Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
/plugin marketplace add RadOrigin-LLC/RAD-Claude-Skillsnpx agentmods add plugins/radorigin-llc/rad-claude-skills/rad-code-reviewgit clone --depth 1 https://github.com/RadOrigin-LLC/RAD-Claude-SkillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/plugins/radorigin-llc/rad-claude-skills/rad-code-review)<a href="https://agentmods.dev/plugins/radorigin-llc/rad-claude-skills/rad-code-review"><img src="https://agentmods.dev/badge/plugins/radorigin-llc/rad-claude-skills/rad-code-review.svg" alt="Measured on agentmods" height="20"></a>Grade A, and why
rad-code-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 26 lines — stays where its author put it; the contents beside it link to each section on GitHub.
{
"name": "rad-code-review",
"version": "6.2.0",
"description": "The specialist lanes and memory that the built-in /code-review doesn't have. Invokes the built-in engine for general bug-finding (quick/standard/deep map to its effort levels), then adds what it lacks: a mechanical hallucinated-imports validator (lockfile-verified across Python/JS/TS/Rust/Go, with a vendored denylist of documented malicious typosquat names and did-you-mean suggestions, offline always); an AI-slop lane refreshed for agentic-era failures (test capitulation, deleted-guard regressions, weak-assertion tests, hardcoded expected outputs, scope-creep refactors, XSS/log-injection sink focus — every pattern sourced and labeled mechanical-vs-judgment); framework IDOR heuristics (Next.js server actions incl. the middleware-is-not-a-boundary anti-pattern, Express/Fastify, Django, Rails, Go); a Supabase/Firebase BaaS-RLS lane with a reachability gate and do-NOT-flag list; and deterministic findings memory — findings-index.py computes fingerprints and assigns stable CR-NNN IDs across runs, so reports show new/recurring/resolved mechanically, never from model memory.\n\n--security-deep runs a 4-phase launch-readiness pass (trust boundaries → data-exposure surface → authorization model → secrets) under a no-false-assurance contract: it never emits a \"safe to launch\" verdict, reports verified-vs-could-not-verify, and recommends a human pen-test. --verify-model runs the lane pass on a different model tier for a cross-tier second opinion. Fix application touches the working tree only — this plugin never commits. Scope is diff/branch/PR only; whole-repo wants /code-review ultra. Deep accessibility belongs to rad-a11y; over-engineering hunts to ponytail-review.\n\nTwo optional external passes bolt on when the tools are present, and skip themselves silently when they are not: a cross-model adversarial pass via the rad-codex plugin (an independent GPT second opinion on the same diff, standard/deep), aWhat it installs
The manifest is a name and a version. 1 skill travel with it, and installing the plugin installs all of them — 172 tokens a session between them. Each is measured on its own page, and each can be installed alone.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 26 lines scan A 3ba461cca215
rad-code-review is a plugin published in the GitHub repository RadOrigin-LLC/RAD-Claude-Skills (5 stars, last pushed 18d ago), licensed Apache-2.0. Its token cost is not measured: this kind of file is read by the harness, not the model. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other plugins, from other repositories
wes-bos-sick-picks
Research-first workflow for building modern, accessible frontend UI components in the spirit of Wes Bos. Researches pitfalls and platform capabilities before planning, designs for WCAG accessibility with modern web standards, then verifies the approach against Wes Bos on X plus trusted sources (MDN, web.dev…
android-reverse-engineering
Decompile Android APK/JAR/AAR with jadx, trace call flows through libraries, and document extracted APIs.
agent-scaffolders
Meta-plugin containing ecosystem generation and evolution auditing primitives. Includes scaffolding for Agent Skills, Plugins, CLI sub-agents, custom GitHub Copilot agents, GitHub Agentic Workflows (gh-aw), CI/CD Smart Failure agents, Azure Foundry agents, and skill evolution auditing (audit-skill).
ai-cli-harness-better-practices
Harness-agnostic session continuity: goal statements, status snapshots, handoffs, cold resume, replanning, and wrap-up. No git or GitHub required.
codeql-resolver
Systematic CodeQL alert analysis and resolution for GitHub Actions workflows.
script-guards
Prevents unnecessary script generation - enforces research-first, native-tool-first patterns via PreToolUse and UserPromptSubmit hooks.