Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add aeonfun/aeon --skill code-reviewergit clone --depth 1 https://github.com/aeonfun/aeonWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/aeonfun/aeon/code-reviewer)<a href="https://agentmods.dev/skills/aeonfun/aeon/code-reviewer"><img src="https://agentmods.dev/badge/skills/aeonfun/aeon/code-reviewer/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/aeonfun/aeon/code-reviewer"><img src="https://agentmods.dev/badge/skills/aeonfun/aeon/code-reviewer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.01058 |
| Opus 5.5 | $0.00000 | $0.00423 |
| Sonnet 5.5 | $0.00000 | $0.00212 |
| Haiku 4.5 | $0.00000 | $0.00106 |
Grade A, and why
[REPLACE: SKILL_NAME] scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
Copies of this mod
1 near-identical copy found in the catalogue:
- code-reviewer — 100% identical, 0 lines differ
How it starts
The opening of the file, as written. The whole thing — 80 lines — stays where its author put it; the contents beside it link to each section on GitHub.
${var} — Optional. PR number to review. If empty, scans all newly-opened PRs on
[REPLACE: WATCHED_REPO].
Today is ${today}. Review external PRs on [REPLACE: WATCHED_REPO] with a focus on [REPLACE: REVIEW_FOCUS].
Steps
-
List candidates — every open PR opened in the last 24h that hasn't been reviewed by this skill yet:
if [ -n "${var:-}" ]; then PRS="$var" else PRS=$(gh pr list -R [REPLACE: WATCHED_REPO] --state open --json number,author,createdAt,additions,deletions \ --jq '.[] | select(.author.login != "github-actions[bot]" and .author.login != "aeonframework") | .number') fiTrack previously-reviewed PRs in
memory/topics/[REPLACE: SKILL_NAME]-reviewed.json(a flat array of PR numbers). Skip anything already in there. -
For each PR — fetch metadata + diff:
gh pr view "$PR" -R [REPLACE: WATCHED_REPO] --json title,body,additions,deletions,files,author > .pr-meta.json gh pr diff "$PR" -R [REPLACE: WATCHED_REPO] > .pr-diff.patchSkip if
additions + deletions > [REPLACE: MAX_PR_LINES]— flag it asDEFERRED: too large for first-touch review, leave a note, and move on. -
Apply the rubric — assign one of four verdicts:
Verdict Trigger ACCEPT Touches expected paths, follows repo conventions, focused scope, no obvious bugs in the diff. NEEDS-CHANGES Reasonable intent but specific issues: missing tests, broken format, incorrect assumption, naming. DEFER Out of scope for this skill — needs a human reviewer (large refactor, architectural change). OUT-OF-SCOPE Touches files outside what the repo accepts contributions on (e.g. lock files, generated assets). Focus the rubric on [REPLACE: REVIEW_FOCUS] — that's the lens that matters most for this repo.
-
Post a comment — use a friendly, specific tone. Acknowledge the contributor, name the verdict, give 1-3 concrete bullets:
gh pr comment "$PR" -R [REPLACE: WATCHED_REPO] --body "Thanks for the PR! [verdict text] - [bullet 1] - [bullet 2]" -
Label the PR via
gh pr edit "$PR" -R [REPLACE: WATCHED_REPO] --add-label "<label>"— useaccepted/needs-changes/defer/out-of-scope(create the labels in the target repo first if they don't exist). -
Notify via
./notifyonly onACCEPTorOUT-OF-SCOPE— those are the actionable verdicts for the operator. Silent onNEEDS-CHANGESandDEFER(the comment on the PR is the signal). -
Log — append to
memory/logs/${today}.md:## [REPLACE: SKILL_NAME] - **PRs reviewed**: N (skipped M as previously seen) - **Verdicts**: accept=X, needs-changes=Y, defer=Z, out-of-scope=W - **Status**: REVIEW_OK | REVIEW_QUIET (no new PRs)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 80 lines · 0 tokens per session scan A 5b9bc341a60c
[REPLACE: SKILL_NAME] is a skill published in the GitHub repository aeonfun/aeon (776 stars, last pushed today), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 1,058 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
flow-deliver
Multi-AI validation, scoring, and review using Codex and Gemini CLIs (Double Diamond Deliver phase). Use when: AUTOMATICALLY ACTIVATE when user requests validation, scoring, or review:. "review X" or "validate Y" or "test Z". "score this", "quality check", "validate before shipping".
skill-code-review
Expert multi-AI code review with quality and security analysis.
no-mistakes
Validate committed feature-branch changes through the no-mistakes pipeline: intent, rebase, review, test, docs, lint, push, PR, and CI. Use when the user asks to run no-mistakes, ship safely, validate before pushing, or gate a change before it reaches upstream.
verify-implementation
A workflow that runs a project’s verification skills to produce a report on coding patterns, architecture rules, and project conventions. It is intended for work after implementation, before a pull request, or during code review.
flowcraft-config
Author, validate, and troubleshoot complete FlowCraft configuration: deployment documents (deploy.yaml with the runtime section, inference/workspace/sandbox/tool sub-documents, core/memory contracts, and graph JSON node wiring), craft.yaml application definitions, and plugin.json manifests. Use when writing or…
review-loop
Run the adversarial verification loop — implement, then hand the change to a fresh checker that did not write it, fix what it finds, and re-dispatch until APPROVE. Use before claiming any behavioural change is done, and on requests like "review loop", "adversarial review", "independent review", "get this verified"…