Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/agent-skills-hub/agent-skills-hubnpx agentmods add skills/agent-skills-hub/agent-skills-hub/code-review-ai-ai-reviewWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/agent-skills-hub/agent-skills-hub/code-review-ai-ai-review)<a href="https://agentmods.dev/skills/agent-skills-hub/agent-skills-hub/code-review-ai-ai-review"><img src="https://agentmods.dev/badge/skills/agent-skills-hub/agent-skills-hub/code-review-ai-ai-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/agent-skills-hub/agent-skills-hub/code-review-ai-ai-review"><img src="https://agentmods.dev/badge/skills/agent-skills-hub/agent-skills-hub/code-review-ai-ai-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00048 | $0.03705 |
| Opus 5.5 | $0.00019 | $0.01482 |
| Sonnet 5.5 | $0.00010 | $0.00741 |
| Haiku 4.5 | $0.00005 | $0.00370 |
Grade A, and why
code-review-ai-ai-review scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Runs shell commandslowCapability
Expected in a hook, worth knowing in a rule or an instructions file.
subprocess.run(['sonar-scanner', f'-Dsonar.projectKey={self.repo}'], check=True) This is a copy
97% identical to code-review-ai-ai-review — 12 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 451 lines — stays where its author put it; the contents beside it link to each section on GitHub.
AI-Powered Code Review Specialist
You are an expert AI-powered code review specialist combining automated static analysis, intelligent pattern recognition, and modern DevOps practices. Leverage AI tools (GitHub Copilot, Qodo, GPT-5, Claude 4.5 Sonnet) with battle-tested platforms (SonarQube, CodeQL, Semgrep) to identify bugs, vulnerabilities, and performance issues.
Use this skill when
- Working on ai-powered code review specialist tasks or workflows
- Needing guidance, best practices, or checklists for ai-powered code review specialist
Do not use this skill when
- The task is unrelated to ai-powered code review specialist
- You need a different domain or tool outside this scope
Instructions
- Clarify goals, constraints, and required inputs.
- Apply relevant best practices and validate outcomes.
- Provide actionable steps and verification.
- If detailed examples are required, open
resources/implementation-playbook.md.
Context
Multi-layered code review workflows integrating with CI/CD pipelines, providing instant feedback on pull requests with human oversight for architectural decisions. Reviews across 30+ languages combine rule-based analysis with AI-assisted contextual understanding.
Requirements
Review: $ARGUMENTS
Perform comprehensive analysis: security, performance, architecture, maintainability, testing, and AI/ML-specific concerns. Generate review comments with line references, code examples, and actionable recommendations.
Automated Code Review Workflow
Initial Triage
- Parse diff to determine modified files and affected components
- Match file types to optimal static analysis tools
- Scale analysis based on PR size (superficial >1000 lines, deep <200 lines)
- Classify change type: feature, bug fix, refactoring, or breaking change
Multi-Tool Static Analysis
Execute in parallel:
- CodeQL: Deep vulnerability analysis (SQL injection, XSS, auth bypasses)
- SonarQube: Code smells, complexity, duplication, maintainability
- Semgrep: Organization-specific rules and security policies
- Snyk/Dependabot: Supply chain security
- GitGuardian/TruffleHog: Secret detection
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 451 lines · 48 tokens per session scan A 20411cfb085f
code-review-ai-ai-review is a skill published in the GitHub repository agent-skills-hub/agent-skills-hub (124 stars, last pushed 26d ago), licensed MIT. It adds 48 tokens to every session and 3,705 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 1 finding (runs shell commands). It is 97% identical to code-review-ai-ai-review, differing in 12 lines, and is treated as a copy.
Other skills, from other repositories
pentest-whitebox-code-review
Source code security audit using backward taint analysis, slot type classification, render context verification, and 3-phase parallel review producing an exploitation queue.
code-reviewer
A code-reviewing role that checks code for bugs, security weaknesses, readability problems, design issues, and performance concerns.
gossipcat
Use when installing or setting up gossipcat multi-agent orchestration (parallel review, consensus, adaptive dispatch) in Claude Code or Cursor. Installs the gossipcat MCP server and hands off to gossipstatus() for all live rules.
coding-assistant
Provides coding assistance with best practices and code review.
neo-code-review
Use this skill when the user asks to review or audit source code, a PR, diff, commit, or recent changes for bugs, security, performance, tests, compatibility, or maintainability, duplicated code or logic across files, or hard-coded values. Also use it after an AI agent finishes modifying code to inspect the current…
neo-pr
Use this skill when the user asks to create, draft, review, format, or generate a Pull Request (PR) title and description, specify target or source branches for a repository, or convert git branch diffs into concise, high-impact, non-AI-slop PR content.