agentsight-code-review

agentsight-code-review is a skill for Claude Code, Codex from alibaba/anolisa. It costs 75 tokens per session (1,245 once invoked), scanned A, original, Apache-2.0.

A review checklist for changes in the AgentSight codebase, compared with the main branch. It checks coding rules, eBPF safety, C-language interfaces, code-size growth, and tests.

In plain words
What is it for?
Reviewing a branch before a pull request, checking changed files for required safeguards, and producing numbered findings with file paths and line numbers.
Why use it?
It helps catch problems that a general code review might miss, especially in low-level monitoring code and interfaces between Rust and C.

Skill for Claude CodeCodex ✓ vendor

Written for no agent in particular: nothing here depends on one. Also seen: mentions CLAUDE.md; mentions AGENTS.md.

Good fit Reviewing a branch before a pull request, checking changed files for required safeguards, and producing numbered findings with file paths and line numbers.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/alibaba/anolisa/agentsight-code-review
About the project

ANOLISA is a server-side operating layer for AI agent workloads that provides terminal access, token-saving tool-output compression, runtime controls, security, observability, skills, memory, and sandbox management. It is for running and supervising agents from a Linux terminal while retaining an existing shell, agent framework, and sandbox. The catalogue add-ons are components of its agent operating environment and workflows.

alibaba/anolisa · 603 stars · on GitHub · agentic-os.sh

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add alibaba/anolisa --skill agentsight-code-review
Clone the repo
git clone --depth 1 https://github.com/alibaba/anolisa

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for agentsight-code-review

README.md
[![agentmods](https://agentmods.dev/badge/skills/alibaba/anolisa/agentsight-code-review/github.svg)](https://agentmods.dev/skills/alibaba/anolisa/agentsight-code-review)
Your own site
<a href="https://agentmods.dev/skills/alibaba/anolisa/agentsight-code-review"><img src="https://agentmods.dev/badge/skills/alibaba/anolisa/agentsight-code-review/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for agentsight-code-review

Your own site · 80×15
<a href="https://agentmods.dev/skills/alibaba/anolisa/agentsight-code-review"><img src="https://agentmods.dev/badge/skills/alibaba/anolisa/agentsight-code-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 75 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,245 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits
  • NVIDIA SkillSpector pass 7 Sept 2026
How audits are shown
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00075 $0.01245
Opus 5.5 $0.00030 $0.00498
Sonnet 5.5 $0.00015 $0.00249
Haiku 4.5 $0.00007 $0.00125

Measured 1mo ago against content hash 00fce8e7cc3b, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

agentsight-code-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

src/agentsight/develop-skills/agentsight-code-review/SKILL.md · 113 lines

How it starts

The opening of the file, as written. The whole thing — 113 lines — stays where its author put it; the contents beside it link to each section on GitHub.

AgentSight Code Review

目标

对当前分支相对于 main 的全部变更执行代码审查,输出所有 findings。

触发时自动执行

步骤 1:收集变更

git diff origin/main..HEAD
git diff --stat origin/main..HEAD
git log --oneline origin/main..HEAD

步骤 2:按维度审查

对 diff 中每个变更文件,依次检查以下 5 个维度。不要在发现第一个问题后停止,必须遍历全部文件和全部维度。

维度 1:硬性规则合规

对照 AGENTS.md ## 0. 硬性规则:

  • 非测试代码中是否使用了 unwrap() / expect() / dbg!()
  • 是否添加了 #[allow(clippy::...)] 但没有注释说明
  • 单个模块是否超过 500 行(不含测试),超过 2000 行的文件是否有拆分计划
  • PR diff 是否超过 800 行,复杂逻辑变更是否超过 500 行
维度 2:eBPF 安全

仅当 diff 涉及 src/bpf/ 或 src/probes/ 时检查:

  • BPF 程序是否兼容 kernel >= 5.8(不使用高版本才有的 helper)
  • ring buffer 大小是否合理(参考现有探针配置)
  • uprobe attach 的符号名是否正确,是否处理了符号不存在的情况
  • BPF map 的 key/value 类型是否与 Rust 侧定义一致
维度 3:FFI 边界

仅当 diff 涉及 src/ffi.rs 或 cbindgen.toml 时检查:

  • 新增/修改的 extern "C" 函数是否在 cbindgen.toml 的 after_includes 中同步声明
  • FFI 类型是否标注了 #[repr(C)]
  • 是否有 panic 可能穿越 FFI 边界(缺少 catch_unwind)
  • 指针参数是否做了 null check
维度 4:Footprint Ladder

对照 AGENTS.md ## 3. 代码表面增长控制:

  • 新增文件 → 是否可以通过扩展现有模块实现(级别 1-2)
  • 新增 eBPF 探针 → 是否附带架构影响说明(级别 4)
  • 新增 FFI 导出 → 是否附带架构影响说明(级别 5)
维度 5:流水线测试覆盖

仅当 diff 涉及 src/parser/、src/aggregator/、src/analyzer/、src/genai/、src/storage/ 时检查:

  • 流水线逻辑变更是否包含集成测试
  • 跨模块行为是否优先用集成测试而非单元测试
  • 测试代码是否放在 *_tests.rs 或 #[cfg(test)] mod tests 中
维度 6:文档同步

检查代码变更是否需要同步更新以下文档(根据变更内容自行判断):

  • AGENTS.md — 导航总览(Module Map、CLI、API、eBPF Probes、Configuration 等)
  • CLAUDE.md — 构建命令、CLI 用法、配置说明
  • src/FFI_AGENTS.md — FFI 层边界规则
  • src/UNIFIED_AGENTS.md — 主编排器边界规则
  • src/storage/AGENTS.md — 存储层边界规则
  • docs/PITFALLS.md — 常见踩坑记录
  • docs/adr/ — 架构决策记录(涉及架构选型变更时需新增 ADR)
  • docs/ARCHITECTURE.md — 架构设计文档
  • docs/DEVELOPMENT.md — 开发指南
  • docs/design-docs/ — 模块设计文档

步骤 3:输出 Findings

使用编号列表输出,每条 finding 必须包含:

N. [维度名] 文件路径:行号 — 问题描述
   建议:具体修复方式

示例:

1. [硬性规则] src/storage/sqlite/token.rs:142 — 非测试代码使用了 unwrap()
   建议:改为 .map_err(|e| anyhow::anyhow!("..."))? 或 .unwrap_or_default()

2. [eBPF] src/bpf/gotls.bpf.c:87 — bpf_loop() 需要 kernel >= 5.17,不兼容 5.8
   建议:改用 bounded for 循环

3. [Footprint Ladder] src/newmodule/mod.rs — 新增模块文件(级别 3),未说明为何不能扩展现有模块
   建议:在 PR 描述中补充为什么级别 1-2 不够

Read the full file on GitHub · 113 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 1mo ago First seen · 113 lines · 75 tokens per session scan A 00fce8e7cc3b

Subscribe to this mod's changes

agentsight-code-review is a skill published in the GitHub repository alibaba/anolisa (603 stars, last pushed 1mo ago), licensed Apache-2.0. It adds 75 tokens to every session and 1,245 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

review-pr

Review a pull request (GitHub) or merge request (GitLab) and provide detailed feedback.

desplega-ai/agent-swarm · 22 tokens

apps

Build and iterate on schema-backed Swarm Apps with live models, named queries, custom actions, and json-render interfaces using the app-upsert, app-get, app-list, and app-patch tools.

desplega-ai/agent-swarm · 43 tokens

kapso-whatsapp

How to interact with Kapso WhatsApp from the swarm — read inbound webhook payloads (text AND media), fetch message history, send free-form messages within the 24h session window (and template messages outside it), mark-as-read, show the typing indicator, send reactions, download media, verify webhook signatures, and…

desplega-ai/agent-swarm · 156 tokens

swarm-scripts

Bulk, repeat, fan-out, or data-heavy work: write and run swarm scripts (inline script-run, named script-upsert, durable launch-script-run). Covers the script-vs-tool rubric, the authoring contract (args first, ctx second), the seed catalog, connections and secrets, files and bash over the agent-fs drive (ctx.fs…

desplega-ai/agent-swarm · 100 tokens

open-prompt-showreel

Make a design-led motion-graphics video (showreel, eval comparison, feature or bug-hunt story) from one open prompt. Claude Opus at max effort designs, codes and renders the whole thing itself in a scratch dir, with no template and no repo PR. Use for any "make a video for X" / "do a showreel for Y" / "a little…

desplega-ai/agent-swarm · 181 tokens

attio-interaction

Generic Attio CRM REST API v2 recipes for querying records, upserting companies/people/deals, writing notes/tasks/comments, managing lists, and handling webhooks.

desplega-ai/agent-swarm · 39 tokens