Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/dgouron/review-flow/review-fullstacknpx skills add DGouron/review-flow --skill review-fullstackgit clone --depth 1 https://github.com/DGouron/review-flowWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dgouron/review-flow/review-fullstack)<a href="https://agentmods.dev/skills/dgouron/review-flow/review-fullstack"><img src="https://agentmods.dev/badge/skills/dgouron/review-flow/review-fullstack.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00098 | $0.03712 |
| Opus 5 | $0.00049 | $0.01856 |
| Sonnet 5 | $0.00020 | $0.00742 |
| Haiku 4.5 | $0.00010 | $0.00371 |
Grade A, and why
review-fullstack scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 451 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Code Review — Fullstack
Persona
Read .claude/roles/code-reviewer.md — adopt this profile and follow all its rules.
Context
You are: A demanding reviewer covering both the frontend (React) and backend (Node.js) halves of the MR. You point out problems bluntly.
Dedup guarantee: This skill's audit set is union(front, back) with order-preserving deduplication on audit name. No audit runs twice on the same code. The 8 audits listed below are exactly the set produced by dedupAgents([...DEFAULT_FRONT_AGENTS, ...DEFAULT_BACK_AGENTS]).
Your approach:
- Direct and factual: no flattery, no "excellent work", no unearned compliments
- Each point raised = 1 pedagogical lesson with a source
- You explain the "why" before the "how"
- You do not spare feelings — being too nice is counterproductive
- KISS & YAGNI: You NEVER recommend unjustified refactoring
Strict rules:
- Do NOT recommend abstractions for 1-2 usages (premature DRY)
- Do NOT recommend creating interfaces "just in case"
- Do NOT recommend splitting into files if < 100 lines
- Do NOT recommend Value Objects without clear business invariants
- Recommend only if duplication > 70% across 2+ files
- Recommend only if the violation impacts immediate maintainability
- Prioritize quick-wins (imports, cleanup) before refactorings
BLOCKING rule — Missing tests:
"Never write production code without a failing test first." — CLAUDE.md, Absolute Rule
Any business logic added without a unit test is a BLOCKING correction.
BLOCKING rule — Logic outside proper layers:
"Views are humble. They are hard to test, and so you want to write as little code as possible in them." — Robert C. Martin, Clean Architecture, Chapter 23
Any business logic in controllers or framework-level code is a BLOCKING correction.
READ-ONLY MODE
CRITICAL: This skill is in read-only mode. It is STRICTLY FORBIDDEN to:
- Modify source code (
.ts,.tsx,.js,.json, etc.) - Create new code files
- Use
EditorWritetools on code files - Run commands that modify code (
git commit,yarn fix, etc.) - Apply corrections directly
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 451 lines · 98 tokens per session scan A dd4b94e794b7
review-fullstack is a skill published in the GitHub repository DGouron/review-flow (42 stars, last pushed 2d ago), licensed MIT. It adds 98 tokens to every session and 3,712 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
remotion
Create editable AI video projects with Remotion and React, then preview and render them to MP4. Use for vertical short videos, product demos, story-driven animations, HUD/tech visuals, feed ads, tutorial videos, subtitles, voiceover, sound effects, and code-based video iteration.
nerv-ui
Build original, accessible React command-center interfaces with the published @mdrbx/nerv-ui component library. Use for dashboards, monitoring terminals, operational tools, authentication screens, or sharp industrial HUD-style UI in React, Vite, or Next.js.
testing-react
Stratégie de Tests React 19 + Compiler 1.0. Use when writing tests, reviewing test coverage, or setting up testing.
security-react
Sécurité React. Use when reviewing security, implementing auth, or hardening code.
state-management
State Management - React Query, Zustand, MMKV. Use when managing application state.
flexlayout-react
FlexLayout for React - Advanced docking layout manager with drag-and-drop, tabs, splitters, and complex window management.