Borrowing it
Nothing to install: this file belongs to 363045841/KLineChartQuant. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/363045841/KLineChartQuant/main/.opencode/skills/codereview-techniques/SKILL.mdgit clone --depth 1 https://github.com/363045841/KLineChartQuantWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/363045841/klinechartquant/codereview-techniques)<a href="https://agentmods.dev/skills/363045841/klinechartquant/codereview-techniques"><img src="https://agentmods.dev/badge/skills/363045841/klinechartquant/codereview-techniques/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/363045841/klinechartquant/codereview-techniques"><img src="https://agentmods.dev/badge/skills/363045841/klinechartquant/codereview-techniques.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00062 | $0.01501 |
| Opus 5.5 | $0.00025 | $0.00600 |
| Sonnet 5.5 | $0.00012 | $0.00300 |
| Haiku 4.5 | $0.00006 | $0.00150 |
Grade A, and why
codereview-techniques scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 22d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 86 lines — stays where its author put it; the contents beside it link to each section on GitHub.
代码审查技巧
与 codereview 配合使用:codereview 讲「查什么原则」,本技能讲「怎么下手、怎么定位、怎么验证」。
审查前先用 CodeGraph 建立调用链与影响面,不要一上来就 grep/read。
0. 先用改动量定位战场
git diff --numstat <base>..HEAD,按增+删排序,先审改动最多的文件;新文件按纯新增计。- 优先核心模块与公共契约,样式/展示层靠后。
- 分清「新文件」与「被改文件」:新文件看整体设计,被改文件看语义漂移。
1. 散落守卫 / 重复前置条件
「同一个前置条件在 N 处各写一遍」就是 finding。
- 手法:grep 关键变量或条件片段(如
grep -n "autoSave\|disposed\|loaded"),统计重复次数与写法差异。 - 收敛为单一谓词或 helper;重点抓第 N+1 处写法不一致的地方(例如某处漏了
disposed判断)。
2. 重复的状态重置 / 半截实现
- 同一「重置 A、再置 B」序列在多处重复 → 抽成一个方法(如
markClean())。 - 重点抓只做了一半的调用点:那是漂移信号(例:三处同时更新基线与 dirty,第四处只更新 dirty)。
3. 双通路 / 影子持久化
- 同一业务状态是否被两套机制各自读写:localStorage + IndexedDB、
commit()+ 裸save()。 - 确认所有写入是否走唯一路径;恢复/加载是否存在两条来源相互覆盖。
- 删除旧通路后,grep 残留的 storage key、事件监听、构造参数、
schedule*钩子。
4. 契约二次定义 / 依赖选型
- 手写校验或 schema 是否把某个类型的字段又列了一遍;优先「类型由 schema 派生」或「持久化用守卫、类型单独定义」,一处为准。
- 依赖选型是否与仓库约定一致:例如 typebox 只用于外部不可信输入(Agent 工具),自有持久化应沿用既有手写 codec 约定。
5. 无意义守卫 / fallback 残余
逐条问「这个分支真的可能被走到吗?」
const x = map[k] ?? null紧接if (!x) return null→?? null冗余。- 守卫重复了上游调用方已经做过的校验 → 跨层重复守卫。
- 永真的
obj[k] ? … : [](k 来自Object.keys(obj))→ 死分支,改用Object.entries省掉。 real ?? (fallback as T)里的as兜底 → 类型谎言。?? default分两种:可选字段 / 未就绪占位(保留);掩盖本不该缺失的值(删除)。- 破坏性判断:删守卫前确认唯一调用路径已保证不变式,否则保留并加注释说明。
6. 魔法字符串 / 枚举散落
- 同一组 id/枚举由生产端定义、消费端再判定 → 提共享常量,避免字符串在两处各自拼。
- 更优:把「是否可操作」这类规则收回领域层(如让列表项携带
deletable),UI 只读标记。
7. 变更传播
- 删除或重命名后,grep 代码、测试、
docs/、README、导出入口、包exportsmap。 - 确认测试也被类型检查(vue-tsc /
pnpm type-check:tests),不能只靠运行时转译。 - 注意分层方向:engine 反向 import controllers 之类的依赖,先确认是不是仓库既有约定,再决定是否 flag。
8. 测试价值
- 识别只覆盖被删能力或旧通路的用例、以及重复覆盖。
- 有价值的行为应「改走新路径」保留覆盖(如把构造期注入的用例改为
kernel.applyLayout(...)),而不是直接删掉了事。 - 关联判断:删掉旧实现后,原来依赖它的断言是否一并失去对象。
9. 验证闭环
pnpm type-check(vue-tsc 逐 tsconfig)、定向vitest run <paths>、biome check <files>。- 框架包经 package
exports解析 core 的dist类型:改 core 公共契约后,必须先pnpm --filter <core> build再给前端 type-check,否则校验到的是陈旧 d.ts。 - 记录「零新增 lint error」,并区分仓库既有错误(例如
theme-light/dark.ts的 organizeImports)。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 22d ago First seen · 86 lines · 62 tokens per session scan A ddca2c8e34c2
codereview-techniques is a skill published in the GitHub repository 363045841/KLineChartQuant (37 stars, last pushed today), licensed Apache-2.0. It adds 62 tokens to every session and 1,501 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-08.
Other skills, from other repositories
agent-upkeep
Perform one small, scoped maintenance improvement to the Elements monorepo and open a single reviewable pull request. Use this skill for scheduled or unattended upkeep runs that improve unit test coverage for one file, fix one behavioral bug in one module, or move one off ESLint rule toward enforcement to reduce…
agent-debug-ci
Investigate failed scheduled or nightly GitHub Actions runs on the default branch, determine whether the failure is reproducible and repository-owned, implement the smallest evidence-backed fix, validate it, and open a pull request. Use when a failed nightly CI event starts an agent, or when the standard CI or…
review
Review one pull request for real bugs, regressions, and convention violations. Enumerate candidate issues across the whole diff, verify each against the code, then return structured line-anchored findings and a verdict. Read-only on GitHub; the orchestrator posts the review.
adversarial-reviewer
Stress-test a code change for concrete correctness defects, unsafe assumptions, and failure modes. Use when the user explicitly asks for an adversarial review, a deep bug hunt, or to tear a change apart, or to check your own change before submitting it. Do not use for ordinary review, style feedback, or general…
establishing-code-ownership
Determine which PostHog team owns a file, directory, or code path, or enumerate all code a team owns (via distributed owners.yaml, products//product.yaml, and .github/CODEOWNERS). Use when assigning a reviewer, attributing a bug or slow query to a team, routing work, scoping a team-wide audit, or answering "who owns…
extending-hobby-smoke-tests
Design, extend, review, or debug PostHog Hobby end-to-end smoke tests in bin/hobby-ci.py and .github/workflows/ci-hobby.yml. Use when adding an ingestion round trip, deciding whether a product belongs in Hobby CI, changing the CI Hobby service topology or API-key scopes, or diagnosing a smoke test that captures data…