Borrowing it
Nothing to install: this file belongs to whiteknightonhorse/APIbase. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/whiteknightonhorse/APIbase/main/.claude/commands/councilreview.mdgit clone --depth 1 https://github.com/whiteknightonhorse/APIbaseWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/whiteknightonhorse/apibase/councilreview)<a href="https://agentmods.dev/commands/whiteknightonhorse/apibase/councilreview"><img src="https://agentmods.dev/badge/commands/whiteknightonhorse/apibase/councilreview/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/commands/whiteknightonhorse/apibase/councilreview"><img src="https://agentmods.dev/badge/commands/whiteknightonhorse/apibase/councilreview.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.03557 |
| Opus 5 | $0.00000 | $0.01778 |
| Sonnet 5 | $0.00000 | $0.00711 |
| Haiku 4.5 | $0.00000 | $0.00356 |
Grade A, and why
councilreview scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 273 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Multi-Expert Council Review
You are a panel of 8 independent expert reviewers. Each expert analyzes the same diff but from their specialized perspective. Experts do not coordinate -- they review independently and may contradict each other. After all reviews, an Auto-Fix phase applies safe fixes for LOW/MEDIUM findings.
Step 1: Get the diff
Run git diff HEAD~1 to get the changes from the last commit. If on a feature branch, use git diff main...HEAD instead. If reviewing pending uncommitted changes, use git diff HEAD.
Read the full diff. Then read the complete file for every changed file (not just the diff context).
Step 2: Run 8 independent expert reviews
Each finding MUST include:
- severity: CRITICAL / HIGH / MEDIUM / LOW
- file:line (so auto-fix can locate it)
- issue (1-2 sentence description)
- fix (concrete: what code change resolves it — must be specific enough to execute, not "consider X")
Expert 1: Security Architect
Focus areas:
- Attack surface changes -- new endpoints, new user inputs, new external data flows
- Authentication and authorization -- bypasses, missing checks, privilege escalation
- Cryptographic usage -- weak algorithms, static keys, improper random generation
- Injection vectors -- SQL, NoSQL, command, SSRF, XSS, path traversal, URL injection
- Secrets management -- hardcoded credentials, secrets in logs, keys in error responses
- OWASP Top 10 applicability to this change
- For this project: x402/MPP payment bypass, escrow integrity, API key handling (SHA-256 hashed), MCP protocol auth, hot wallet key handling
Output 1-3 findings. Verdict: PASS / CONCERN / BLOCK
Expert 2: Performance Engineer
Focus areas:
- Latency impact -- new synchronous operations in hot paths, blocking I/O
- Throughput -- N+1 queries, unbounded result sets, missing pagination
- Memory -- leaks (uncleaned listeners, growing maps), large allocations per request
- Scaling bottlenecks -- single-threaded locks, global state, connection pool exhaustion
- Caching -- missing cache for expensive operations, incorrect TTL, cache invalidation bugs
- Database -- missing indexes, full table scans, unoptimized JOIN patterns
- For this project: Redis single-flight dedup, per-tool cache TTL, Prisma connection pool limits (API: 20, Worker: 10), provider timeout 10s, max response 1MB, 13-stage pipeline latency budget
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 273 lines · 0 tokens per session scan A 6a1af4c0f5ad
councilreview is a command published in the GitHub repository whiteknightonhorse/APIbase (10 stars, last pushed yesterday), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 3,557 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other commands, from other repositories
zooza-setup
One-time Zooza setup — teaches Claude your business vocabulary so it understands your terms in every future session.
show_diff
Call the showdiff MCP tool to show me a side-by-side visual diff (it returns an image in the chat). If I passed a checkpoint sha in $ARGUMENTS, diff that checkpoint; otherwise show my current uncommitted changes.
latent-review
Quick latent review of code using structured hidden-state reasoning.
checklist
Generate a custom checklist for the current feature based on user requirements.
clarify
Identify underspecified areas in the current feature spec by asking up to 5 highly targeted clarification questions and encoding answers back into the spec.
specify
Create or update the feature specification from a natural language feature description.