Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add AnastasiyaW/codex-claude-code-config --skill deep-reviewgit clone --depth 1 https://github.com/AnastasiyaW/codex-claude-code-configWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/anastasiyaw/codex-claude-code-config/deep-review)<a href="https://agentmods.dev/skills/anastasiyaw/codex-claude-code-config/deep-review"><img src="https://agentmods.dev/badge/skills/anastasiyaw/codex-claude-code-config/deep-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/anastasiyaw/codex-claude-code-config/deep-review"><img src="https://agentmods.dev/badge/skills/anastasiyaw/codex-claude-code-config/deep-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Excessive Agency · line 202 Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.Fix: Set explicit rate limits, timeouts, and resource quotas for API calls, file operations, and compute. Implement circuit breakers for runaway loops.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00180 | $0.03998 |
| Opus 5 | $0.00090 | $0.01999 |
| Sonnet 5 | $0.00036 | $0.00800 |
| Haiku 4.5 | $0.00018 | $0.00400 |
Grade A, and why
deep-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 401 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Deep Review — Parallel Competency-Based Code Review
Inspired by Memento workflow engine's parallel review pattern. Philosophy: one focused expert per domain > one generalist checking everything.
Step 0: Determine scope
BASE=$(gh pr view --json baseRefName -q .baseRefName 2>/dev/null || git symbolic-ref refs/remotes/origin/HEAD 2>/dev/null | sed 's@refs/remotes/origin/@@' || echo "main")
echo "BASE: $BASE"
BASE_REF=$(git rev-parse --verify --quiet "refs/remotes/origin/$BASE" 2>/dev/null || git rev-parse --verify --quiet "$BASE" 2>/dev/null || true)
if [ -z "$BASE_REF" ]; then
echo "No locally available base ref for $BASE; cannot perform a read-only diff." >&2
exit 2
fi
echo "BASE_REF: $BASE_REF"
echo "=== DIFF STATS ==="
git diff "$BASE_REF" --stat
echo "=== CHANGED FILES ==="
git diff "$BASE_REF" --name-only
echo "=== DIFF SIZE ==="
git diff "$BASE_REF" --shortstat
Store the BASE branch name, resolved local base ref, and list of changed files.
Report-only review does not run git fetch, pull, or another command that
updates Git state. If the accepted task explicitly requires a fresh remote base
and permits that preparation mutation, run git fetch origin "$BASE" --quiet
without suppressing failure before resolving BASE_REF; otherwise state that
the review used the locally available ref.
If there is no diff, stop: "Nothing to review — no changes against $BASE."
Step 1: Scoping — select relevant competencies
Based on the changed files, select ONLY the competencies that are relevant. Do NOT run all 8 for a 3-file CSS change.
Default to a review-only task. Enter review-and-fix only when the user clearly authorizes both review and implementation (for example, "review and fix"). In either mode, the review phase remains read-only; review-and-fix continues with the approved remediation in this same task after findings are triaged.
Competency selection rules
| Competency | Trigger files/patterns |
|---|---|
| security | auth, middleware, routes handling user input, env files, CORS, JWT, crypto, passwords, tokens, API keys |
| performance | database queries, loops over collections, API endpoints, bundle config, image/asset handling, caching |
| architecture | new files/modules, cross-module imports, service boundaries, DI patterns, >5 files changed |
| database | migrations, schema changes, raw SQL, ORM queries, transactions, indexes |
| concurrency | queues, workers, locks, async/await patterns, shared state, cron jobs, webhooks |
| error-handling | try/catch blocks, error responses, validation, external API calls, file I/O |
| frontend | Vue/React components, CSS/Tailwind, composables/hooks, stores, routing, i18n |
| testing | test files changed OR >100 lines of logic changed without test changes |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday Changed · +26 lines · +14 tokens per session c13f4eca0ffb
- 3d ago Changed · +25 lines bf4a893d07bc
- 9d ago First seen · 350 lines · 166 tokens per session scan A d52cb1534203
deep-review is a skill published in the GitHub repository AnastasiyaW/codex-claude-code-config (149 stars, last pushed today), licensed MIT. It adds 180 tokens to every session and 3,998 once invoked, about $0.0009 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
discount-review
Inspect the discount policy fixture with a repeatable review checklist and helper script.
code-review
Perform comprehensive code reviews focusing on best practices, security vulnerabilities, performance optimization, and maintainability.
code-review
Reviews code for bugs, security issues, and best practices.
lfe-hygiene
Conduct a structural audit of the repository to detect "Documentation Drift" or "Spaghetti Files." Use in Phase 5 (Hygiene sub-pipeline, Step 1).
lfe-dep-audit
Inspector sub-skill. Reviews dependency manifest files (package.json, requirements.txt, go.mod, Cargo.toml, pom.xml) changed in the current diff for risky version patterns and stale majors. Emits a human-run audit instruction rather than executing tools. Writes .plans/checks/depfindings.md. Called by lfe-inspector…
lfe-security-check
Inspector sub-skill. Runs an OWASP Top-10 prompt-based security analysis on the current implementation diff. No external tooling required — pure LLM reasoning. Writes .plans/checks/securityfindings.md. Called by lfe-inspector when enabled in inspector-config.md.