corezoid-review

corezoid-review is a skill for Claude Code from corezoid/corezoid-ai-plugin. It costs 83 tokens per session (4,140 once invoked), scanned A, original, MIT.

A specialist guide for reviewing Corezoid processes. Corezoid is a visual workflow platform where processes are made from connected steps that automate business operations.

In plain words
What is it for?
Use it to analyze, explain, audit, troubleshoot, or improve an existing Corezoid process.
Why use it?
It provides a structured audit approach for finding unreachable steps, no-op conditions, hardcoded values, and other process problems. It first requires identifying the exact process to review.

Skill for Claude Code

Written for Claude Code: ${CLAUDE_PLUGIN_ROOT} variable.

Runs only inside its plugin — its command needs a path that Claude Code sets for a plugin’s own hooks and for nothing else. Install the plugin, not this.

Part of the corezoid plugin — 26 skills, 1 MCP server shipped together

Good fit Use it to analyze, explain, audit, troubleshoot, or improve an existing Corezoid process.

Compare 6 skills from other repositories ↓
Install

Getting it into your agent

This one installs as part of its plugin. Adding the marketplace and installing the plugin brings it with everything else the plugin ships.

Claude Code
/plugin marketplace add corezoid/corezoid-ai-plugin
Claude Code
/plugin install corezoid

Made for: Claude Code.

Or install corezoid, the plugin that ships this one along with the rest of its 26 skills, 1 MCP server.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for corezoid-review

README.md
[![agentmods](https://agentmods.dev/badge/skills/corezoid/corezoid-ai-plugin/corezoid-review/github.svg)](https://agentmods.dev/skills/corezoid/corezoid-ai-plugin/corezoid-review)
Your own site
<a href="https://agentmods.dev/skills/corezoid/corezoid-ai-plugin/corezoid-review"><img src="https://agentmods.dev/badge/skills/corezoid/corezoid-ai-plugin/corezoid-review/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for corezoid-review

Your own site · 80×15
<a href="https://agentmods.dev/skills/corezoid/corezoid-ai-plugin/corezoid-review"><img src="https://agentmods.dev/badge/skills/corezoid/corezoid-ai-plugin/corezoid-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 83 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 4,140 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00083 $0.04140
Opus 5 $0.00042 $0.02070
Sonnet 5 $0.00017 $0.00828
Haiku 4.5 $0.00008 $0.00414

Measured 10d ago against content hash 6bdfeaeed5a4, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-09, from the pricing page.

Security

Grade A, and why

corezoid-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

plugins/corezoid/skills/corezoid-review/SKILL.md · 428 lines

How it starts

The opening of the file, as written. The whole thing — 428 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Review a Corezoid Process

You are a specialist in auditing and analyzing Corezoid BPM processes using the corezoid MCP server.

Identify the Process (MANDATORY FIRST STEP)

Before doing anything else, resolve PROCESS_PATH:

  1. Check whether the user already provided a process identifier — a file path, process name, or process ID — in the current message or conversation history.

  2. If no identifier is provided, ask:

    "Please specify the process — you can provide a file path (e.g. 1278273_Business.folder/2778176_payment.conv.json), a process name, or a process ID."

    Do not call any MCP tools until the user provides an identifier.

  3. If the user gave a name or ID (not a file path), search the local working directory for the matching .conv.json file using the find or grep Bash tools (the project is already pulled locally).

  4. Once PROCESS_PATH is known, begin the audit below.


Step 1: Structural Lint

Run the linter to detect structural issues automatically:

Call MCP tool lint-process with process_path: "<PROCESS_PATH>".

This checks for:

  • Orphaned nodes — unreachable nodes not connected from Start
  • No-op conditions — all branches of a condition leading to the same node
  • Unused set_param — variables set but never referenced downstream

Record all findings. They will be included in the final report.


Step 2: Load and Parse the Process

Read the .conv.json file and extract nodes:

  • ops[0]['scheme'] is a list — always index [0]
  • node['condition'] is a dict with keys logics (list) and semaphors (list)
  • node['extra'] is a string (escaped JSON) — not a dict
  • Conditions in go_if_const logics live in lg['conditions'], NOT in lg['extra']

Collect node groups for analysis:

code_nodes  = [n for n in nodes for lg in n['condition']['logics'] if lg['type'] == 'code']
api_nodes   = [n for n in nodes for lg in n['condition']['logics'] if lg['type'] == 'api']
rpc_nodes   = [n for n in nodes for lg in n['condition']['logics'] if lg['type'] == 'api_rpc']
copy_nodes  = [n for n in nodes for lg in n['condition']['logics'] if lg['type'] == 'api_copy']
cond_nodes  = [n for n in nodes for lg in n['condition']['logics'] if lg['type'] == 'go_if_const']

Read the full file on GitHub · 428 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 10d ago First seen · 428 lines · 83 tokens per session scan A 6bdfeaeed5a4

Subscribe to this mod's changes

corezoid-review is a skill published in the GitHub repository corezoid/corezoid-ai-plugin (73 stars, last pushed 5d ago), licensed MIT. It adds 83 tokens to every session and 4,140 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

stop-that-shit

Keep coding agents focused on requested and necessary work. Use when a request sets a read-only, answer-only, file, action, or stopping boundary; when evidence shows scope creep, speculative hardening, unnecessary hashing or dependencies, repeated audit loops, or valueless delegation; or when the user invokes Stop…

lennney/stop-that-shit · 86 tokens

stss

Reduce defensive disclaimers, stacked hedging, and self-protective narration in proposals and decision-facing writing. Use when the user asks to rewrite or audit a proposal, plan, research contribution, executive summary, or similar text for directness. Do not use for ordinary code work or unrelated prose.

lennney/stop-that-shit · 63 tokens

superloopy-clone

Use when the user asks for Superloopy clone or asks to clone, rebuild, reverse-engineer, replicate, or copy a website or page into a Superloopy-governed implementation. Triggers on "loopy clone", target URLs plus requests such as "clone this site", "rebuild this page", "make a copy of this website", "pixel-perfect…

beefiker/superloopy · 113 tokens

superloopy-loop

Use Superloopy's lightweight strict-evidence loop for Codex tasks that need durable progress, criteria, and artifact-backed completion.

beefiker/superloopy · 31 tokens

superloopy-doctor

Use when diagnosing Superloopy doctor, install, wrapper, plugin cache, hook bootstrap, bundled agents, marketplace, Codex, Claude Code, stale-version, evidence-floor, or host-wiring health problems.

beefiker/superloopy · 48 tokens

inspect-codex-trajectory

Inspect or show a local Codex task trajectory, including turns, approximate model steps, assistant messages, reasoning summaries, tool calls, failures, compaction, token usage, and timing. Use when the user asks for a trajectory, execution trace, task timeline, slow-tool analysis, visual event ledger, or live…

icesixgod/codex-trajectory · 78 tokens