Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add devcxl/mattpocock-skills-zh --skill code-reviewgit clone --depth 1 https://github.com/devcxl/mattpocock-skills-zhWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/devcxl/mattpocock-skills-zh/code-review)<a href="https://agentmods.dev/skills/devcxl/mattpocock-skills-zh/code-review"><img src="https://agentmods.dev/badge/skills/devcxl/mattpocock-skills-zh/code-review.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00109 | $0.01891 |
| Opus 5 | $0.00055 | $0.00945 |
| Sonnet 5 | $0.00022 | $0.00378 |
| Haiku 4.5 | $0.00011 | $0.00189 |
Grade A, and why
code-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 90 lines — stays where its author put it; the contents beside it link to each section on GitHub.
审查
对 HEAD 与用户指定的固定点之间的 diff 进行双轴审查:
- 规范——代码是否符合本仓库文档化的编码规范?
- 规格——代码是否忠实地实现了原始 issue / PRD / 规格?
两条轴线作为并行子 agent 运行,互不污染彼此的上下文,然后由本技能汇总双方的发现。
Issue 跟踪器应该已经提供给你了。如果 docs/agents/issue-tracker.md 缺失,请告诉用户运行 /setup-matt-pocock-skills。
流程
1. 确定固定点
用户说的任何东西都可以作为固定点——commit SHA、分支名、tag、main、HEAD~5 等等。不要随意发挥,直接传入即可。如果用户没有指定,则询问:"以什么为基准进行审查——一个分支、一个 commit、还是 main?" 没有得到答案之前不要继续。
捕获 diff 命令:git diff <fixed-point>...HEAD(三个点,这样比较的是 merge-base)。同时通过 git log <fixed-point>..HEAD --oneline 记录 commit 列表。
在继续之前,确认固定点能解析(git rev-parse <fixed-point>)且 diff 非空。错误的引用或空的 diff 应该在此处失败——不应该让两个并行子 agent 来处理。
2. 确定规格来源
按以下顺序查找原始规格:
- commit 消息中的 issue 引用(
#123、Closes #45、GitLab!67等)——按照docs/agents/issue-tracker.md中的工作流来获取。 - 用户作为参数传入的路径。
docs/、specs/或.scratch/下与分支名或功能名匹配的 PRD/规格文件。- 如果什么都没找到,询问用户规格在哪里。如果用户说没有,规格子 agent 将跳过并报告"无可用的规格"。
3. 确定规范来源
仓库中任何记载了代码应如何编写的文档,例如 CODING_STANDARDS.md 或 CONTRIBUTING.md。
除了仓库记录的内容外,规范轴线始终携带下面的气味基线(smell baseline)——一组来自 Fowler《重构》第 3 章的固定代码气味,即使仓库没有任何文档也适用。两条约束规则:
- 仓库覆盖规范。 已文档化的仓库标准永远优先;如果仓库明确认可了基线的某些判定,则压制该气味。
- 始终是判断性问题。 每个气味都是带标签的启发式判断("可能的特性依恋"),绝不是一个硬性违反——而且和这里的所有标准一样,跳过工具已强制执行的内容。
每个气味的格式为它是什么 → 如何修复;将其与 diff 匹配:
- 神秘命名(Mysterious Name)——函数、变量或类型的名称不能揭示其作用或含义。→ 重命名;如果找不到一个诚实的名字,说明设计本身模糊不清。
- 重复代码(Duplicated Code)——相同的逻辑形态出现在变更中的多个 hunk 或文件里。→ 提取共享形态,从两处调用。
- 特性依恋(Feature Envy)——方法访问另一个对象的数据比访问自己的更多。→ 将该方法移动到它所依恋的数据上。
- 数据泥团(Data Clumps)——同一组字段或参数反复结伴出现(一个等待诞生的类型)。→ 将它们打包成一个类型,传递这个类型。
- 基本类型偏执(Primitive Obsession)——用基本类型或字符串来表示值得拥有自己类型的概念。→ 给该概念一个自己的小类型。
- 重复 switch(Repeated Switches)——对同一类型反复使用相同的
switch/if级联。→ 用多态替换,或使用两者共享的一个映射。 - 霰弹式修改(Shotgun Surgery)——一个逻辑变更迫使 diff 中散落在许多文件中的修改。→ 将一起变更的内容聚集到一个模块中。
- 发散式变更(Divergent Change)——一个文件或模块因多个无关原因被修改。→ 拆分,使每个模块因单一原因变更。
- 臆测通用性(Speculative Generality)——为规格中不存在的需求添加的抽象、参数或钩子。→ 删除;内联回去,直到真实需求出现。
- 消息链(Message Chains)——调用者不应依赖的冗长
a.b().c().d()导航。→ 将遍历隐藏在第一个对象的一个方法后面。 - 中间人(Middle Man)——一个类或函数大部分时间只是委托给其他人。→ 砍掉它,直接调用真正的目标。
- 拒绝遗产(Refused Bequest)——子类或实现者忽略或覆盖了大部分继承的内容。→ 放弃继承,改用组合。
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 90 lines · 109 tokens per session scan A 96fbc4abc216
code-review is a skill published in the GitHub repository devcxl/mattpocock-skills-zh (318 stars, last pushed 3d ago), licensed MIT. It adds 109 tokens to every session and 1,891 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
chinese-code-review
A Chinese-language code-review communication guide with templates and severity levels for review comments.
receiving-code-review
A guide for handling code-review feedback carefully. Code review is the process of checking proposed changes before they are accepted into a project.
requesting-code-review
A code-review procedure for checking completed work against its requirements before it spreads or is merged. A code reviewer is a person or agent who looks for defects and missing parts.
dsh-pr-review
A checklist and feedback format for reviewing a pull request, which is a proposed set of code changes before they are added to a project.
dsh-code-review
A Chinese-language code-review skill using a six-part checklist: correctness, security, maintainability, error handling, tests, and documentation.
lazarus-mode
Use for expert engineering judgment, "X mode", seasoned/staff/principal standards, robust architecture, security/performance/reliability/scalability scrutiny, optimization review, rigorous implementation/release discipline, or implementation with implement-release-flow. A rigor overlay for design, testing, reviews…