Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add conorbronsdon/agent-skills --skill code-reviewgit clone --depth 1 https://github.com/conorbronsdon/agent-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/conorbronsdon/agent-skills/code-review)<a href="https://agentmods.dev/skills/conorbronsdon/agent-skills/code-review"><img src="https://agentmods.dev/badge/skills/conorbronsdon/agent-skills/code-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/conorbronsdon/agent-skills/code-review"><img src="https://agentmods.dev/badge/skills/conorbronsdon/agent-skills/code-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00032 | $0.01380 |
| Opus 5.5 | $0.00013 | $0.00552 |
| Sonnet 5.5 | $0.00006 | $0.00276 |
| Haiku 4.5 | $0.00003 | $0.00138 |
Grade A, and why
code-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 113 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Code Review — Multi-Agent PR Review
User-invokable orchestrator for code-PR review across any repo: Copilot for line-level findings, parallel subagents for the architectural and operational misses line-level review can't see. (Validation evidence and origin story: README.)
Fallbacks: no gh or not a GitHub repo → review the local diff (git diff <base>...HEAD) and skip the Copilot lane entirely; no subagent tool → run the review angles sequentially in the main thread. Detect what's available before assuming Copilot access.
Invocation: deliberately model-invocable — "review this PR" phrasing is the trigger. Pushes and issue-creation inside the flow are confirmation-gated.
Step 1: Assess PR Scope
The review target is $ARGUMENTS (a PR number, branch, or URL). If empty, infer it from the conversation or ask.
gh pr view N --json files,additions,deletions,title
Categorize:
| Tier | Examples | Treatment |
|---|---|---|
| Trivial | Typo, copy edit, single-line deps bump, README polish | Skip multi-agent. Copilot alone is enough. |
| Standard | Component refactor, single-feature bug fix, contained logic change | Copilot + 1 subagent (pick the angle that matches the risk shape) |
| High-stakes | Payment, auth, crypto/wallet, RPC, deployment configs, scale-relevant changes, new external SDK integrations | Copilot + 2 parallel subagents minimum (always include adversarial + operational) |
If trivial → stop reading this skill, just request Copilot review and ship.
Step 2: Spawn Subagents in Parallel
Three angles that empirically work. Pick by risk shape:
- Adversarial — "Try to break it. What's the worst attack?" Finds security holes, abuse vectors, replay/race conditions, malformed-input handling.
- Operational — "What fails in production at scale? Latency, cost, observability, timeouts, env config, retries, cold-start?" Finds the architectural P0s line-level review misses (platform execution limits are the canonical class).
- Reference-comparison — "Does this match the upstream reference impl exactly? Where does it diverge and why?" Use for third-party SDK / spec integration (Phantom deep-link, Stripe, OAuth providers, RPC clients).
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 113 lines · 32 tokens per session scan A dd76de23d34c
code-review is a skill published in the GitHub repository conorbronsdon/agent-skills (10 stars, last pushed 21d ago), licensed MIT. It adds 32 tokens to every session and 1,380 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
ai-architect-review
Review the architecture of a system that calls a language model. Use when adding an agent loop, a retrieval path, a tool surface, or an MCP server to a codebase; when a system that worked in a demo is being prepared for production; or when asked to audit, review, or plan AI/agent architecture. Checks the four…
github-code-review
Comprehensive GitHub pull-request code review with multi-agent coordination. Use when reviewing a PR or diff, auditing changes for correctness/security/style before merge, or generating actionable inline review comments.
verification-quality
Truth scoring, code-quality verification, and automatic rollback with a high accuracy threshold. Use when validating agent output before it ships, gating changes on quality, or adding a verify-and-rollback safety loop.
ia-orchestrating-swarms
Coordinate multi-agent swarms for parallel and pipeline workflows. Use when coordinating multiple agents, running parallel reviews, building pipeline workflows, or implementing divide-and-conquer patterns with subagents.
santa-method
Send a finished change to two reviewers who did not write it, using one rubric, and stop after three rounds. Use before a public page, a priced artifact, or a pull request that changes behavior.
security-review
Scan a port or a diff before it lands, and apply the narrow deny list for this machine. Use before copying upstream skills, hooks, or commands into a repo or into the live Claude directory.