Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add coddy-project/coddy-agent --skill crossreviewgit clone --depth 1 https://github.com/coddy-project/coddy-agentWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/coddy-project/coddy-agent/crossreview)<a href="https://agentmods.dev/skills/coddy-project/coddy-agent/crossreview"><img src="https://agentmods.dev/badge/skills/coddy-project/coddy-agent/crossreview/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/coddy-project/coddy-agent/crossreview"><img src="https://agentmods.dev/badge/skills/coddy-project/coddy-agent/crossreview.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00204 | $0.03372 |
| Opus 5.5 | $0.00082 | $0.01349 |
| Sonnet 5.5 | $0.00041 | $0.00674 |
| Haiku 4.5 | $0.00020 | $0.00337 |
Grade A, and why
crossreview scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 13d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 218 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Crossreview: independent reviewers, one orchestrator
One brief is written, every reviewer gets that brief and nothing else, they all answer, and then the orchestrator alone decides: which findings are real, which matter, what to fix now and what not to fix. The reviewers advise; the last word is the orchestrator's: the subagent you hand the run to in step 3, or you. Their value is in the disagreement of different models, so pick reviewers from different vendors.
Three rules hold for the whole run:
- Reviewers are blind to each other. A reviewer never sees another reviewer's answer: not in its brief, not in a later round, not as a summary. Internal reviewers (your own subagents) included.
- Every reviewer gets to answer. Wait until each one has answered or ended (failed, timed out). Retry the ones that failed for a passing reason before you write the report. Stop one early only when the user says so.
- You decide, not the majority. One reviewer with evidence outweighs four without it. Your verdict may differ from every reviewer's.
<skill> below is the directory holding this SKILL.md; agents usually say where it is when they
load a skill (Claude Code's "Base directory", Coddy's "Skill directory"). If yours did not, take
the first of these that holds scripts/crossreview.py, and do not search the whole disk:
${CODDY_HOME:-~/.coddy}/skills/crossreview, then crossreview under ~/.claude/skills,
~/.codex/skills, ~/.cursor/skills, ~/.agents/skills, ~/.config/opencode/skills,
~/.config/devin/skills, and under the workspace's .claude/skills, .agents/skills,
.cursor/skills, .opencode/skills, .coddy/skills.
The helper is python3 <skill>/scripts/crossreview.py (py -3 or python on Windows), standard
library only, the same on Linux, macOS and Windows; every subcommand has --help. Without Python,
see the last section.
Who you are. Every helper command that reads or writes a roster takes --host <you>:
claude (Claude Code), codex, coddy, cursor, opencode, devin, gemini, qwen, kimi,
or your own name. The rosters are yours, kept where you keep your settings: the global one in your
home folder (~/.claude/crossreview.json, ${CODDY_HOME:-~/.coddy}/crossreview.json,
${CODEX_HOME:-~/.codex}/..., ~/.cursor/...), the local one in your folder of the project
(.claude/crossreview.json, .coddy/..., .codex/..., .cursor/...). An agent not on the list
uses ~/.agents and .agents. Claude Code is recognised without the flag.
Requirements. A shell and permission to write files: in a read-only mode (plan, ask) say so and stop. Reviewers call their model APIs and write their own session files, so a sandbox that blocks the network or writes outside the workspace (Codex's default) has to let the helper's commands out, or every reviewer fails.
Never recurse. If CROSSREVIEW_DEPTH is set in your environment, you are a reviewer: answer
the brief directly and do not start another crossreview.
What ships with it
9 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 13d ago Changed · +136 lines · +118 tokens per session c8c0f98723cb
- 15d ago First seen · 82 lines · 86 tokens per session scan A 3552816d74df
crossreview is a skill published in the GitHub repository coddy-project/coddy-agent (175 stars, last pushed today), licensed MIT. It adds 204 tokens to every session and 3,372 once invoked, about $0.0008 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-01.
Other skills, from other repositories
python-repl
Interactive Python REPL automation with common helpers and best practices.
hypotheses
Turns a research direction into testable hypotheses with predictions, competing explanations and the experiments that discriminate between them, including the design (controls, randomization, blocking), sample size or seed count, the pre-specified analysis, and the result that would falsify each hypothesis. Use when a…
crit
Review code changes, a plan, a live page (running dev server), or a local HTML file with Crit inline comments and structured human feedback. Use only when the user explicitly invokes /crit or directly asks to use Crit; a generic review request does not count.
crit-story
Author a crit story and continue the interactive review loop only when the user explicitly invokes crit-story or directly asks you to generate a crit story. Do not infer this skill from generic review, PR, or diff-review requests.
kanban-tasks
A task-board workflow for breaking work into cards and moving them through stages such as inbox, ready, doing, review, and done. It also includes a background service and a web interface for the board.
ocr
OCR image files using the Qwen VL model via the bundled scripts/ocr.py (lives in this skill's directory, NOT your cwd). Use when the user asks to extract text from an image, perform OCR on a photo or screenshot, or recognize characters in an image file (.jpg, .jpeg, .png, .gif, .webp). Requires QWENAPIKEY and…