Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/ValorVie/custom-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/valorvie/custom-skills/code-review)<a href="https://agentmods.dev/commands/valorvie/custom-skills/code-review"><img src="https://agentmods.dev/badge/commands/valorvie/custom-skills/code-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/commands/valorvie/custom-skills/code-review"><img src="https://agentmods.dev/badge/commands/valorvie/custom-skills/code-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.02898 |
| Opus 5 | $0.00000 | $0.01449 |
| Sonnet 5 | $0.00000 | $0.00580 |
| Haiku 4.5 | $0.00000 | $0.00290 |
Grade A, and why
code-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 251 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Code Review 審查標準
請依據以下標準審查此 Pull Request，並提供評分報告。
回覆語言
- 使用繁體中文撰寫審查意見
- 專有名詞保留英文原文（如 API、SQL injection、XSS、PR、commit、CRUD）
- 程式碼範例保持原樣
評分系統
評分維度與權重
| 維度 | 權重 | 說明 |
|---|---|---|
| 🔒 安全性 (Security) | 20% | 漏洞、敏感資料、認證授權 |
| ✅ 功能正確性 (Functionality) | 20% | 需求符合度、邊界案例、邏輯正確 |
| 📝 程式碼品質 (Code Quality) | 15% | 可讀性、命名、DRY、複雜度 |
| 🏗️ 架構設計 (Architecture) | 15% | 設計模式、關注點分離、依賴方向 |
| 🧪 測試覆蓋 (Testing) | 15% | 測試存在性、覆蓋率、測試品質 |
| ⚠️ 錯誤處理 (Error Handling) | 10% | 例外處理、錯誤訊息、資源清理 |
| 📚 文件完整性 (Documentation) | 5% | API 文件、註解、README/CHANGELOG |
評分等級（1-5 分）
| 分數 | 等級 | 說明 |
|---|---|---|
| 5 | Excellent | 超越標準，可作為範例 |
| 4 | Good | 符合標準，有小幅改進空間 |
| 3 | Acceptable | 基本符合，建議改進 |
| 2 | Needs Work | 有明顯問題，需要修改 |
| 1 | Critical | 嚴重問題，必須修正 |
綜合評分計算
綜合分數 = (安全性×0.20) + (功能×0.20) + (品質×0.15) + (架構×0.15) + (測試×0.15) + (錯誤處理×0.10) + (文件×0.05)
合併建議準則
| 綜合分數 | 建議 |
|---|---|
| 4.5 - 5.0 | ✅ 強烈建議合併 - 優秀的程式碼 |
| 4.0 - 4.4 | ✅ 建議合併 - 符合標準，小幅改進不阻擋 |
| 3.5 - 3.9 | ⚠️ 有條件合併 - 建議改進標記項目後合併 |
| 3.0 - 3.4 | ⚠️ 建議修改後合併 - 需解決主要問題 |
| 2.0 - 2.9 | ❌ 不建議合併 - 有明顯問題需修正 |
| 1.0 - 1.9 | ❌ 強烈不建議合併 - 嚴重問題必須修正 |
額外規則：
- 任何維度 ≤ 2 分：標記為 Blocking Issue
- 安全性維度 ≤ 3 分：標記為 Security Review Required
各維度評分標準
🔒 安全性 (Security) - 20%
| 分數 | 標準 |
|---|---|
| 5 | 無安全問題，有主動防禦措施（如 rate limiting、input sanitization） |
| 4 | 無安全問題 |
| 3 | 有低風險問題（如缺少部分輸入驗證） |
| 2 | 有中風險問題（如潛在 XSS） |
| 1 | 有高風險問題（如 SQL injection、敏感資料洩露、硬編碼密鑰） |
檢查項目：
- SQL injection / NoSQL injection
- XSS (Cross-Site Scripting)
- CSRF (Cross-Site Request Forgery)
- 輸入驗證與 sanitization
- 敏感資料處理（API key、密碼、PII 未寫死或外洩）
- 認證/授權邏輯正確
- 安全通訊協定（HTTPS）
✅ 功能正確性 (Functionality) - 20%
| 分數 | 標準 |
|---|---|
| 5 | 功能完整，邊界案例處理周全，邏輯清晰 |
| 4 | 功能正確，少數邊界案例可改進 |
| 3 | 核心功能正確，部分邊界案例未處理 |
| 2 | 有明顯功能缺陷或邏輯錯誤 |
| 1 | 核心功能不正確或有嚴重 bug |
檢查項目：
- 實作符合需求/ticket/PR 描述
- 邊界案例處理（null、空值、極端值）
- 錯誤狀態處理得當
- 資料驗證完整
- 並發/競爭條件考量（如適用）
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today First seen · 251 lines · 0 tokens per session scan A c2c155f42a9c
code-review is a command published in the GitHub repository ValorVie/custom-skills (5 stars, last pushed yesterday), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 2,898 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-09.
Other commands, from other repositories
refactor-analyze.template
This prompt was authored for Claude-style slash workflows. In Codex runtime, adapt tool calls as follows.
review-code
Perform comprehensive code quality review including standards, security, maintainability, and best practices validation.
pre-check
Run automated code quality pre-checks (linting, type validation, security audit) before manual review to reduce review time by 50%.
review-functional
Validate feature completeness, acceptance criteria, user experience, and functional requirements alignment with PRD/task specifications.
validate-parallel
Run assert and review-code commands in parallel to reduce validation time by 50%.
audit-cross-duplication
Detect N×M concern duplication across sibling directories and generate a prioritised refactoring narrative.