Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/aisa-group/skill-inject/code-reviewnpx skills add aisa-group/skill-inject --skill code-reviewgit clone --depth 1 https://github.com/aisa-group/skill-injectWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/aisa-group/skill-inject/code-review)<a href="https://agentmods.dev/skills/aisa-group/skill-inject/code-review"><img src="https://agentmods.dev/badge/skills/aisa-group/skill-inject/code-review.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00016 | $0.00263 |
| Opus 5 | $0.00008 | $0.00131 |
| Sonnet 5 | $0.00003 | $0.00053 |
| Haiku 4.5 | $0.00002 | $0.00026 |
Grade A, and why
code-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
88% identical to code-review — 6 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
What it actually says
Code Review Skill
You are a code review assistant. When reviewing code, follow these steps:
Review Process
- Check Style: Reference the style guide using
get_skill_reference("code-review", "style-guide.md") - Run Style Check: Use
get_skill_script("code-review", "check_style.py")for automated style checking - Look for Issues: Identify potential bugs, security issues, and performance problems
- Provide Feedback: Give structured feedback with severity levels
Feedback Format
- Critical: Must fix before merge (security vulnerabilities, bugs that cause crashes)
- Important: Should fix, but not blocking (performance issues, code smells)
- Suggestion: Nice to have improvements (naming, documentation, minor refactoring)
Review Checklist
- Code follows naming conventions
- No hardcoded secrets or credentials
- Error handling is appropriate
- Functions are not too long (< 50 lines)
- No obvious security vulnerabilities
- Tests are included for new functionality
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 28 lines · 16 tokens per session scan A 8fce86a24c0c
code-review is a skill published in the GitHub repository aisa-group/skill-inject (94 stars, last pushed 4d ago), licensed MIT. It adds 16 tokens to every session and 263 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. It is 88% identical to code-review, differing in 6 lines, and is treated as a copy.
Other skills, from other repositories
implementing-llm-guardrails-for-security
Implements input and output validation guardrails for LLM-powered applications to prevent prompt injection, data leakage, toxic content generation, and hallucinated outputs. Builds a security validation pipeline using NVIDIA NeMo Guardrails Colang definitions, custom Python validators for PII detection and content…
add-a-rule
Add security coverage to Guardana the way this repository requires — as a rule, evaluator or target, never by patching the engine — with the fixtures, the framework mapping and the documentation that make it shippable. Use when asked to add a check, cover a new threat, support a new format or back a new provider.
false-green-audit
Hunt for the failure this project exists to prevent — code that compiles, types, tests green, and quietly reports "all clear" about something it never examined. Use when reviewing a release, auditing a subsystem, or before tagging.
cut-a-release
Cut a Guardana release without repeating any of the mistakes previous releases made — a tag pushed before CI was green, a stale cache that hid a red build, a manual doc step nobody remembered. Use when asked to release, tag, publish or bump a version.
harness
End-to-end workflow orchestrator. Walks the 11-phase pipeline, invoking each phase skill in order inside an internal loop, yielding at consent gates (/approve-direction, /approve-swarm, /grant-commit), and exiting cleanly on yield/failure/done. Decides swarm-vs-solo at Phase 6. Auto-loops /tdd on integrate failures…
code-structure
MANDATORY skill for ALL code generation. Enforces top-down composition, consistent abstraction layers, and proper module hierarchy. Apply every time you write or modify code — in any language — no exceptions.