Getting it into your agent
This one installs as part of its plugin. Adding the marketplace and installing the plugin brings it with everything else the plugin ships.
/plugin marketplace add corezoid/corezoid-ai-plugin/plugin install corezoidWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/corezoid/corezoid-ai-plugin/corezoid-review)<a href="https://agentmods.dev/skills/corezoid/corezoid-ai-plugin/corezoid-review"><img src="https://agentmods.dev/badge/skills/corezoid/corezoid-ai-plugin/corezoid-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/corezoid/corezoid-ai-plugin/corezoid-review"><img src="https://agentmods.dev/badge/skills/corezoid/corezoid-ai-plugin/corezoid-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00083 | $0.04140 |
| Opus 5 | $0.00042 | $0.02070 |
| Sonnet 5 | $0.00017 | $0.00828 |
| Haiku 4.5 | $0.00008 | $0.00414 |
Grade A, and why
corezoid-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 428 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Review a Corezoid Process
You are a specialist in auditing and analyzing Corezoid BPM processes using the corezoid MCP server.
Identify the Process (MANDATORY FIRST STEP)
Before doing anything else, resolve PROCESS_PATH:
-
Check whether the user already provided a process identifier — a file path, process name, or process ID — in the current message or conversation history.
-
If no identifier is provided, ask:
"Please specify the process — you can provide a file path (e.g.
1278273_Business.folder/2778176_payment.conv.json), a process name, or a process ID."Do not call any MCP tools until the user provides an identifier.
-
If the user gave a name or ID (not a file path), search the local working directory for the matching
.conv.jsonfile using thefindorgrepBash tools (the project is already pulled locally). -
Once
PROCESS_PATHis known, begin the audit below.
Step 1: Structural Lint
Run the linter to detect structural issues automatically:
Call MCP tool lint-process with process_path: "<PROCESS_PATH>".
This checks for:
- Orphaned nodes — unreachable nodes not connected from Start
- No-op conditions — all branches of a condition leading to the same node
- Unused set_param — variables set but never referenced downstream
Record all findings. They will be included in the final report.
Step 2: Load and Parse the Process
Read the .conv.json file and extract nodes:
ops[0]['scheme']is a list — always index[0]node['condition']is a dict with keyslogics(list) andsemaphors(list)node['extra']is a string (escaped JSON) — not a dict- Conditions in
go_if_constlogics live inlg['conditions'], NOT inlg['extra']
Collect node groups for analysis:
code_nodes = [n for n in nodes for lg in n['condition']['logics'] if lg['type'] == 'code']
api_nodes = [n for n in nodes for lg in n['condition']['logics'] if lg['type'] == 'api']
rpc_nodes = [n for n in nodes for lg in n['condition']['logics'] if lg['type'] == 'api_rpc']
copy_nodes = [n for n in nodes for lg in n['condition']['logics'] if lg['type'] == 'api_copy']
cond_nodes = [n for n in nodes for lg in n['condition']['logics'] if lg['type'] == 'go_if_const']
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 428 lines · 83 tokens per session scan A 6bdfeaeed5a4
corezoid-review is a skill published in the GitHub repository corezoid/corezoid-ai-plugin (73 stars, last pushed 5d ago), licensed MIT. It adds 83 tokens to every session and 4,140 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
stop-that-shit
Keep coding agents focused on requested and necessary work. Use when a request sets a read-only, answer-only, file, action, or stopping boundary; when evidence shows scope creep, speculative hardening, unnecessary hashing or dependencies, repeated audit loops, or valueless delegation; or when the user invokes Stop…
stss
Reduce defensive disclaimers, stacked hedging, and self-protective narration in proposals and decision-facing writing. Use when the user asks to rewrite or audit a proposal, plan, research contribution, executive summary, or similar text for directness. Do not use for ordinary code work or unrelated prose.
superloopy-clone
Use when the user asks for Superloopy clone or asks to clone, rebuild, reverse-engineer, replicate, or copy a website or page into a Superloopy-governed implementation. Triggers on "loopy clone", target URLs plus requests such as "clone this site", "rebuild this page", "make a copy of this website", "pixel-perfect…
superloopy-loop
Use Superloopy's lightweight strict-evidence loop for Codex tasks that need durable progress, criteria, and artifact-backed completion.
superloopy-doctor
Use when diagnosing Superloopy doctor, install, wrapper, plugin cache, hook bootstrap, bundled agents, marketplace, Codex, Claude Code, stale-version, evidence-floor, or host-wiring health problems.
inspect-codex-trajectory
Inspect or show a local Codex task trajectory, including turns, approximate model steps, assistant messages, reasoning summaries, tool calls, failures, compaction, token usage, and timing. Use when the user asks for a trajectory, execution trace, task timeline, slow-tool analysis, visual event ledger, or live…