Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/AgentureHQ/agenture-loopnpx agentmods add skills/agenturehq/agenture-loop/code-reviewWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/agenturehq/agenture-loop/code-review)<a href="https://agentmods.dev/skills/agenturehq/agenture-loop/code-review"><img src="https://agentmods.dev/badge/skills/agenturehq/agenture-loop/code-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/agenturehq/agenture-loop/code-review"><img src="https://agentmods.dev/badge/skills/agenturehq/agenture-loop/code-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00056 | $0.01184 |
| Opus 5.5 | $0.00022 | $0.00474 |
| Sonnet 5.5 | $0.00011 | $0.00237 |
| Haiku 4.5 | $0.00006 | $0.00118 |
Grade A, and why
code-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 121 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Code Review
Read-only review of the codebase. Produces actionable backlog tasks for findings. Does not modify code.
When to Use
Run periodically — after completing a batch of tasks, before a release, or when the codebase has accumulated drift from multiple contributors or agents working on isolated tasks.
Workflow
- Determine scope — ask the user what to review: the entire codebase, a specific module, or recent changes (e.g.,
git diff main..HEADor a date range). - Run the checklist — evaluate each category below. For each finding, note the file, line, and a concrete recommendation.
- Present summary to user — show findings grouped by category and severity. Discuss with user which findings warrant action.
- Create backlog tasks — for each approved finding (or group of related findings), create a task file in
tasks/backlog/following the task management standard. These tasks are then executed later via/agn:task-implement.
Review Checklist
1. Dead Code & Unused Artifacts
- Unused imports, variables, functions, classes, and modules
- Commented-out code blocks (belongs in version control, not in source)
- Unused dependencies in
requirements.txt,package.json, etc. - Orphaned configuration files or scripts that no longer serve a purpose
2. Type Safety
- Python: all function signatures should have type hints for parameters and return values.
- TypeScript: no
anytypes without justification. Prefer interfaces over inline types for reused shapes. - Data transfer boundaries (API endpoints, serialization) should have explicit type definitions.
3. Function & Module Design
- Functions should be small and do one thing. If a function exceeds ~30 lines, evaluate whether it can be decomposed.
- Modules should have clear single responsibility.
- Nesting depth: flag functions with more than 3 levels of nesting.
4. DRY Violations
- Duplicated logic across files or modules.
- Similar but slightly different implementations of the same concept.
- Opportunities to extract shared utilities, base classes, or mixins.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2mo ago First seen · 121 lines · 56 tokens per session scan A acede8ec4b79
code-review is a skill published in the GitHub repository AgentureHQ/agenture-loop (2 stars, last pushed 4mo ago), licensed Apache-2.0. It adds 56 tokens to every session and 1,184 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
arrow-maintenance
Navigation and audit overlay for linked-intent development. Use when working with docs/arrows/ — orienting via index.yaml, auditing spec-to-code coherence, detecting reverse orphans and drift, splitting/merging/renaming/re-parenting segments. Dual-mode: ambient guidance when the overlay is present…
code-reviewer
Code review knowledge base: quality, security (OWASP Top 10), error-handling, performance, and test-coverage checklists with severity-ranked output format. Use when reviewing code changes, PRs, or before commits. Loaded automatically by the code-reviewer agent.
review-depth
Experimental declared review depth for linked-intent development. Use when a LID project's instruction file declares a review depth in prose (e.g. 'Review depth - I review through LLD; below that, consolidate to one review') or the user asks to batch phase reviews, consolidate stops, or let go below a phase depth.…
bidirectional-differential
Audit coherence across an arrow of intent by running two parallel fresh Claude sessions — one reconstructs code from a single EARS, the other reconstructs the EARS from stripped code — then classifies the drift between them. Use when the user invokes /differential-audit, asks to audit EARS-to-code drift for a feature…
pr-contribution
Prepare pull requests for repositories you do not maintain: find the project's AI-contribution rules before writing code, earn a reviewer, and shape the change so a volunteer can say yes. The user opens the PR. Not for filing issues.
review
Structured code review with parallel audit agents, confidence-scored triage, and optional auto-fix. Examines uncommitted changes, staged diffs, commit ranges, or specific paths. Produces a tiered report (MUST-FIX / RECOMMENDED / NIT) backed by evidence, then optionally applies fixes with verification.