Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add 233i/agent-skills --skill code-review-and-qualitygit clone --depth 1 https://github.com/233i/agent-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/233i/agent-skills/code-review-and-quality)<a href="https://agentmods.dev/skills/233i/agent-skills/code-review-and-quality"><img src="https://agentmods.dev/badge/skills/233i/agent-skills/code-review-and-quality/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/233i/agent-skills/code-review-and-quality"><img src="https://agentmods.dev/badge/skills/233i/agent-skills/code-review-and-quality.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00061 | $0.03561 |
| Opus 5 | $0.00030 | $0.01781 |
| Sonnet 5 | $0.00012 | $0.00712 |
| Haiku 4.5 | $0.00006 | $0.00356 |
Grade A, and why
code-review-and-quality scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 344 lines — stays where its author put it; the contents beside it link to each section on GitHub.
代码评审与质量
概览
带质量门禁的多维度代码评审。每一项改动在合并前都必须经过评审，没有例外。评审覆盖五个维度：正确性、可读性、架构、安全性和性能。
批准标准： 当一个改动能够明确提升整体代码健康度时，就应该批准，即使它还不完美。完美代码不存在，目标是持续改进。不要因为“不是你会写出来的样子”就阻塞变更。只要它让代码库变得更好，并且遵守项目约定，就应该批准。
何时使用
- 合并任何 PR 或改动之前
- 完成功能实现之后
- 当另一个 agent 或模型产出了你需要评估的代码时
- 重构现有代码时
- 任意 bug 修复之后，同时评审修复本身和回归测试
五维评审
每次评审都要从以下维度检查代码：
1. 正确性
这段代码是否真的完成了它声称完成的事？
- 是否符合 spec 或任务要求？
- 边界情况是否处理了，例如
null、空值、临界值？ - 是否处理了错误路径，而不仅是 happy path？
- 所有测试是否通过？测试本身是否真的在测正确的东西？
- 是否有 off-by-one、竞态条件或状态不一致问题？
2. 可读性与简洁性
另一个工程师或 agent 是否能在不找作者解释的前提下看懂它？
- 名称是否清晰，是否符合项目约定？不要出现无上下文的
temp、data、result - 控制流是否直白？避免嵌套三元表达式、深层回调
- 代码组织是否合理？相关内容是否放在一起，模块边界是否清晰
- 有没有“聪明过头”的技巧应该被简化？
- 能不能用更少的代码实现？ 1000 行才能做完 100 行就能做的事，就是失败
- 抽象是否配得上它的复杂度？ 没有第三个用例前，不要泛化
- 是否存在需要注释解释的非显然意图？不要注释显而易见的代码
- 有没有死代码痕迹，例如
_unused、兼容旧逻辑的 shim、// removed一类注释？
3. 架构
这个改动是否符合系统设计？
- 它是沿用现有模式，还是引入了新模式？如果是新模式，理由是否充分？
- 是否保持了清晰的模块边界？
- 有没有本该共用却重复实现的代码？
- 依赖方向是否正确，有没有循环依赖？
- 抽象层级是否合适？既不过度设计，也不过度耦合
4. 安全性
更详细的安全指导见 security-and-hardening。这个改动会不会引入漏洞？
- 用户输入是否做了校验和清洗？
- Secrets 是否远离代码、日志和版本控制？
- 该做认证 / 授权检查的地方是否做了？
- SQL 查询是否参数化，避免字符串拼接？
- 输出是否编码以防 XSS？
- 依赖是否来自可信来源，且无已知漏洞？
- 来自外部的数据，例如 API、日志、用户内容、配置文件，是否都被当作不可信输入？
- 外部数据流在进入业务逻辑或渲染前，是否在系统边界被验证？
5. 性能
更详细的性能分析见 performance-optimization。这个改动是否引入性能问题？
- 有没有 N+1 查询模式？
- 有没有无界循环或无限制的数据抓取？
- 有没有该异步却写成同步的操作？
- UI 组件里有没有不必要的重复渲染？
- 列表接口是否缺少分页？
- 热路径上是否构造了大对象？
改动大小
小而聚焦的改动更容易评审、更快合并，也更安全。目标尺寸如下：
~100 lines changed → Good. Reviewable in one sitting.
~300 lines changed → Acceptable if it's a single logical change.
~1000 lines changed → Too large. Split it.
什么算“一项改动”： 一个自洽的修改，只解决一件事，包含相关测试，并且提交后系统仍可工作。是一块功能切片，而不是整个功能。
当改动过大时的拆分策略：
| 策略 | 做法 | 适用场景 |
|---|---|---|
| Stack | 先提交小改动，再基于它继续下一层 | 串行依赖 |
| By file group | 按文件组拆分，方便不同 reviewer 处理 | 横跨多个关注面 |
| Horizontal | 先做共享代码 / 桩，再做使用方 | 分层架构 |
| Vertical | 按全栈功能切片继续拆小 | 功能开发 |
什么情况下大改动还能接受： 完整删除文件，或自动化重构这类 reviewer 只需验证意图、无需逐行看细节的改动。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 344 lines · 61 tokens per session scan A 53e6e5d92be5
code-review-and-quality is a skill published in the GitHub repository 233i/agent-skills (6 stars, last pushed 5mo ago), licensed MIT. It adds 61 tokens to every session and 3,561 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
autoreview
Pre-commit/ship code review: Codex default; optional Claude or Pi.
rework-rate
Measure and interpret PR rework rate — the emerging 5th DORA metric.
omh-code-review
This is a Hermes-native code-review workflow skill.
revdiff-plan
Review the last Codex assistant message (plan, analysis, or proposal) with inline annotations in a TUI overlay. Extracts the most recent response from Codex rollout files and opens it in revdiff for review and annotation. Activates on "revdiff-plan", "review plan with revdiff", "annotate plan", "review last response"…
code-reviewer
Code review specialist focused on patterns, bugs, security, and performance.
agent-teams-simplify-and-harden
Implementation + audit loop using parallel agent teams with structured simplify, harden, and document passes. Spawns implementation agents to do the work, then audit agents to find complexity, security gaps, and spec deviations, then loops until code compiles cleanly, all tests pass, and auditors find zero issues or…