Getting it into your agent
This one installs as part of its plugin. Adding the marketplace and installing the plugin brings it with everything else the plugin ships.
/plugin marketplace add donnfelker/loop-skills/plugin install triangulated-code-reviewWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/donnfelker/loop-skills/triangulated-code-review)<a href="https://agentmods.dev/skills/donnfelker/loop-skills/triangulated-code-review"><img src="https://agentmods.dev/badge/skills/donnfelker/loop-skills/triangulated-code-review.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00163 | $0.07272 |
| Opus 5 | $0.00081 | $0.03636 |
| Sonnet 5 | $0.00033 | $0.01454 |
| Haiku 4.5 | $0.00016 | $0.00727 |
Grade A, and why
triangulated-code-review scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directorieslowAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
- `<SKILL_DIR>` → absolute path of this skill's directory. Resolve this from the orchestrator's runtime: it is the directory containing the SKILL.md you are reading. If unsure, run `find ~/.claude/plugins -path '*triangu Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
How it starts
The opening of the file, as written. The whole thing — 397 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Triangulated Code Review Orchestrator
You are the review lead. Your job is to coordinate up to four specialized reviewers in parallel, triangulate their findings into one prioritized report, and save that report to disk so the user (and future-you) can refer back to it.
Announce at start: "I'm using the triangulated-code-review orchestrator skill — let me confirm which reviewers to run."
Why this skill exists
Single-reviewer passes miss things. This skill borrows from research methodology: triangulating a finding against multiple independent sources reduces blind spots. A comprehensive reviewer catches correctness defects; a security reviewer catches OWASP-style vulns; Codex catches things a single model often doesn't; an adversarial Codex pass questions whether the chosen approach is even right. Running them in parallel and merging gets you broader coverage in roughly the wall-clock time of the slowest reviewer.
But broader coverage means more chances for a confident-but-wrong claim to slip through — particularly around third-party library APIs, where reviewers regularly hallucinate function signatures or deprecation status. A final QA analyst pass substantiates every finding before it's locked into the report: it re-checks the cited file/line, walks the reasoning, and for any claim that touches an external library, verifies actual current usage via the context7 MCP. Findings the QA analyst can't substantiate are demoted into a dedicated section of the report rather than silently dropped — the user still gets to see what was flagged and why it was rejected.
The merged + QA-validated report is saved to a timestamped file so you can re-run later and diff against the previous report to see what changed.
Process flow
1. Sanity-check git state
2. Ask which reviewers to run (AskUserQuestion, multi-select)
3. Spawn one subagent per selected reviewer — in parallel, single message
4. Wait for ALL subagents (no partial synthesis)
5. Merge + prioritize findings (conservative dedupe) into a draft
6. Spawn QA analyst subagent to substantiate every draft finding
(uses context7 MCP for any third-party library claims)
7. Apply QA verdicts — move invalidated findings to their own section
8. Write timestamped report to CWD
9. Tell the user where the file is and present top findings
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 397 lines · 163 tokens per session scan A a77924522e06
triangulated-code-review is a skill published in the GitHub repository donnfelker/loop-skills (18 stars, last pushed 1mo ago), licensed MIT. It adds 163 tokens to every session and 7,272 once invoked, about $0.0008 per session on Opus 5. A static security scan graded it A with 1 finding (reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
autoreview
Pre-commit/ship code review: Codex default; optional Claude or Pi.
rework-rate
Measure and interpret PR rework rate — the emerging 5th DORA metric.
omh-code-review
This is a Hermes-native code-review workflow skill.
revdiff-plan
Review the last Codex assistant message (plan, analysis, or proposal) with inline annotations in a TUI overlay. Extracts the most recent response from Codex rollout files and opens it in revdiff for review and annotation. Activates on "revdiff-plan", "review plan with revdiff", "annotate plan", "review last response"…
code-reviewer
Code review specialist focused on patterns, bugs, security, and performance.
agent-teams-simplify-and-harden
Implementation + audit loop using parallel agent teams with structured simplify, harden, and document passes. Spawns implementation agents to do the work, then audit agents to find complexity, security gaps, and spec deviations, then loops until code compiles cleanly, all tests pass, and auditors find zero issues or…