Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/UiPath/coder_evalnpx agentmods add commands/uipath/coder_eval/coder-eval-code-review-fullWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/uipath/coder_eval/coder-eval-code-review-full)<a href="https://agentmods.dev/commands/uipath/coder_eval/coder-eval-code-review-full"><img src="https://agentmods.dev/badge/commands/uipath/coder_eval/coder-eval-code-review-full/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/commands/uipath/coder_eval/coder-eval-code-review-full"><img src="https://agentmods.dev/badge/commands/uipath/coder_eval/coder-eval-code-review-full.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00008 | $0.14940 |
| Opus 5.5 | $0.00003 | $0.05976 |
| Sonnet 5.5 | $0.00002 | $0.02988 |
| Haiku 4.5 | $0.00001 | $0.01494 |
Grade A, and why
coder-eval-code-review-full scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 29d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 565 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Context
You are performing a structured codebase review of the coder_eval project.
Optional argument: $ARGUMENTS — space-separated tokens that control review scope and axis selection. See Scope Selection below. If empty, review the full codebase across all 8 axes.
Scope Selection
$ARGUMENTS accepts a space-separated set of tokens. Default scope is all.
Default axes are all 8.
Scope tokens (pick one):
all— full codebase (walksrc/coder_eval/). Default.local— uncommitted changes + untracked files. Resolve viagit status --porcelainplusgit difffor tracked changes; read untracked files directly.staged— only files ingit diff --staged --name-only.branch— files changed on the current branch vsmain(git diff main...HEAD --name-only).unpushed— commits on the current branch not onorigin(git log @{u}..HEAD --name-only --pretty=format: | sort -u).pr:<N>— files in GitHub PR #N at the PR's actual HEAD, not the local working tree. The local checkout may differ from (or be unaware of) the PR's branch. Resolve as follows:git fetch origin pull/<N>/head:pr-<N>— creates a local refpr-<N>at the PR's HEAD (works for fork PRs too via the GitHubpull/<N>/headrefspec).gh pr view <N> --json baseRefName -q .baseRefName→ store as<base>.git fetch origin <base>:refs/remotes/origin/<base>— ensure base is current.- File list:
git diff origin/<base>...pr-<N> --name-only. - Sub-agents read file contents via
git show pr-<N>:<path>, NOT via Read on the working tree. Include this instruction in every sub-agent prompt forpr:<N>scope.
Axis filter (optional, combinable with any scope):
axis:<comma-list>— restrict to the listed axis numbers (e.g.axis:4,6).
Action flags (optional, combinable with any scope):
--post-comment— after writing the report, post99-pr-comment.mdto the relevant PR viagh pr review <N> --comment --body-file <path>. Treat this token as explicit authorization to perform the shared-state action; do not re-confirm with the user. The PR number is resolved as follows:- If scope is
pr:<N>, use that N directly. - Otherwise (
branch/local/staged/unpushed/all), interpret the flag as "post to this PR" — the PR associated with the current branch. Resolve viagh pr view --json number,title,author,headRefName,baseRefName,state(no arg = current branch). If that succeeds and the PR isOPEN, use its number. Ifgh pr viewfails (no PR for the branch) or the PR is closed/merged, abort before running any tools with a clear error: "--post-comment requires eitherpr:<N>scope or an open PR for the current branch; got<branch>with no open PR" — and suggest pushing the branch + opening a PR first, or invoking withpr:<N>explicitly.
- If scope is
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 29d ago Changed 50e824be2554
- 1mo ago First seen · 565 lines · 8 tokens per session scan A c920883debd6
coder-eval-code-review-full is a command published in the GitHub repository UiPath/coder_eval (151 stars, last pushed today), licensed Apache-2.0. It adds 8 tokens to every session and 14,940 once invoked, about $0.0000 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other commands, from other repositories
review-pr
Command "review-pr" from saski/arnesto, covering review pr, what this command does, workflow steps, phase 0: initialize review and phase 1: analysis & summary.
review_prs
Hold the same bar as reviewpr: a Principal AWS Solutions Architect who is direct, specific, justifies every concern with a concrete risk and a file:line, distinguishes blocking issues from nits, and never rubber-stamps. This command orchestrates that single-PR review across a set of PRs — it does not restate the…
review_pr
Review as a Principal AWS Solutions Architect. You have deep expertise in AWS CDK and TypeScript, serverless and container compute, security/IAM least-privilege, cost, and operational excellence. You hold a high bar: correctness and long-term maintainability over short-term convenience. You are direct, specific, and…
harness-review
Review the current change set from an opposing harness-engineering perspective.
prepare-review
Package codebase for external review using RepoMix.
run-technical-review
Run /run-technical-review as a BACKGROUND task so this chat stays responsive. If the runinbackground tool is available: call runinbackground with name "Technical review + fix", completionmode "presentresult", the review instruction below, and a messagesequence with one follow-up message (id "fix") carrying the fix…