Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/auerbachb/claude-code-config/receiving-code-reviewnpx skills add auerbachb/claude-code-config --skill receiving-code-reviewgit clone --depth 1 https://github.com/auerbachb/claude-code-configWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00059 | $0.01564 |
| Opus 5 | $0.00030 | $0.00782 |
| Sonnet 5 | $0.00012 | $0.00313 |
| Haiku 4.5 | $0.00006 | $0.00156 |
Grade A, and why
receiving-code-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 122 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Receiving Code Review — Judgment Layer
Code review requires technical evaluation, not emotional performance. This skill guides the EVALUATE step that sits between reading a bot finding and touching any code.
Core principle: Verify before implementing. Technical correctness over performative compliance.
Scope note: This file is the judgment layer. The mechanical loop — polling endpoints, batching fixes, replying to threads, resolving via GraphQL — belongs to
cr-github-review.md. Do not duplicate that loop here.
The Six-Step Response Pattern
WHEN a bot reviewer (coderabbitai[bot], cursor[bot], greptile-apps[bot],
codeant-ai[bot], graphite-app[bot]) posts a finding:
1. READ: Complete the finding without reacting
2. UNDERSTAND: Restate the requirement in your own words (or flag if unclear)
3. VERIFY: Check against codebase reality — open the actual file
4. EVALUATE: Is this finding technically sound FOR THIS codebase?
5. RESPOND: Technical acknowledgment or reasoned decline with evidence
6. IMPLEMENT: Only valid findings, one at a time, per cr-github-review.md
STOP before step 6 if you have not completed steps 3 and 4. Incomplete verification = incomplete review.
Step 3 — VERIFY maps to our verification step
"Check against the actual file" in step 3 is the same verification step described in cr-local-review.md. Specifically: open the file the finding references, read the surrounding context, confirm whether the code matches the reviewer's claim. Do not rely on memory or the diff alone.
Step 5 — RESPOND respects reply conventions
How you reply depends on the reviewer:
coderabbitai[bot]: Replies teach CodeRabbit's model. Use@coderabbitaiin a PR-level comment for general context; inline replies for thread-specific responses.cursor[bot](BugBot) /greptile-apps[bot]: Plain text only. Do NOT include@cursoror@greptileaiin reply comments — each mention triggers a new paid review. For the exact reply-format table see.claude/reference/greptile-reply-format.md.codeant-ai[bot]/graphite-app[bot]: Plain text inline replies.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 122 lines · 59 tokens per session scan A 39f7158934dc
receiving-code-review is a skill published in the GitHub repository auerbachb/claude-code-config (5 stars, last pushed 3d ago), licensed MIT. It adds 59 tokens to every session and 1,564 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
fixer
Surgical code fixer for Bug Hunter. Implements minimal, precise fixes for verified bugs. Uses doc-lookup (Context Hub + Context7) to verify correct API usage in patches. Respects fix strategy classifications (safe-autofix vs manual-review vs larger-refactor).
referee
Final arbiter for Bug Hunter. Receives Hunter findings and Skeptic challenges, independently re-reads code, and delivers authoritative verdicts with CVSS scoring and proof-of-concept generation for security findings.
commit-security-scan
Scan code changes for security vulnerabilities using Bug Hunter-native artifacts and STRIDE context. Use whenever the user asks for PR security review, commit-diff scanning, staged-change security checks, branch-comparison security review, or pre-merge security analysis of changed code.
decompose
Decompose project or track into modules with dependency mapping. Project scope updates architecture.md and derives .ai-context.md. Track scope generates hld.md (always) and lld.md (when --lld or High-complexity module triggers it) — design-mandated artifacts that drive implement, deploy-checklist, and upload sign-off.
adr
Create and manage Architecture Decision Records. Documents significant technical decisions with context, alternatives, and consequences. Also supports evaluate (assess proposals) and design (system design) modes.
deploy-checklist
Pre-deployment verification checklist. Generates customized checklists based on tech-stack with rollback triggers. Auto-invoked by /draft:upload.