim-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/commands/kimyx0207/kim_service/kim-review"><img src="https://agentmods.dev/badge/commands/kimyx0207/kim_service/kim-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00025 | $0.01551 |
| Opus 5.5 | $0.00010 | $0.00620 |
| Sonnet 5.5 | $0.00005 | $0.00310 |
| Haiku 4.5 | $0.00003 | $0.00155 |
Grade A, and why
kim-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 187 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Kim Service 执行门（必须先执行）
- 先复述原始用户意图，并列出本次计划调用的 MCP 工具、目标目录和拟新增或修改的文件；不要把本命令扩展成 Router 或自动验收流程。
- 任何项目写入、依赖安装、外部访问或环境变更都必须先获得对应的人类批准。未批准时只分析并展示计划。
- 写入前读取现有目标；目标已存在时不得用重定向、空文件或整文件覆盖。只做受管更新，遇到冲突停止并展示差异。
- 新文件只能在已批准的项目根目录内安全创建；不得写用户级配置。MCP 仅使用本 Tool 的 cli.mjs mcp codex 或 cli.mjs mcp gemini 运行时及其已注册工具。
Kim代码审查命令（Claude + Gemini）
代码审查模式：理解代码 → 深度审查，专注于代码质量和安全
你现在要协调2个AI工具完成代码审查：$ARGUMENTS
模式说明：这是专业审查模式，适合审查现有代码、代码质量检查、安全审计。
⚠️ 文件写入规则（必须遵守）
审查默认只读。若用户批准保存报告，先展示 .kim-orchestrator/ 目标清单并读取已有目标；只做受管更新，新文件安全创建，禁止重定向清空。
执行流程
阶段0.1：健康检查
参考 .claude/skills/kim-orchestrator/prompts/health-check.md 执行MCP健康检查。
在开始前检测 mcp__gemini__gemini 工具是否可用：
- ✅ 可用 → 继续执行
- ❌ 不可用 → 显示修复指南，询问是否用Claude降级执行
阶段0.2：初始化工作目录
未批准保存时不初始化目录。批准后安全创建 .kim-orchestrator/，逐个检查目标文件且不得覆盖已有内容。
然后读取这些文件：
- Read .kim-orchestrator/phase1_analysis.json
- Read .kim-orchestrator/phase2_review.md
- Read .kim-orchestrator/result.md
阶段1：代码理解与分析（你自己完成）
首先读取用户指定的代码文件，然后分析：
- 识别审查目标：用户可能提供文件路径、目录、或描述
- 读取代码：使用Read/Glob/Grep工具获取代码内容
- 初步分析：理解代码结构、功能、潜在问题点
输出JSON格式的分析报告：
{
"review_target": "审查目标描述",
"files_analyzed": [
{"path": "文件路径", "lines": 行数, "purpose": "用途"}
],
"code_summary": "代码功能概述",
"initial_concerns": [
"初步发现的问题1",
"初步发现的问题2"
],
"review_focus": [
"重点审查方向1：安全性",
"重点审查方向2：性能",
"重点审查方向3：可维护性"
]
}
保存到 .kim-orchestrator/phase1_analysis.json
阶段2：深度代码审查（调用Gemini MCP Server）
检查工具：确认 mcp__gemini__gemini 可用。如果不可用，提示用户配置MCP Server。
调用Gemini进行深度审查：
- prompt: 包含代码内容和phase1_analysis.json的审查要点
- sandbox: true
- cwd: 当前已批准的项目根目录
审查维度：
- 代码质量：可读性、命名规范、代码复杂度
- 安全性：SQL注入、XSS、认证漏洞、敏感信息泄露
- 性能：N+1查询、内存泄漏、算法效率
- 可维护性：模块化、依赖关系、测试覆盖
- 最佳实践：设计模式、SOLID原则、错误处理
将响应保存到 .kim-orchestrator/phase2_review.md
阶段3：生成审查报告
# Kim代码审查报告（Claude + Gemini）
**审查目标**: $ARGUMENTS
**审查时间**: [当前时间]
**模式**: 深度代码审查
---
## 阶段1: 代码分析（Claude Sonnet 4.5）
\`\`\`json
[phase1_analysis.json的内容]
\`\`\`
---
## 阶段2: 深度审查（Gemini 3 Pro）
[phase2_review.md的内容]
---
## 审查总结
### 🔴 严重问题（必须修复）
[列出严重问题]
### 🟡 一般问题（建议修复）
[列出一般问题]
### 🟢 优化建议（可选改进）
[列出优化建议]
---
## 下一步建议
1. 优先修复严重问题
2. 使用 `/kim-code` 生成修复代码
3. 修复后再次运行 `/kim-review` 验证
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 187 lines · 25 tokens per session scan A 2f4d627814e5
kim-review is a command published in the GitHub repository KimYx0207/Kim_Service (177 stars, last pushed 5d ago), licensed MIT. It adds 25 tokens to every session and 1,551 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-14.
Other commands, from other repositories
review-branch
Review the current branch's diff against base by dispatching atomic-reviewer. No orchestration loop, no spec required — pre-flight before /commit pr or /commit merge.
refactor
Systematic code refactoring with smart scope detection.
init
Install the formatters this repository needs, with every command visible before it runs.
spec-trace-requirements
You are verifying that implementation changes trace back to specification requirements.
merge-conflict-analysis
You are analyzing merge conflicts for PR #${{ pr-number }}.
boot
Start a new PromptKit prompt assembly session (alias for /bootstrap).