Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
/plugin marketplace add husniadil/ekstendnpx agentmods add plugins/husniadil/ekstend/code-reviewgit clone --depth 1 https://github.com/husniadil/ekstendGrade A, and why
code-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
{
"name": "code-review",
"description": "Iterative code review toolkit. Bundles two skills: code-review (diff-based PR review or holistic codebase audit with gap detection and tracked fix loop) and address-pr-review (validate GitHub PR comments, fix, reply, and resolve threads).",
"version": "1.1.0",
"author": {
"name": "Husni Adil Makmur",
"email": "[email protected]"
},
"license": "MIT"
}
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 11 lines scan A 5cc50bb36033
code-review is a plugin published in the GitHub repository husniadil/ekstend (1 stars, last pushed 4mo ago), licensed MIT. Its token cost is not measured: this kind of file is read by the harness, not the model. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other plugins, from other repositories
moai-accountant
재무·세무 전담 AI 코워커 — 재무제표 분석·결산 관리·차이 분석·IR, 개인 세금 절약·가계 예산·투자 입문·보험 적합성 스킬 11종. OpenDART 전자공시 MCP 연동. 이런 분께 추천: 사업자·재무 담당자·개인 재테크 입문자. ※ 세무사·회계사 자문 대체가 아닌 참고 자료입니다.
moai-analyst
데이터·공공데이터 분석 전담 AI 코워커 — 데이터 프로파일링·시각화, 공공데이터 조회(부동산·경매·주식·KOSIS·건축물대장) 스킬 7종. KOSIS 통계·건축HUB·DART 전자공시 MCP 연동. 자연어 요청 시 매칭 스킬이 자동 호출됩니다. 이런 분께 추천: 데이터 애널리스트·사무직·기획자·자영업 운영자.
moai-career
구직자 편 커리어 코칭 전담 AI 코워커 — 이력서·포트폴리오 첨삭, 면접 준비, 이직 전략까지 커리어 전환 실무 스킬. 인사채용(고용주 편)과 구분되는 구직자 관점입니다. 이런 분께 추천: 이직 준비자·취업 준비생·주니어 직장인.
moai-consultant
경영·창업 컨설팅 전담 AI 코워커 — 사업계획서·비즈니스 모델·시장 분석(TAM/SAM/SOM)·경영 진단 브리프·정부 지원사업 매칭·상권분석 보고서까지 전략 실무 스킬 6종. 이런 분께 추천: 예비 창업자·소상공인·스타트업 운영자.
jasonm4130-claude-skills
Plugin marketplace listing 11 plugins: adr, codex-review, domain-modeling, frontend-design, gates.
subagent-driven-development
Deterministic, workflow-driven subagent development loop: plan -> confirm -> background Workflow runs per-task implement/review/fix with tiered models in deps-driven parallel waves (per-task worktrees + per-wave merge gate), ponytail anti-over-engineering discipline, deterministic BLOCKED escalation and oscillation…