ANOLISA is a server-side operating layer for AI agent workloads that provides terminal access, token-saving tool-output compression, runtime controls, security, observability, skills, memory, and sandbox management. It is for running and supervising agents from a Linux terminal while retaining an existing shell, agent framework, and sandbox. The catalogue add-ons are components of its agent operating environment and workflows.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add alibaba/anolisa --skill agentsight-code-reviewgit clone --depth 1 https://github.com/alibaba/anolisaWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/alibaba/anolisa/agentsight-code-review)<a href="https://agentmods.dev/skills/alibaba/anolisa/agentsight-code-review"><img src="https://agentmods.dev/badge/skills/alibaba/anolisa/agentsight-code-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/alibaba/anolisa/agentsight-code-review"><img src="https://agentmods.dev/badge/skills/alibaba/anolisa/agentsight-code-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00075 | $0.01245 |
| Opus 5.5 | $0.00030 | $0.00498 |
| Sonnet 5.5 | $0.00015 | $0.00249 |
| Haiku 4.5 | $0.00007 | $0.00125 |
Grade A, and why
agentsight-code-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 113 lines — stays where its author put it; the contents beside it link to each section on GitHub.
AgentSight Code Review
目标
对当前分支相对于 main 的全部变更执行代码审查,输出所有 findings。
触发时自动执行
步骤 1:收集变更
git diff origin/main..HEAD
git diff --stat origin/main..HEAD
git log --oneline origin/main..HEAD
步骤 2:按维度审查
对 diff 中每个变更文件,依次检查以下 5 个维度。不要在发现第一个问题后停止,必须遍历全部文件和全部维度。
维度 1:硬性规则合规
对照 AGENTS.md ## 0. 硬性规则:
- 非测试代码中是否使用了
unwrap()/expect()/dbg!() - 是否添加了
#[allow(clippy::...)]但没有注释说明 - 单个模块是否超过 500 行(不含测试),超过 2000 行的文件是否有拆分计划
- PR diff 是否超过 800 行,复杂逻辑变更是否超过 500 行
维度 2:eBPF 安全
仅当 diff 涉及 src/bpf/ 或 src/probes/ 时检查:
- BPF 程序是否兼容 kernel >= 5.8(不使用高版本才有的 helper)
- ring buffer 大小是否合理(参考现有探针配置)
- uprobe attach 的符号名是否正确,是否处理了符号不存在的情况
- BPF map 的 key/value 类型是否与 Rust 侧定义一致
维度 3:FFI 边界
仅当 diff 涉及 src/ffi.rs 或 cbindgen.toml 时检查:
- 新增/修改的
extern "C"函数是否在cbindgen.toml的after_includes中同步声明 - FFI 类型是否标注了
#[repr(C)] - 是否有 panic 可能穿越 FFI 边界(缺少
catch_unwind) - 指针参数是否做了 null check
维度 4:Footprint Ladder
对照 AGENTS.md ## 3. 代码表面增长控制:
- 新增文件 → 是否可以通过扩展现有模块实现(级别 1-2)
- 新增 eBPF 探针 → 是否附带架构影响说明(级别 4)
- 新增 FFI 导出 → 是否附带架构影响说明(级别 5)
维度 5:流水线测试覆盖
仅当 diff 涉及 src/parser/、src/aggregator/、src/analyzer/、src/genai/、src/storage/ 时检查:
- 流水线逻辑变更是否包含集成测试
- 跨模块行为是否优先用集成测试而非单元测试
- 测试代码是否放在
*_tests.rs或#[cfg(test)] mod tests中
维度 6:文档同步
检查代码变更是否需要同步更新以下文档(根据变更内容自行判断):
AGENTS.md— 导航总览(Module Map、CLI、API、eBPF Probes、Configuration 等)CLAUDE.md— 构建命令、CLI 用法、配置说明src/FFI_AGENTS.md— FFI 层边界规则src/UNIFIED_AGENTS.md— 主编排器边界规则src/storage/AGENTS.md— 存储层边界规则docs/PITFALLS.md— 常见踩坑记录docs/adr/— 架构决策记录(涉及架构选型变更时需新增 ADR)docs/ARCHITECTURE.md— 架构设计文档docs/DEVELOPMENT.md— 开发指南docs/design-docs/— 模块设计文档
步骤 3:输出 Findings
使用编号列表输出,每条 finding 必须包含:
N. [维度名] 文件路径:行号 — 问题描述
建议:具体修复方式
示例:
1. [硬性规则] src/storage/sqlite/token.rs:142 — 非测试代码使用了 unwrap()
建议:改为 .map_err(|e| anyhow::anyhow!("..."))? 或 .unwrap_or_default()
2. [eBPF] src/bpf/gotls.bpf.c:87 — bpf_loop() 需要 kernel >= 5.17,不兼容 5.8
建议:改用 bounded for 循环
3. [Footprint Ladder] src/newmodule/mod.rs — 新增模块文件(级别 3),未说明为何不能扩展现有模块
建议:在 PR 描述中补充为什么级别 1-2 不够
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 113 lines · 75 tokens per session scan A 00fce8e7cc3b
agentsight-code-review is a skill published in the GitHub repository alibaba/anolisa (603 stars, last pushed 1mo ago), licensed Apache-2.0. It adds 75 tokens to every session and 1,245 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
review-pr
Review a pull request (GitHub) or merge request (GitLab) and provide detailed feedback.
apps
Build and iterate on schema-backed Swarm Apps with live models, named queries, custom actions, and json-render interfaces using the app-upsert, app-get, app-list, and app-patch tools.
kapso-whatsapp
How to interact with Kapso WhatsApp from the swarm — read inbound webhook payloads (text AND media), fetch message history, send free-form messages within the 24h session window (and template messages outside it), mark-as-read, show the typing indicator, send reactions, download media, verify webhook signatures, and…
swarm-scripts
Bulk, repeat, fan-out, or data-heavy work: write and run swarm scripts (inline script-run, named script-upsert, durable launch-script-run). Covers the script-vs-tool rubric, the authoring contract (args first, ctx second), the seed catalog, connections and secrets, files and bash over the agent-fs drive (ctx.fs…
open-prompt-showreel
Make a design-led motion-graphics video (showreel, eval comparison, feature or bug-hunt story) from one open prompt. Claude Opus at max effort designs, codes and renders the whole thing itself in a scratch dir, with no template and no repo PR. Use for any "make a video for X" / "do a showreel for Y" / "a little…
attio-interaction
Generic Attio CRM REST API v2 recipes for querying records, upserting companies/people/deals, writing notes/tasks/comments, managing lists, and handling webhooks.