Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
/plugin marketplace add HoussemDjeghri/self-reviewnpx agentmods add plugins/houssemdjeghri/self-review/plugingit clone --depth 1 https://github.com/HoussemDjeghri/self-reviewGrade A, and why
self-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
{
"name": "self-review",
"version": "0.4.0",
"description": "Review every code change before the turn ends: fresh-context reviewer agents, a verified finding standard, honest convergence, and a measured token budget — enforced by a Stop hook, graph-aware when you have a code graph, zero-cost when you don't.",
"author": { "name": "Houssem Djeghri", "url": "https://github.com/HoussemDjeghri" },
"homepage": "https://github.com/HoussemDjeghri/self-review",
"license": "MIT",
"keywords": ["code-review", "self-review", "agents", "hooks", "quality", "tokens"],
"hooks": {
"Stop": [
{
"hooks": [
{
"type": "command",
"command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/self-review-gate.mjs\"",
"timeout": 20,
"statusMessage": "self-review gate: checking this turn for unreviewed changes…"
}
]
}
],
"PreToolUse": [
{
"matcher": "Bash",
"hooks": [
{
"type": "command",
"command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/tree-guard.mjs\"",
"timeout": 10,
"statusMessage": "tree guard: checking a reviewer's command for tree writes…"
}
]
},
{
"matcher": "ListAgents|TaskOutput",
"hooks": [
{
"type": "command",
"command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/poll-guard.mjs\"",
"timeout": 10,
"statusMessage": "poll guard: checking for repeated status checks…"
}
]
}
]
}
}
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 48 lines scan A f05ecddfc289
self-review is a plugin published in the GitHub repository HoussemDjeghri/self-review (1 stars, last pushed 2d ago), licensed MIT. Its token cost is not measured: this kind of file is read by the harness, not the model. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other plugins, from other repositories
swarm-skill
Plugin marketplace listing 1 plugin: swarm-skill.
swarm-skill
Multi-agent codebase audit skill for Claude Code — spawns parallel subagents (security, performance, tests, architecture, dead-code) and synthesizes their findings into a prioritized action plan.
claude-skills-marketplace
Plugin marketplace listing 23 plugins: golden-rules, agent-based-development, mvp-readiness, full-security-review, git-workflow.
accessibility
WCAG 2.2 AA accessibility auditing and design guidance. Review mode audits existing code; design mode guides building accessible components.
agent-based-development
Full async multi-agent development workflow: Planning → Design → Dev → Security/Tech Review loop with file-based handoffs and release-branch Git model.
architecture-design
Guides system and feature architecture design with C4 diagrams, service boundaries, API contracts, failure analysis, and design artifacts.