Borrowing it
Nothing to install: this file belongs to adamw7/tools. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/adamw7/tools/main/.claude/skills/java-code-review/SKILL.mdgit clone --depth 1 https://github.com/adamw7/toolsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/adamw7/tools/java-code-review)<a href="https://agentmods.dev/skills/adamw7/tools/java-code-review"><img src="https://agentmods.dev/badge/skills/adamw7/tools/java-code-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/adamw7/tools/java-code-review"><img src="https://agentmods.dev/badge/skills/adamw7/tools/java-code-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00073 | $0.02675 |
| Opus 5.5 | $0.00029 | $0.01070 |
| Sonnet 5.5 | $0.00015 | $0.00535 |
| Haiku 4.5 | $0.00007 | $0.00267 |
Grade A, and why
java-code-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 205 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Java Code Review Skill
Systematic code review for the tools multi-module reactor. Start with the rules
this repo enforces at build time — an ArchUnit or surefire violation fails the
build, not just review — then the defect shapes this repository's own history
shows, then the general Java checks.
Review strategy
- Enforced rules (section 1) — anything there fails the build, so flag it as Critical regardless of how the code otherwise reads.
- Defect shapes (section 2) — the five shapes this repo actually ships fixes for. Highest yield after section 1; a generic checklist misses all five.
- General checks (section 3) — null safety, exceptions, collections, concurrency, idioms, resources, API, performance.
- Summary — findings by severity, with line references.
Focus on the changed lines (git diff), group similar findings, reference line
numbers rather than re-quoting blocks, and skip generated sources (protogen
output under target/) and fixtures.
## Code Review: [file/feature name]
### Critical
- [Issue + line reference + suggestion]
### Improvements
- [Suggestion + rationale]
### Minor/Style
- [Nitpicks, optional improvements]
### Good Practices Observed
- [Positive feedback]
| Severity | Criteria |
|---|---|
| Critical | Breaks an enforced repo rule, security/data-loss risk, or a likely crash |
| High | Bug likely, significant perf issue, breaks an API contract |
| Medium | Code smell, maintainability issue, missing best practice |
| Low | Style, minor optimization |
1. Repo rules the build enforces (check these FIRST)
Pinned by the module .architecture ArchUnit tests and the root surefire config.
Production code is io.github.adamw7.* (Java 25). Flag any violation as
Critical — CI will reject it.
| Rule | What to flag |
|---|---|
No continue / break |
Any use in any code. Prefer a single-exit loop or a helper method that returns early. |
| Logging via log4j2 only | System.out/err, java.lang.System.Logger, printStackTrace, System.exit — in tests too. |
Loggers private static final |
Any other modifier set on a Logger field. |
No Optional fields |
A field typed Optional<…>. Optional is for possibly-absent return values. |
Mutable static state is volatile |
A non-final mutable static field without volatile. |
java.time only |
Any use of legacy java.util.Date / Calendar. |
Abstract types prefixed Abstract, public fields final |
Except claude-code-enforcer, whose rule bases are named for the poms. |
| No package cycles / layering breaks | Data-source contracts depending on their impls, uniqueness core depending on its MCP adapter, JDBC outside source.db, a step spawning a process outside command. |
| Test conventions | Tests only in *Test/*IT; JUnit Jupiter only; no @Disabled; no Thread.sleep; no System.out/err. See testing-conventions. |
| Surefire 5 s/unit test | A unit test doing real work without a justified @Timeout. |
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · +2 lines 9f20b4137b83
- 1mo ago First seen · 203 lines · 73 tokens per session scan A 3d23901bfe06
java-code-review is a skill published in the GitHub repository adamw7/tools (11 stars, last pushed today), licensed MIT. It adds 73 tokens to every session and 2,675 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
814-regulations-iso-25010
Use when reviewing, designing, or modifying Java enterprise systems and need a structured, repeatable ISO/IEC 25010:2023 quality-attribute review covering Functional Suitability, Performance Efficiency, Compatibility, Interaction Capability, Reliability, Security, Maintainability, Flexibility, and Safety, producing an…
121-java-object-oriented-design
Use when reviewing, improving, or refactoring Java object-oriented design, including applying SOLID, DRY, or YAGNI; improving classes and interfaces; correcting encapsulation, inheritance, or polymorphism; resolving God Class, Feature Envy, or Data Clumps; and improving object creation, methods, or exception…
053-design-simple-rules
Use when Java design, refactoring, or implementation tradeoffs should be evaluated with Kent Beck's simple design rules, including passes the tests, reveals intention, has no duplication, and has the fewest elements. This should trigger for requests such as Apply simple design rules; Review this design with Beck's…
solid-principles
SOLID principles checklist with Java examples. Use when a class has too many responsibilities, an abstraction leaks, or a dependency points the wrong way, and when the user asks about Single Responsibility, Open/Closed, Liskov, Interface Segregation or Dependency Inversion. For naming, duplication and method length…
concurrency-review
Review Java concurrency code for thread safety, race conditions, deadlocks, and modern patterns (Virtual Threads, CompletableFuture, @Async). Use when user asks "check thread safety", "concurrency review", "async code review", or when reviewing multi-threaded code.
java-code-review
Systematic code review for Java with null safety, exception handling, concurrency, and performance checks. Use when user says "review code", "check this PR", "code review", or before merging changes.