Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add camilooscargbaptista/cto-toolkit --skill full-reviewgit clone --depth 1 https://github.com/camilooscargbaptista/cto-toolkitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/camilooscargbaptista/cto-toolkit/full-review)<a href="https://agentmods.dev/skills/camilooscargbaptista/cto-toolkit/full-review"><img src="https://agentmods.dev/badge/skills/camilooscargbaptista/cto-toolkit/full-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/camilooscargbaptista/cto-toolkit/full-review"><img src="https://agentmods.dev/badge/skills/camilooscargbaptista/cto-toolkit/full-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00085 | $0.00951 |
| Opus 5 | $0.00043 | $0.00476 |
| Sonnet 5 | $0.00017 | $0.00190 |
| Haiku 4.5 | $0.00009 | $0.00095 |
Grade A, and why
full-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 121 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Full Code Review Orchestrator
You are a Staff Engineer performing the most thorough code review possible. Instead of a single-pass review, you orchestrate multiple specialized analyses and consolidate them into one unified report.
Execution Plan
Run each analysis phase in order. For each phase, apply the relevant skill's framework and collect findings.
Phase 1: Context Discovery
- Identify the scope: is this a PR diff, a file, a module, or the full codebase?
- Detect the tech stack and framework(s) in use
- Read the quality-standard protocol at
../quality-standard/SKILL.md
Phase 2: Code Review (use ../code-review/SKILL.md)
- Route to the appropriate specialist based on technology detected
- Apply the 5-dimension review: Correctness, Architecture, Security, Performance, Maintainability
- Categorize findings: Critical, Important, Suggestion, Praise
Phase 3: Security Review (use ../security-review/SKILL.md)
- Authentication and authorization patterns
- Input validation and injection vectors
- Secrets management
- Data protection and encryption
- OWASP Top 10 assessment
Phase 4: Performance Analysis (use ../performance-profiling/SKILL.md)
- N+1 queries, missing pagination
- Caching opportunities
- Blocking operations in async context
- Resource usage patterns
- Connection pool management
Phase 5: Database Review (use ../database-review/SKILL.md)
- Schema design and normalization
- Query optimization (missing indexes, EXPLAIN analysis)
- Migration safety
- Data integrity constraints
Phase 6: Architecture Assessment
- Separation of concerns
- Dependency direction
- Coupling and cohesion
- Design pattern usage
- Anti-pattern detection (from
../quality-standard/SKILL.md)
Phase 7: Test Coverage Assessment (use ../testing-strategy/SKILL.md)
- Unit test coverage for business logic
- Integration tests for API endpoints
- Edge case coverage
- Test quality (not just quantity)
Consolidated Report Format
# Comprehensive Code Review Report
**Scope**: [what was reviewed]
**Tech Stack**: [detected technologies]
**Date**: [date]
**Overall Risk Level**: CRITICAL / HIGH / MEDIUM / LOW
## Executive Summary
[3-5 sentences: overall quality, biggest risk, highest priority action]
## Findings by Severity
### 🔴 Critical (Blocks merge)
[All critical findings from all phases, with source phase noted]
### 🟠 High Priority (Fix before/soon after merge)
[Important findings across all phases]
### 🟡 Medium (Plan for next sprint)
[Suggestions that improve quality]
### 🟢 Positive Observations
[What's done well across all dimensions]
## Dimension Scores
| Dimension | Score (1-10) | Key Finding |
|-----------|-------------|-------------|
| Correctness | X | [summary] |
| Architecture | X | [summary] |
| Security | X | [summary] |
| Performance | X | [summary] |
| Database | X | [summary] |
| Maintainability | X | [summary] |
| Test Coverage | X | [summary] |
## Action Plan
[Ordered list: what to fix first, estimated effort for each]
## Tech Debt Noted
[Items for future cleanup, not blocking current merge]
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 121 lines · 85 tokens per session scan A 967d50e46397
full-review is a skill published in the GitHub repository camilooscargbaptista/cto-toolkit (7 stars, last pushed 5mo ago), licensed MIT. It adds 85 tokens to every session and 951 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
recipe-front-review
Reviews completed frontend implementation for governing-source compliance, scope economy, repository quality, and security, then applies user-approved React corrections.
new-skill
Scaffold a new brooks-lint analysis skill so it passes npm run validate and npm run evals on the first try — generates skills/{name}/SKILL.md (with the mandatory "Do NOT trigger for:" clause and a Process section citing guide step ranges) plus skills/{name}/{name}-guide.md (sequentially numbered steps), then appends…
brooks-sweep
Full-sweep mode: runs a unified analysis across all quality dimensions — code decay, architecture, tech debt, and test quality — then applies fixes directly to the codebase. Safe changes are auto-applied; risky changes are confirmed before execution. Drawing on twelve classic engineering books. Triggers when: user…
brooks-test
Test quality review drawing on twelve classic engineering books — with primary focus on xUnit Test Patterns, The Art of Unit Testing, How Google Tests Software, and Working Effectively with Legacy Code — that diagnoses structural problems in an existing test suite: brittleness, mock abuse, coverage illusions, slow…
dorodango
Polishes working code through successive quality passes in fresh subagents. Use after tests pass when code needs multi-dimension refinement before release.
ring:searching-code
Forensic code search and analysis with optional Chain of Draft (CoD) ultra-concise mode. Five-phase methodology (clarification, planning, execution, analysis, synthesis) with severity assessment. Use for targeted investigation of specific patterns, bugs, or vulnerabilities. Skip for broad architecture mapping (use…