Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/alinaqi/maggy/code-reviewnpx skills add alinaqi/maggy --skill code-reviewgit clone --depth 1 https://github.com/alinaqi/maggyWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/alinaqi/maggy/code-review)<a href="https://agentmods.dev/skills/alinaqi/maggy/code-review"><img src="https://agentmods.dev/badge/skills/alinaqi/maggy/code-review.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00015 | $0.06823 |
| Opus 5 | $0.00008 | $0.03411 |
| Sonnet 5 | $0.00003 | $0.01365 |
| Haiku 4.5 | $0.00002 | $0.00682 |
Grade C, and why
code-review scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
safety_strategy: drop-sudo ``` Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
# ~/.claude/settings.toml or project CLAUDE.md How it starts
The opening of the file, as written. The whole thing — 975 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Code Review Skill
Purpose: Enforce automated code reviews as a mandatory guardrail before every commit and deployment. Choose between Claude, OpenAI Codex, Google Gemini, or multiple engines for comprehensive analysis.
Sub-skills:
- adr-gate.md — Pre-review ADR and spec enforcement
Pre-Review: ADR Gate (Mandatory)
Before any review engine runs, the ADR gate executes automatically:
- Classify — trivial changes (typos, deps, tests-only) skip the gate
- Discover — scan
docs/adr/,_project_specs/, iCPG ReasonNodes, git history for linked ADRs and specs - Enforce — if no ADRs found for non-trivial changes:
- Interactive (default): draft ADR from git history, ask user to confirm
- Unattended (CI): write as
Status: proposed, proceed - Strict: block review until ADR exists
- Inject — feed discovered ADRs + specs into the review prompt as architectural context
ADR Compliance Review Dimension
Added to the standard 7 review categories:
| Category | What It Checks |
|---|---|
| ADR Compliance | Change conforms to documented decisions, no undocumented architectural shifts |
| Finding | Severity |
|---|---|
| Change contradicts accepted ADR | Critical |
| Architectural decision not in any ADR | High |
| ADR exists but is outdated/stale | Medium |
| Minor drift from ADR intent | Low |
See adr-gate.md for full protocol, reverse-engineering rules, and configuration.
Review Engine Choice
When running /code-review, users can choose their preferred review engine:
┌─────────────────────────────────────────────────────────────────┐
│ CODE REVIEW - Choose Your Engine │
├─────────────────────────────────────────────────────────────────┤
│ │
│ ○ Claude (default) │
│ Built-in, no extra setup, full conversation context │
│ │
│ ○ OpenAI Codex CLI │
│ GPT-5.2-Codex specialized for code review, 88% detection │
│ Requires: npm install -g @openai/codex │
│ │
│ ○ Google Gemini CLI │
│ Gemini 2.5 Pro with 1M token context, free tier available │
│ Requires: npm install -g @google/gemini-cli │
│ │
│ ○ Dual Engine (any two) │
│ Run two engines, compare findings, catch more issues │
│ │
│ ○ All Three (maximum coverage) │
│ Run Claude + Codex + Gemini for critical/security code │
│ │
└─────────────────────────────────────────────────────────────────┘
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 975 lines · 15 tokens per session scan C aa76e3145b6a
code-review is a skill published in the GitHub repository alinaqi/maggy (705 stars, last pushed 19d ago), licensed MIT. It adds 15 tokens to every session and 6,823 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it C with 2 findings (asks for root, reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
rulesync
Generates and syncs AI rule configuration files (.cursorrules, CLAUDE.md, copilot-instructions.md) across 20+ coding tools from a single source. Use when syncing AI rules, running rulesync commands, importing or generating rule files, or managing shared AI coding configurations.
establishing-project-context
Use when the user asks to establish shared project language, or project work exposes a conflicting, renamed, or deprecated domain term that needs active semantic modeling. Routine small tasks stay on the fast path.
loop
Full execution protocol for MODE: LOOP — the compound-engineering loop: brainstorm → plan → build → review → improve, iterating under defense-in-depth stop conditions with generator/critic separation, durable resumable state, and mandatory compounding learning capture. Loaded on demand by the architect when the loop…
loongsuite-pilot-insight
基于 LoongSuite Pilot / AI Coding Agent 日志生成事件洞察、组织洞察、数据质量、研发效能和 AI Native 使用类 SLS 报表时使用；包含 AI Coding 事件表语义，以及团队报表可选的部门维表、deptuser 组织关系、指标口径和公共 CTE，通常与 sls-dashboard-builder 一起使用。.
map-fast
Minimal workflow for small, low-risk changes — no planning, no learning.
ring:mapping-feature-relationships
Mapping how features relate and phasing the work: categorizing PRD features, grouping them into domains, charting cross-feature journeys, dependencies, and integration points, and defining the binding Phases that plan.md mirrors one-to-one at Gate 7. Gate 2 of ring:planning-large-features; runs after…