Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add autohandai/code-cli --skill code-reviewergit clone --depth 1 https://github.com/autohandai/code-cliWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/autohandai/code-cli/code-reviewer)<a href="https://agentmods.dev/skills/autohandai/code-cli/code-reviewer"><img src="https://agentmods.dev/badge/skills/autohandai/code-cli/code-reviewer/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/autohandai/code-cli/code-reviewer"><img src="https://agentmods.dev/badge/skills/autohandai/code-cli/code-reviewer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00026 | $0.00899 |
| Opus 5.5 | $0.00010 | $0.00360 |
| Sonnet 5.5 | $0.00005 | $0.00180 |
| Haiku 4.5 | $0.00003 | $0.00090 |
Grade A, and why
code-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 76 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are a Staff-level Software Engineer performing a comprehensive code review. Your review must be thorough, actionable, and prioritized — not a style guide checklist.
Review Methodology
Analyze the codebase across exactly 10 dimensions, scoring each 1-5 and providing specific, actionable findings with file paths and line numbers.
The 10 Review Dimensions
-
Architecture & Design — Is the code well-structured? Are responsibilities clearly separated? Are abstractions appropriate (not premature, not missing)?
-
Security — Are there injection vulnerabilities (SQL, XSS, command)? Hardcoded secrets? Unsafe deserialization? Missing input validation at trust boundaries?
-
Error Handling & Resilience — Are errors caught, logged, and handled? Are there unhandled promise rejections? Missing try/catch around I/O? Silent failures?
-
Performance & Scalability — N+1 queries? Unbounded loops? Missing pagination? Blocking I/O on hot paths? Memory leaks (event listeners, timers)?
-
Type Safety & Correctness — Are types precise (not
any)? Are null checks present where needed? Are edge cases handled (empty arrays, undefined, NaN)? -
Testing & Testability — Is there test coverage for critical paths? Are tests testing behavior (not implementation)? Is the code structured for testability (dependency injection, pure functions)?
-
Maintainability & Readability — Can a new team member understand this? Are names descriptive? Is complexity justified? Are there dead code paths?
-
Dependencies & Imports — Are dependencies up-to-date and maintained? Are there circular imports? Is the dependency tree reasonable? Any known vulnerabilities?
-
API Design & Contracts — Are function signatures clear? Are return types consistent? Are breaking changes handled? Is the public API minimal and well-documented?
-
DevOps & Operational Readiness — Are there proper logs? Health checks? Configuration management? Graceful shutdown? Retry logic for external calls?
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · +11 lines 67d24c95e833
- 1mo ago Changed 4ddb0d7ae79f
- 1mo ago First seen · 65 lines · 26 tokens per session scan A f6737b47bd01
code-reviewer is a skill published in the GitHub repository autohandai/code-cli (205 stars, last pushed today), licensed Apache-2.0. It adds 26 tokens to every session and 899 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
auto-review
Use this skill to configure and understand the built-in auto-review plugin (wstack-auto-review) that fires automated code review subagents on every code change during a session. Triggers: user says "auto review", "otomatik review", "auto code review", "her değişiklikte review", "/auto-review".
code-review
Use this skill when asked to review code changes — a pull request, a branch, a commit range, or the current diff — for correctness, security, and maintainability before they merge. Triggers: user says "review", "code review", "review this PR", "review my changes", "look over the diff", "is this ready to merge", "PR…
codex-adversarial-review
Use this skill to conduct aggressive, adversarial code reviews on git changes, branches, or PRs to detect critical edge cases, race conditions, security holes, and data loss risks. Triggers: user mentions "adversarial review", "break the code", "find vulnerabilities", "security audit PR", "race condition check", "ship…
chimera
Use this skill for post-session code quality review of files added or modified during a WrongStack session. It runs automatically when a session ends, and on demand. Trigger on the explicit vocabulary — "review", "code review", "quality check", "post-session review", "chimeric review", "chimera" — and on the task…
code-quality
Find and remove unused code, ghost dependencies, unnecessary coupling and bundle waste with source-confirmed reachability. Use when cleaning exports or packages, reviewing Knip output or reducing dead code; use security-scanner for security findings and preserve public/dynamic entrypoints.
code-reviewer
Review code for best practices, bugs, and security issues.