Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add AdamBien/airails --skill bce-reviewergit clone --depth 1 https://github.com/AdamBien/airailsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/adambien/airails/bce-reviewer)<a href="https://agentmods.dev/skills/adambien/airails/bce-reviewer"><img src="https://agentmods.dev/badge/skills/adambien/airails/bce-reviewer/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/adambien/airails/bce-reviewer"><img src="https://agentmods.dev/badge/skills/adambien/airails/bce-reviewer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00191 | $0.01585 |
| Opus 5.5 | $0.00076 | $0.00634 |
| Sonnet 5.5 | $0.00038 | $0.00317 |
| Haiku 4.5 | $0.00019 | $0.00159 |
Grade A, and why
bce-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 88 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Verify the BCE structure of $ARGUMENTS and report as briefly as possible. Review only; never modify code.
Composition
- rules come from
/bce; this skill owns only the procedure and the output format - the composed stack skill supplies the stack layer rules (e.g. "JAX-RS resources are boundary classes") and what counts as an external entry point; what it explicitly allows is not a finding
- dependencies are read from the source as the stack expresses them: Java
import, ES moduleimport … from, fully qualified references - domain vocabulary comes from the project itself —
package-info.mdor the SBCE spec, REST paths or routes, UI labels, test names,GLOSSARY.md— never from model knowledge of the domain; a BC name without a contradicting project source is not a finding - fixing belongs to the stack skill or
/sbce apply
Modes
| Invocation | Scope |
|---|---|
full [path] |
whole source tree below path (default: project root) |
diff |
uncommitted changes: git diff HEAD plus untracked files (git ls-files --others --exclude-standard) |
diff <ref> |
git diff <ref>... plus the working tree — a branch or PR range |
| mode omitted | diff when the working tree is dirty, otherwise full |
Both modes build the same BC map first: direct children of the top-level package are BCs; record each BC's layers, the cross-BC dependency edges, and per BC two counts — internal references (file pairs inside the BC that reference each other) and outgoing cross-BC references (file pairs reaching another BC). A reference is one import or fully qualified use per referencing file, counted once per target file; a reference to another BC's entity counts twice, because it bypasses the control contract.
fullreports every finding in the mapdiffreports only findings the change creates or worsens: new, moved, or renamed packages and files, added imports, added public control methods, added classes. Carving checks (cycles, fan-in/fan-out) use the full map as context but are reported only when the diff introduced the edge. Pre-existing findings in touched files collapse to one trailing line.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 88 lines · 191 tokens per session scan A aa31e7b2a041
bce-reviewer is a skill published in the GitHub repository AdamBien/airails (58 stars, last pushed 3d ago), licensed MIT. It adds 191 tokens to every session and 1,585 once invoked, about $0.0008 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-11.
Other skills, from other repositories
pr-review-comments
Posts review findings from a JSON file as inline comments on a GitHub Pull Request, attaching each comment to its file and line. Use when you have a list/JSON of review findings (each with a file path, line number, and a message such as summary/failurescenario) and want them published on a PR as inline review…
skill-author
Package and validate an existing skill draft for AutoVault when its frontmatter, resources, capabilities, or admission result need review.
otto-impact-assessment
Check the final diff's consumers, focused tests, evidence, and gaps.
otto-review-remediation
Handle trusted reviewers' change requests on Otto PRs.
feature-publish
Commit the feature, write the PR body, publish in the selected mode, and drive the PR.
otto-drive-pr
PR mergeability, CI, and live preview.