Getting it into your agent
This one installs as part of its plugin. Adding the marketplace and installing the plugin brings it with everything else the plugin ships.
/plugin marketplace add synaptiai/synapti-marketplace/plugin install flowWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/synaptiai/synapti-marketplace/review)<a href="https://agentmods.dev/commands/synaptiai/synapti-marketplace/review"><img src="https://agentmods.dev/badge/commands/synaptiai/synapti-marketplace/review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/commands/synaptiai/synapti-marketplace/review"><img src="https://agentmods.dev/badge/commands/synaptiai/synapti-marketplace/review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00023 | $0.13218 |
| Opus 5 | $0.00012 | $0.06609 |
| Sonnet 5 | $0.00005 | $0.02644 |
| Haiku 4.5 | $0.00002 | $0.01322 |
Grade B, and why
review scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
# 3. $HOME/.claude/settings.flow.json — user-global default across projects. How it starts
The opening of the file, as written. The whole thing — 806 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Review PR #$ARGUMENTS
Multi-faceted code review with parallel analysis. Follows Explore > Plan > Code > Verify loop.
Required Skills
llm-operator-principles— operator stance (inlined above): convergence is zero findings, fix in this PR, no calendar-time estimates, escalate only for true decisionscode-review-methodology— 6-facet review, finding synthesis, adversarial protocolholdout-validation— cross-reference self-review claims against file state (Phase 3)run-state-management— FlowRun/FlowActivity records at phase boundaries (v3 runtime)
# Inline the Required Skills above so their rules are in context before the
# first phase runs (commands cannot preload skills from frontmatter). Ambient
# skills load whole; dispatched skills (context: fork / agent:) load their
# `## Contract` section and run in full when this command invokes
# Skill(<name>). Output per `references/command-output-format.md`.
"$(__fr="${CLAUDE_PLUGIN_ROOT:-}";[ -x "$__fr/bin/cascade-resolve.sh" ]||__fr=$({ echo plugins/flow;ls -d "$HOME"/.claude/plugins/cache/synapti-marketplace/flow/*/ 2>/dev/null|sort -Vr;echo "$HOME/.claude/plugins/marketplaces/synapti-marketplace/plugins/flow"; }|while read -r __p;do [ -x "${__p%/}/bin/cascade-resolve.sh" ]&&{ echo "${__p%/}";break;};done);echo "$__fr")/bin/flow-load-skills.sh" llm-operator-principles code-review-methodology holdout-validation run-state-management
true
Phase 1: EXPLORE
gh pr checkout stays inline below (mutating working tree); read-only context-gathering is in the ! block.
# Take the first whitespace-separated token; accept only if it is all digits.
# A non-numeric token (e.g., "foo42" or "evil;rm") is rejected with empty
# PR_NUM so it never reaches the prompt context or any downstream shell.
#
# Output: `###`-headed sections + KEY=value per
# `references/command-output-format.md`. STATE=blocked on bad input.
_RAW="$ARGUMENTS" # Claude Code substitutes the bare arg token, not bash parameter-expansion
ARG1="${_RAW%% *}"
case "$ARG1" in
''|*[!0-9]*) PR_NUM="" ;;
*) PR_NUM="$ARG1" ;;
esac
echo "### PR Reference"
if [ -z "$PR_NUM" ]; then
echo "STATE=blocked"
echo "ERROR=PR number required (all-digit). Usage: /flow:review <pr-number>"
else
echo "STATE=ok"
echo "PR_NUM=$PR_NUM"
# Section: PR Details
echo ""
echo "### PR Details"
gh pr view "$PR_NUM" --json title,headRefName,baseRefName,changedFiles,additions,deletions,labels,author,reviews --jq '"TITLE=\"\(.title)\"\nHEAD_BRANCH=\(.headRefName)\nBASE_BRANCH=\(.baseRefName)\nAUTHOR=@\(.author.login)\nCHANGED_FILES=\(.changedFiles)\nADDITIONS=\(.additions)\nDELETIONS=\(.deletions)\nLABELS=\([.labels[].name] | join(","))\nREVIEW_COUNT=\(.reviews | length)"' 2>/dev/null
# Section: Linked Issue (parsed from PR body)
echo ""
echo "### Linked Issue"
LINKED=$(gh pr view "$PR_NUM" --json body --jq '.body' 2>/dev/null | grep -oE '#[0-9]+' | head -1 | tr -d '#')
echo "LINKED_ISSUE=${LINKED:-none}"
# Section: Previous Reviews (follow-up detection)
echo ""
echo "### Previous Reviews"
# Capture gh exit separately. Without this, `jq 'length' | echo "0"` on a
# failed gh call (auth, network) produces no output (jq 1.8 empty-input
# ⇒ exit 0) so `||` doesn't fire, COUNT stays empty, and the section
# silently leaks `REVIEW_COUNT=` (bare empty).
PREV_JSON=$(gh pr view "$PR_NUM" --json reviews --jq '.reviews' 2>/dev/null); GH_EXIT=$?
if [ $GH_EXIT -ne 0 ]; then
echo "REVIEW_COUNT=0"
echo "STATE=unavailable"
else
PREV_COUNT=$(echo "$PREV_JSON" | jq 'length' 2>/dev/null)
[ -z "$PREV_COUNT" ] && PREV_COUNT=0
echo "REVIEW_COUNT=$PREV_COUNT"
if [ "$PREV_COUNT" = "0" ]; then
echo "STATE=empty"
else
echo "$PREV_JSON" | jq -r '.[] | "REVIEW=state=\(.state) by=@\(.author.login) at=\(.submittedAt)"' 2>/dev/null
fi
fi
# Section: Diff Files
echo ""
echo "### Diff Files"
DIFF_FILES=$(gh pr diff "$PR_NUM" --name-only 2>/dev/null)
# `grep -c '.' || echo 0` produces multi-line `0\n0` on empty input — use
# explicit empty-check.
if [ -z "$DIFF_FILES" ]; then
DIFF_FILE_COUNT=0
else
DIFF_FILE_COUNT=$(printf '%s\n' "$DIFF_FILES" | wc -l | tr -d ' ')
fi
echo "DIFF_FILE_COUNT=$DIFF_FILE_COUNT"
if [ "$DIFF_FILE_COUNT" = "0" ]; then
echo "STATE=empty"
else
printf '%s\n' "$DIFF_FILES" | sed 's/^/DIFF_FILE=/'
fi
fi
true
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed · +12 lines 8205a37a01f2
- 7d ago First seen · 794 lines · 23 tokens per session scan B 424457b1b1e7
review is a command published in the GitHub repository synaptiai/synapti-marketplace (6 stars, last pushed today), licensed Apache-2.0. It adds 23 tokens to every session and 13,218 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it B with 1 finding (reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other commands, from other repositories
create-worktree
Follow these steps to create a git worktree.
release
Release manager for frontend and mobile. Writes App Store notes, user-facing changelog, flags stale docs and landing copy. Actions: notes | changelog | docs | sync.
pr
Prepare and open a pull request the senior way: gate, template, scrubbed, everything visible.
status
The state of play, computed fresh: branch, dirty files, the active sprint, open work, index freshness.
triage
Triages a PR comment — from a bot (Copilot, CI) or a human reviewer. Fetches the comment and diff via gh CLI, classifies it, applies the fix directly to the file if valid, posts a reply on the thread, and resolves it. Run from inside the repo.
done
Finish a task - document, create PR or merge, close.