code-review

code-review is a skill for Codex from asherzj/ashers-agent-skills. It costs 111 tokens per session (1,974 once invoked), scanned A, original, MIT.

A skill for reviewing changes from a chosen commit, branch, tag, or merge-base against coding standards and the source specification.

In plain words
What is it for?
It is for reviewing branches or pull requests, finding the relevant specification and standards, and reporting findings from both review areas.
Why use it?
It separates checks for repository conventions from checks that the implementation meets the requested behaviour.

Skill for Codex

Written for Codex: agents/openai.yaml present. Also seen: mentions AGENTS.md.

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/asherzj/ashers-agent-skills/code-review
Any agent
npx skills add asherzj/ashers-agent-skills --skill code-review
Clone the repo
git clone --depth 1 https://github.com/asherzj/ashers-agent-skills

Made for: Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for code-review

README.md
[![agentmods](https://agentmods.dev/badge/skills/asherzj/ashers-agent-skills/code-review.svg)](https://agentmods.dev/skills/asherzj/ashers-agent-skills/code-review)
Your own site
<a href="https://agentmods.dev/skills/asherzj/ashers-agent-skills/code-review"><img src="https://agentmods.dev/badge/skills/asherzj/ashers-agent-skills/code-review.svg" alt="Measured on agentmods" height="20"></a>
Per session 111 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,974 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00111 $0.01974
Opus 5 $0.00056 $0.00987
Sonnet 5 $0.00022 $0.00395
Haiku 4.5 $0.00011 $0.00197

Measured 6d ago against content hash 6d0d56148ebe, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-06, from the pricing page.

Security

Grade A, and why

code-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

coding/code-review/SKILL.md · 88 lines

How it starts

The opening of the file, as written. The whole thing — 88 lines — stays where its author put it; the contents beside it link to each section on GitHub.

HEAD 与用户指定的固定点之间的 diff 进行双轴审查:

  • Standards:代码是否符合本仓库成文的编码规范?
  • Spec:代码是否忠实实现了来源 issue / spec(规格说明)?

两条轴以并行子代理运行,互不污染对方的上下文,然后由本 skill 汇总它们的发现。

工单系统(issue tracker)应已提供给你。如果 docs/agents/issue-tracker.md 缺失,让用户运行 /setup-engineering-skills

流程

1. 确定固定点

用户所说的任何东西都是固定点(commit SHA、分支名、tag、mainHEAD~5 等)。如果用户没有指定,主动询问。

一次性记下 diff 命令:git diff <fixed-point>...HEAD(三个点,即与 merge-base 比较)。同时用 git log <fixed-point>..HEAD --oneline 记下 commit 列表。

在继续之前,确认固定点可以解析(git rev-parse <fixed-point>)且 diff 非空。坏的引用或空的 diff 应该在这里就失败,而不是在两个并行子代理内部失败。

2. 找出 spec 来源

按以下顺序查找来源 spec:

  1. commit message 中的 issue 引用(#123Closes #45、GitLab 的 !67 等),按 docs/agents/issue-tracker.md 中的工作流获取。
  2. 用户作为参数传入的路径。
  3. docs/specs/.scratch/ 下与分支名或功能相匹配的 spec 文件。
  4. 如果什么都没找到,询问用户 spec 在哪里。如果用户说没有 spec,Spec 子代理将跳过并报告"无可用 spec"。

3. 找出规范来源

仓库中任何记载代码应当如何编写和依赖的文档,例如 AGENTS.mdCODING_STANDARDS.mdCONTRIBUTING.md、架构说明、CONTEXT-MAP.md 和本次影响区域内的 ADR。领域词汇表只用于检查名称和语义,不把实现细节强塞进 CONTEXT.md

在仓库已有文档之外,Standards 轴始终附带下面的坏味道基线:一组固定的 Fowler 代码坏味道(Refactoring 第 3 章),即使仓库没有任何文档也适用。有两条规则约束它:

  • 仓库优先。 成文的仓库规范永远胜出;凡仓库认可、而基线本会标记的东西,压下该坏味道不报。
  • 永远是主观判断。 每个坏味道都是带标签的启发式判断("可能是 Feature Envy"),绝不是硬性违规。与这里的任何规范一样,凡工具已强制的,一律跳过。

每个坏味道按是什么如何修复来读;将其与 diff 对照:

  • Mysterious Name(神秘命名):函数、变量或类型的名字没能揭示它做什么、装什么。→ 重命名;如果起不出诚实的名字,说明设计浑浊。
  • Duplicated Code(重复代码):同一逻辑形态出现在本次变更的多个差异块(hunk)或文件里。→ 提取共享形态,两处都调用它。
  • Feature Envy(依恋情结):方法伸进别的对象的数据多于自己的。→ 把方法搬移到它依恋的数据上。
  • Data Clumps(数据泥团):同几个字段或参数总是结伴出现(一个想要诞生的类型)。→ 把它们捆成一个类型,改传这个类型。
  • Primitive Obsession(基本类型偏执):用原语或字符串顶替一个本该有自己类型的领域概念。→ 给这个概念一个自己的小类型。
  • Repeated Switches(重复 switch):针对同一类型的相同 switch/if 级联在变更中反复出现。→ 用多态替换,或用一张两处共享的映射。
  • Shotgun Surgery(霰弹式修改):一个逻辑变更迫使 diff 中许多文件四处开花。→ 把一起变化的东西聚到一个模块里。
  • Divergent Change(发散式变化):一个文件或模块因多个不相关的原因被修改。→ 拆开,让每个模块只因一个原因变化。
  • Speculative Generality(夸夸其谈通用性):为 spec 没有的需求添加的抽象、参数或钩子。→ 删掉它;内联回去,直到真实需求出现。
  • Message Chains(消息链):调用方不该依赖的长 a.b().c().d() 链式导航。→ 用第一个对象上的一个方法把这段游走藏起来。
  • Middle Man(中间人):一个类或函数大多只是继续往下转发。→ 砍掉它,直接调用真正的目标。
  • Refused Bequest(被拒绝的遗赠):子类或实现者忽略或覆盖了继承来的大部分内容。→ 放弃继承,改用组合。

Read the full file on GitHub · 88 lines

Files

What ships with it

1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 6d ago First seen · 88 lines · 111 tokens per session scan A 6d0d56148ebe

Subscribe to this mod's changes

code-review is a skill published in the GitHub repository asherzj/ashers-agent-skills (2 stars, last pushed 8d ago), licensed MIT. It adds 111 tokens to every session and 1,974 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Related

Other skills, from other repositories

systematic-debugging

Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.

obra/superpowers · 21 tokens

local-ai-agents

Build local-first AI agents that run entirely on a developer workstation with Microsoft Foundry Local and Qwen function-calling models. Covers Small Language Models (SLMs), the OpenAI-compatible local endpoint, sandboxed local tools, local RAG with Chroma, local MCP servers, hybrid cloud/local routing, and the…

microsoft/ai-agents-for-beginners · 200 tokens

next-cache-components-adoption

Turn on Cache Components in a Next.js app and resolve the blocking routes it surfaces. Use when the user wants to enable, adopt, or migrate to Cache Components, flip the cacheComponents flag, work through a flood of blocking-prerender / instant validation errors, run the cache-components-instant-false codemod, or…

vercel/next.js · 95 tokens

chat-pet-sprite-creation

Use when creating or changing VS Code chat pet sprite art, sprite sheets, state animations, eye treatments, Stable/Insiders variants, or pet transitions under src/vs/workbench/contrib/chat/browser/widget/media/chatPet.

microsoft/vscode · 53 tokens

cpu-profile-analysis

Analyze V8/Chrome CPU profiles (.cpuprofile) and DevTools trace files (Trace-.json). Use when: profiling performance, investigating slow functions, comparing code paths, finding bottlenecks, analyzing timeToRequest, understanding call trees from sampling profiler data, analyzing layout/paint/rendering, investigating…

microsoft/vscode · 71 tokens

insight-error-page

Write or audit an insight-kind error page for the Next.js dev overlay. Use when creating a new errors/ .mdx page, auditing an existing one, or checking that a page matches the framework fix cards. Covers page structure, title alignment, FixCard cards with Copy prompt button, code snippets, terminology verification…

vercel/next.js · 83 tokens