Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/adamw7/tools/java-code-reviewnpx skills add adamw7/tools --skill java-code-reviewgit clone --depth 1 https://github.com/adamw7/toolsWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00073 | $0.02656 |
| Opus 5 | $0.00036 | $0.01328 |
| Sonnet 5 | $0.00015 | $0.00531 |
| Haiku 4.5 | $0.00007 | $0.00266 |
Grade A, and why
java-code-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 203 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Java Code Review Skill
Systematic code review for the tools multi-module reactor. Start with the rules
this repo enforces at build time — an ArchUnit or surefire violation fails the
build, not just review — then the defect shapes this repository's own history
shows, then the general Java checks.
Review strategy
- Enforced rules (section 1) — anything there fails the build, so flag it as Critical regardless of how the code otherwise reads.
- Defect shapes (section 2) — the five shapes this repo actually ships fixes for. Highest yield after section 1; a generic checklist misses all five.
- General checks (section 3) — null safety, exceptions, collections, concurrency, idioms, resources, API, performance.
- Summary — findings by severity, with line references.
Focus on the changed lines (git diff), group similar findings, reference line
numbers rather than re-quoting blocks, and skip generated sources (protogen
output under target/) and fixtures.
## Code Review: [file/feature name]
### Critical
- [Issue + line reference + suggestion]
### Improvements
- [Suggestion + rationale]
### Minor/Style
- [Nitpicks, optional improvements]
### Good Practices Observed
- [Positive feedback]
| Severity | Criteria |
|---|---|
| Critical | Breaks an enforced repo rule, security/data-loss risk, or a likely crash |
| High | Bug likely, significant perf issue, breaks an API contract |
| Medium | Code smell, maintainability issue, missing best practice |
| Low | Style, minor optimization |
1. Repo rules the build enforces (check these FIRST)
Pinned by the module .architecture ArchUnit tests and the root surefire config.
Production code is io.github.adamw7.* (Java 25). Flag any violation as
Critical — CI will reject it.
| Rule | What to flag |
|---|---|
No continue / break |
Any use in any code. Prefer a single-exit loop or a helper method that returns early. |
| Logging via log4j2 only | System.out/err, java.lang.System.Logger, printStackTrace, System.exit — in tests too. |
Loggers private static final |
Any other modifier set on a Logger field. |
No Optional fields |
A field typed Optional<…>. Optional is for possibly-absent return values. |
Mutable static state is volatile |
A non-final mutable static field without volatile. |
java.time only |
Any use of legacy java.util.Date / Calendar. |
Abstract types prefixed Abstract, public fields final |
Except claude-code-enforcer, whose rule bases are named for the poms. |
| No package cycles / layering breaks | Data-source contracts depending on their impls, uniqueness core depending on its MCP adapter, JDBC outside source.db, a step spawning a process outside command. |
| Test conventions | Tests only in *Test/*IT; JUnit Jupiter only; no @Disabled; no Thread.sleep; no System.out/err. See testing-conventions. |
| Surefire 5 s/unit test | A unit test doing real work without a justified @Timeout. |
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 203 lines · 73 tokens per session scan A 3d23901bfe06
java-code-review is a skill published in the GitHub repository adamw7/tools (11 stars, last pushed 4d ago), licensed MIT. It adds 73 tokens to every session and 2,656 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
union-type-wrappers
Add typed getters and setters over BinaryData properties that represent TypeSpec union types in generated Java models. Use when generated classes expose BinaryData for union-typed fields and you need ergonomic, type-safe accessors instead.
build-with-tinybase
Scaffold, extend, and verify reactive local-first JavaScript or TypeScript applications with TinyBase. Use when choosing TinyBase for in-memory tabular or key-value state, generating an app with create-tinybase, adding schemas or UI bindings, configuring browser or database persistence, configuring MergeableStore…
tika-eval-compare
Compare extracts from two Tika builds over a corpus to detect regressions in content, encoding, exceptions, and embedded-document handling. Use for "compare before/after extracts", "eval this change against the corpus".
run-tests
Run project tests using Maven (mvn). Use when the user asks to run tests.
search-m2
Search for Java classes inside Maven dependencies in /.m2. Use when the user asks to locate classes or inspect JARs. Cross-reference pom.xml files in the current directory to resolve dependency names/versions.
using-process-tool
Describes how to correctly use 'process' tool.