Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/alibaba/anolisa/agentsight-code-reviewnpx skills add alibaba/anolisa --skill agentsight-code-reviewgit clone --depth 1 https://github.com/alibaba/anolisaWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00075 | $0.01245 |
| Opus 5 | $0.00037 | $0.00622 |
| Sonnet 5 | $0.00015 | $0.00249 |
| Haiku 4.5 | $0.00007 | $0.00125 |
Grade A, and why
agentsight-code-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 113 lines — stays where its author put it; the contents beside it link to each section on GitHub.
AgentSight Code Review
目标
对当前分支相对于 main 的全部变更执行代码审查,输出所有 findings。
触发时自动执行
步骤 1:收集变更
git diff origin/main..HEAD
git diff --stat origin/main..HEAD
git log --oneline origin/main..HEAD
步骤 2:按维度审查
对 diff 中每个变更文件,依次检查以下 5 个维度。不要在发现第一个问题后停止,必须遍历全部文件和全部维度。
维度 1:硬性规则合规
对照 AGENTS.md ## 0. 硬性规则:
- 非测试代码中是否使用了
unwrap()/expect()/dbg!() - 是否添加了
#[allow(clippy::...)]但没有注释说明 - 单个模块是否超过 500 行(不含测试),超过 2000 行的文件是否有拆分计划
- PR diff 是否超过 800 行,复杂逻辑变更是否超过 500 行
维度 2:eBPF 安全
仅当 diff 涉及 src/bpf/ 或 src/probes/ 时检查:
- BPF 程序是否兼容 kernel >= 5.8(不使用高版本才有的 helper)
- ring buffer 大小是否合理(参考现有探针配置)
- uprobe attach 的符号名是否正确,是否处理了符号不存在的情况
- BPF map 的 key/value 类型是否与 Rust 侧定义一致
维度 3:FFI 边界
仅当 diff 涉及 src/ffi.rs 或 cbindgen.toml 时检查:
- 新增/修改的
extern "C"函数是否在cbindgen.toml的after_includes中同步声明 - FFI 类型是否标注了
#[repr(C)] - 是否有 panic 可能穿越 FFI 边界(缺少
catch_unwind) - 指针参数是否做了 null check
维度 4:Footprint Ladder
对照 AGENTS.md ## 3. 代码表面增长控制:
- 新增文件 → 是否可以通过扩展现有模块实现(级别 1-2)
- 新增 eBPF 探针 → 是否附带架构影响说明(级别 4)
- 新增 FFI 导出 → 是否附带架构影响说明(级别 5)
维度 5:流水线测试覆盖
仅当 diff 涉及 src/parser/、src/aggregator/、src/analyzer/、src/genai/、src/storage/ 时检查:
- 流水线逻辑变更是否包含集成测试
- 跨模块行为是否优先用集成测试而非单元测试
- 测试代码是否放在
*_tests.rs或#[cfg(test)] mod tests中
维度 6:文档同步
检查代码变更是否需要同步更新以下文档(根据变更内容自行判断):
AGENTS.md— 导航总览(Module Map、CLI、API、eBPF Probes、Configuration 等)CLAUDE.md— 构建命令、CLI 用法、配置说明src/FFI_AGENTS.md— FFI 层边界规则src/UNIFIED_AGENTS.md— 主编排器边界规则src/storage/AGENTS.md— 存储层边界规则docs/PITFALLS.md— 常见踩坑记录docs/adr/— 架构决策记录(涉及架构选型变更时需新增 ADR)docs/ARCHITECTURE.md— 架构设计文档docs/DEVELOPMENT.md— 开发指南docs/design-docs/— 模块设计文档
步骤 3:输出 Findings
使用编号列表输出,每条 finding 必须包含:
N. [维度名] 文件路径:行号 — 问题描述
建议:具体修复方式
示例:
1. [硬性规则] src/storage/sqlite/token.rs:142 — 非测试代码使用了 unwrap()
建议:改为 .map_err(|e| anyhow::anyhow!("..."))? 或 .unwrap_or_default()
2. [eBPF] src/bpf/gotls.bpf.c:87 — bpf_loop() 需要 kernel >= 5.17,不兼容 5.8
建议:改用 bounded for 循环
3. [Footprint Ladder] src/newmodule/mod.rs — 新增模块文件(级别 3),未说明为何不能扩展现有模块
建议:在 PR 描述中补充为什么级别 1-2 不够
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 113 lines · 75 tokens per session scan A 00fce8e7cc3b
agentsight-code-review is a skill published in the GitHub repository alibaba/anolisa (614 stars, last pushed 4d ago), licensed Apache-2.0. It adds 75 tokens to every session and 1,245 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
beevibe-team-mesh-negotiation
Multi-round negotiation protocol — covers both initiator and peer roles. Use when about to call negotiate(), when receiving a intent block as a peer, or when receiving an 'escalated' sentinel from a blocked respondnegotiate. Covers proposal crafting, counter-strategy, deadlock detection, when to accept early…
beevibe-verify-pr
CI verification before marking a PR-bearing task done. Use BEFORE calling mcpbeevibeupdateprogress(done) on any session whose deliverable is a pull request — including the first dispatch (you opened the PR with gh pr create) and any revision dispatch (you pushed new commits to an existing PR). Watches the PR's…
beevibe-pre-task-setup
Cold-start git workspace setup for a fresh beevibe task. Use at the start of a session whose intent has a block but NO or block — i.e. the first dispatch of this task. Checks for an existing repo clone, pulls the base branch if present (clone if missing), prunes any per-task worktrees from earlier tasks whose work has…
beevibe-use-repo
You are the child agent inside a fresh Docker sandbox. Borrow the given GitHub repo, produce a real artifact for the goal, and export it. Do not review the repo. The proof is that it works.
spec-converge
Iteratively review an instar-development spec with multi-angle internal reviewers (security, scalability, adversarial, integration, decision-completeness, lessons-aware) and real cross-model external reviewers routed through the agent's own installed CLIs (codex → GPT-tier, gemini → Gemini-tier; one pass per available…
beevibe-discover-repo
Find the best GitHub repo for a goal, then call userepo to run it in a sandbox. Use whenever the user's goal requires a capability you don't have natively and you haven't been given a specific repo.