inspect

A guide for reviewing an entire set of code changes together, including how its parts fit, its overall structure, and its security.

In plain words
What is it for?
Performing a broad review after a major feature or before merging, with attention to cross-task consistency, architecture, and security.
Why use it?
It catches problems that may be missed when each task is reviewed separately, such as inconsistent decisions or gaps between components.

Skill for Claude CodeCodex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/devnomad-byte/techneering/inspect
Any agent
npx skills add devnomad-byte/techneering --skill inspect
Clone the repo
git clone --depth 1 https://github.com/devnomad-byte/techneering

Made for: Claude Code, Codex.

Per session 44 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,394 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00044 $0.01394
Opus 5 $0.00022 $0.00697
Sonnet 5 $0.00009 $0.00279
Haiku 4.5 $0.00004 $0.00139

Measured 2d ago against content hash 9cb7015353ab, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

inspect scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/inspect/SKILL.md · 145 lines

How it starts

The opening of the file, as written. The whole thing — 145 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Global Review

Dispatch a code-reviewer subagent to review the whole change as one body of work, not task-by-task. Where tn:assemble reviewed each task in isolation (spec compliance + code quality), inspect catches problems that only surface when you look at the change end-to-end: cross-task consistency, architectural integrity, and security.

Core Principle

REVIEW THE WHOLE, NOT THE PARTS.
Each task passed review alone — but do they fit together?
The reviewer is a safety net, not a rubber stamp.

Why inspect ≠ assemble's per-task review

tn:assemble review tn:inspect
Scope one task the entire change, all tasks together
Questions did this task match its spec? do the tasks fit? is the whole sound?
Catches per-task defects emergent issues: inconsistency, arch drift, security holes

Inspect is not a re-run of assemble's reviews. It looks at what those reviews could not see — the gaps between tasks.

Steps

Phase 1: Request Review

Step 1: Get Git SHAs

Use the merge-base of the change, not HEAD~1 (a change often spans many commits, so HEAD~1 misses everything but the last):

BASE_SHA=$(git merge-base HEAD origin/main)  # whole change from branch point
HEAD_SHA=$(git rev-parse HEAD)
Step 2: Dispatch Code-Reviewer Subagent

Dispatch a reviewer subagent using the template at ./code-reviewer-prompt.md. The template is host-neutral — see its header for how to dispatch on Claude Code (Agent tool) vs Codex (subagent). Fill the placeholders, then send the full prompt block to the reviewer.

Placeholders to fill:

  • WHAT_WAS_IMPLEMENTED — What the whole change built (the proposal's "what")
  • PLAN_OR_REQUIREMENTS — Reference proposal.md + the full tasks.md (all tasks, not one)
  • BASE_SHA — Merge-base of the change
  • HEAD_SHA — Current HEAD
  • DESCRIPTION — Brief summary of the change as a whole
  • CODING_CONVENTIONS — From techneering/config.yaml coding_conventions section (if exists)
  • QUALITY_STANDARDS — From techneering/config.yaml quality_standards section (if exists)

Read the full file on GitHub · 145 lines

Files

What ships with it

1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 145 lines · 44 tokens per session scan A 9cb7015353ab

Subscribe to this mod's changes

inspect is a skill published in the GitHub repository devnomad-byte/techneering (13 stars, last pushed 2mo ago), licensed MIT. It adds 44 tokens to every session and 1,394 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

agenttrace-session-audit

Audit local AI coding-agent sessions with agenttrace for cost, tool failures, latency, anomalies, health, diffs, and CI gates.

Ghosteken/agent-harness · 34 tokens

workflows

Execute a workflow script that orchestrates multiple subagents deterministically. Use when the user explicitly requests a workflow, multi-agent orchestration, parallel or sequential agent pipelines, structured agent outputs, or a durable background workflow run.

get-bb/bb · 47 tokens

establishing-project-context

Use when the user asks to establish shared project language, or project work exposes a conflicting, renamed, or deprecated domain term that needs active semantic modeling. Routine small tasks stay on the fast path.

GanyuanRan/Aegis · 45 tokens

autoprompt

Explicit-only useful-first orchestration. Invoke /autoprompt to turn a mission into one executable roadmap, build dependency-safe lanes, and verify the result with independent reviewers. Never infer invocation from ordinary requests. Never resume from leftover artifacts without an explicit resume instruction.

Spielewoy/autoprompt-skill · 56 tokens

regex-mastery

Use this skill when writing regular expressions, debugging pattern matching,optimizing regex performance, or implementing text validation. Triggers on regex, regular expressions, pattern matching, lookahead, lookbehind, named groups, capture groups, backreferences, and any task requiring text pattern matching.

alibaba/anolisa · 60 tokens

office-hours

YC Office Hours — two modes. Startup mode: six forcing questions that expose demand reality, status quo, desperate specificity, narrowest wedge, observation, and future-fit. Builder mode: design thinking brainstorming for side projects, hackathons, learning, and open source. Saves a design doc. Use when asked to…

GCWing/BitFun · 168 tokens