agentsight-code-review

A review checklist for changes in the AgentSight codebase, compared with the main branch. It checks coding rules, eBPF safety, C-language interfaces, code-size growth, and tests.

In plain words
What is it for?
Reviewing a branch before a pull request, checking changed files for required safeguards, and producing numbered findings with file paths and line numbers.
Why use it?
It helps catch problems that a general code review might miss, especially in low-level monitoring code and interfaces between Rust and C.

Skill for Claude CodeCodex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/alibaba/anolisa/agentsight-code-review
Any agent
npx skills add alibaba/anolisa --skill agentsight-code-review
Clone the repo
git clone --depth 1 https://github.com/alibaba/anolisa

Made for: Claude Code, Codex.

Per session 75 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,245 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00075 $0.01245
Opus 5 $0.00037 $0.00622
Sonnet 5 $0.00015 $0.00249
Haiku 4.5 $0.00007 $0.00125

Measured 3d ago against content hash 00fce8e7cc3b, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

agentsight-code-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

src/agentsight/develop-skills/agentsight-code-review/SKILL.md · 113 lines

How it starts

The opening of the file, as written. The whole thing — 113 lines — stays where its author put it; the contents beside it link to each section on GitHub.

AgentSight Code Review

目标

对当前分支相对于 main 的全部变更执行代码审查,输出所有 findings。

触发时自动执行

步骤 1:收集变更

git diff origin/main..HEAD
git diff --stat origin/main..HEAD
git log --oneline origin/main..HEAD

步骤 2:按维度审查

对 diff 中每个变更文件,依次检查以下 5 个维度。不要在发现第一个问题后停止,必须遍历全部文件和全部维度。

维度 1:硬性规则合规

对照 AGENTS.md ## 0. 硬性规则

  • 非测试代码中是否使用了 unwrap() / expect() / dbg!()
  • 是否添加了 #[allow(clippy::...)] 但没有注释说明
  • 单个模块是否超过 500 行(不含测试),超过 2000 行的文件是否有拆分计划
  • PR diff 是否超过 800 行,复杂逻辑变更是否超过 500 行
维度 2:eBPF 安全

仅当 diff 涉及 src/bpf/src/probes/ 时检查:

  • BPF 程序是否兼容 kernel >= 5.8(不使用高版本才有的 helper)
  • ring buffer 大小是否合理(参考现有探针配置)
  • uprobe attach 的符号名是否正确,是否处理了符号不存在的情况
  • BPF map 的 key/value 类型是否与 Rust 侧定义一致
维度 3:FFI 边界

仅当 diff 涉及 src/ffi.rscbindgen.toml 时检查:

  • 新增/修改的 extern "C" 函数是否在 cbindgen.tomlafter_includes 中同步声明
  • FFI 类型是否标注了 #[repr(C)]
  • 是否有 panic 可能穿越 FFI 边界(缺少 catch_unwind
  • 指针参数是否做了 null check
维度 4:Footprint Ladder

对照 AGENTS.md ## 3. 代码表面增长控制

  • 新增文件 → 是否可以通过扩展现有模块实现(级别 1-2)
  • 新增 eBPF 探针 → 是否附带架构影响说明(级别 4)
  • 新增 FFI 导出 → 是否附带架构影响说明(级别 5)
维度 5:流水线测试覆盖

仅当 diff 涉及 src/parser/src/aggregator/src/analyzer/src/genai/src/storage/ 时检查:

  • 流水线逻辑变更是否包含集成测试
  • 跨模块行为是否优先用集成测试而非单元测试
  • 测试代码是否放在 *_tests.rs#[cfg(test)] mod tests
维度 6:文档同步

检查代码变更是否需要同步更新以下文档(根据变更内容自行判断):

  • AGENTS.md — 导航总览(Module Map、CLI、API、eBPF Probes、Configuration 等)
  • CLAUDE.md — 构建命令、CLI 用法、配置说明
  • src/FFI_AGENTS.md — FFI 层边界规则
  • src/UNIFIED_AGENTS.md — 主编排器边界规则
  • src/storage/AGENTS.md — 存储层边界规则
  • docs/PITFALLS.md — 常见踩坑记录
  • docs/adr/ — 架构决策记录(涉及架构选型变更时需新增 ADR)
  • docs/ARCHITECTURE.md — 架构设计文档
  • docs/DEVELOPMENT.md — 开发指南
  • docs/design-docs/ — 模块设计文档

步骤 3:输出 Findings

使用编号列表输出,每条 finding 必须包含:

N. [维度名] 文件路径:行号 — 问题描述
   建议:具体修复方式

示例:

1. [硬性规则] src/storage/sqlite/token.rs:142 — 非测试代码使用了 unwrap()
   建议:改为 .map_err(|e| anyhow::anyhow!("..."))? 或 .unwrap_or_default()

2. [eBPF] src/bpf/gotls.bpf.c:87 — bpf_loop() 需要 kernel >= 5.17,不兼容 5.8
   建议:改用 bounded for 循环

3. [Footprint Ladder] src/newmodule/mod.rs — 新增模块文件(级别 3),未说明为何不能扩展现有模块
   建议:在 PR 描述中补充为什么级别 1-2 不够

Read the full file on GitHub · 113 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 3d ago First seen · 113 lines · 75 tokens per session scan A 00fce8e7cc3b

Subscribe to this mod's changes

agentsight-code-review is a skill published in the GitHub repository alibaba/anolisa (614 stars, last pushed 4d ago), licensed Apache-2.0. It adds 75 tokens to every session and 1,245 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

beevibe-team-mesh-negotiation

Multi-round negotiation protocol — covers both initiator and peer roles. Use when about to call negotiate(), when receiving a intent block as a peer, or when receiving an 'escalated' sentinel from a blocked respondnegotiate. Covers proposal crafting, counter-strategy, deadlock detection, when to accept early…

beevibe-ai/beevibe · 112 tokens

beevibe-verify-pr

CI verification before marking a PR-bearing task done. Use BEFORE calling mcpbeevibeupdateprogress(done) on any session whose deliverable is a pull request — including the first dispatch (you opened the PR with gh pr create) and any revision dispatch (you pushed new commits to an existing PR). Watches the PR's…

beevibe-ai/beevibe · 172 tokens

beevibe-pre-task-setup

Cold-start git workspace setup for a fresh beevibe task. Use at the start of a session whose intent has a block but NO or block — i.e. the first dispatch of this task. Checks for an existing repo clone, pulls the base branch if present (clone if missing), prunes any per-task worktrees from earlier tasks whose work has…

beevibe-ai/beevibe · 198 tokens

beevibe-use-repo

You are the child agent inside a fresh Docker sandbox. Borrow the given GitHub repo, produce a real artifact for the goal, and export it. Do not review the repo. The proof is that it works.

beevibe-ai/beevibe · 50 tokens

spec-converge

Iteratively review an instar-development spec with multi-angle internal reviewers (security, scalability, adversarial, integration, decision-completeness, lessons-aware) and real cross-model external reviewers routed through the agent's own installed CLIs (codex → GPT-tier, gemini → Gemini-tier; one pass per available…

JKHeadley/instar · 135 tokens

beevibe-discover-repo

Find the best GitHub repo for a goal, then call userepo to run it in a sandbox. Use whenever the user's goal requires a capability you don't have natively and you haven't been given a specific repo.

beevibe-ai/beevibe · 51 tokens