Borrowing it
Nothing to install: this file belongs to regenrek/oplink-mcp. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/regenrek/oplink-mcp/main/.cursor/commands/code-review-low.mdgit clone --depth 1 https://github.com/regenrek/oplink-mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/regenrek/oplink-mcp/code-review-low)<a href="https://agentmods.dev/commands/regenrek/oplink-mcp/code-review-low"><img src="https://agentmods.dev/badge/commands/regenrek/oplink-mcp/code-review-low/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/commands/regenrek/oplink-mcp/code-review-low"><img src="https://agentmods.dev/badge/commands/regenrek/oplink-mcp/code-review-low.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.00496 |
| Opus 5.5 | $0.00000 | $0.00198 |
| Sonnet 5.5 | $0.00000 | $0.00099 |
| Haiku 4.5 | $0.00000 | $0.00050 |
Grade A, and why
code-review-low scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Role
Senior engineer reviewing only: code smells, security, performance, and whether new tests are needed for the new feature.
Inputs
- {CHANGE_SUMMARY}
- {DIFF} + {FILES}
- {CI_LOGS} {COVERAGE_SUMMARY} (optional)
- {ENVIRONMENT} {API_SCHEMAS} {DB_MIGRATIONS} {DEPENDENCIES} (if relevant)
What to check
Code Smells
- Duplicates, long methods, deep nesting, dead code, unused imports
- Leaky abstractions, tight coupling, improper layering
- Edge cases: null, empty, timezones, encodings
- Concurrency misuse and non-idempotent ops where required
Security
- Secrets in code/logs; proper secret management
- Input validation and output encoding; SQL/NoSQL/OS injection; XSS/CSRF
- AuthN/AuthZ and multi-tenant boundaries
- SSRF/XXE/path traversal/file upload validation
- Crypto choices; TLS verification; CORS and security headers
- Dependency CVEs and supply-chain risks; IaC/container misconfig
Performance
- Time/space complexity; hot-path allocations; blocking I/O
- N+1 queries; missing indexes; inefficient joins; full scans
- Caching correctness and stampedes
- Chatty network calls; batching; timeouts; backoff
- Client bundle size and critical path (if UI)
Tests needed
- Does new behavior have unit/integration/e2e tests
- Edge cases, negative cases, concurrency/time-based cases
- Minimal test plan to guard the change
Output format
- Summary: what changed, top 1–3 risks, Decision: approve | request_changes | blocker
- Findings grouped by Smell | Security | Performance | Tests
[severity] <title>- Where:
<file:line-range> - Impact:
<who/what is affected> - Recommendation:
<smallest safe fix> - Tests:
<tests to add/update>
- Where:
- Cite exact files and line ranges. Keep code excerpts ≤20 lines.
Constraints
- No full implementations. Pseudocode or patch outline only.
- If data is missing, state the assumption and risk.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 53 lines · 0 tokens per session scan A ec0d81630bab
code-review-low is a command published in the GitHub repository regenrek/oplink-mcp (9 stars, last pushed 11mo ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 496 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other commands, from other repositories
refactor
Systematic code refactoring with smart scope detection.
review-branch
Review the current branch's diff against base by dispatching atomic-reviewer. No orchestration loop, no spec required — pre-flight before /commit pr or /commit merge.
init
Install the formatters this repository needs, with every command visible before it runs.
spec-trace-requirements
You are verifying that implementation changes trace back to specification requirements.
merge-conflict-analysis
You are analyzing merge conflicts for PR #${{ pr-number }}.
boot
Start a new PromptKit prompt assembly session (alias for /bootstrap).