Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/eai-org/agent-toolkit/maintainer-reviewnpx skills add eai-org/agent-toolkit --skill maintainer-reviewgit clone --depth 1 https://github.com/eai-org/agent-toolkitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/eai-org/agent-toolkit/maintainer-review)<a href="https://agentmods.dev/skills/eai-org/agent-toolkit/maintainer-review"><img src="https://agentmods.dev/badge/skills/eai-org/agent-toolkit/maintainer-review.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00036 | $0.01851 |
| Opus 5 | $0.00018 | $0.00925 |
| Sonnet 5 | $0.00007 | $0.00370 |
| Haiku 4.5 | $0.00004 | $0.00185 |
Grade A, and why
maintainer-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 144 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Maintainer review
You are the merge gate, not the author's assistant: the question is whether this ships, and the contributor will argue back. Review in this session, not a subagent. A session opened for the PR is fresh already, and staying in it keeps the diff, the comments and your findings in hand for the argument that follows. Session already loaded with unrelated work, say so and offer a fresh one first.
1. Gather
Take a PR reference on any forge and pull, through whatever tooling is connected, all of it before judging: metadata (title, description, author, base and head refs, draft state, labels, mergeability, required-check results), the diff, and every comment stream — conversation comments, review verdicts with their bodies, and inline threads with their replies. A single "view PR" call typically misses the review bodies and the inline threads; expect one request per stream.
Fetch here, never via a review-capture skill: those write the author's triage file and take thread status from the forge, which step 3 re-derives against the current head.
Fetch, then diff the merge base — <base>...<head>, three-dot — so the target's own commits don't
read as the author's. A fork's head has no local ref; fetch the forge's PR ref for it.
Done when the head SHA, the base, the diff, the check results and all comment streams are in hand.
2. Follow every reference
Extract every issue and PR reference, commit sha, external link and domain identifier (a ticket key or product entity id) from the title, the description and every comment, then open each, including its own comments. A linked issue's description is part of the requirement; a linked PR may already have fixed or superseded this one.
Never take a claim as fact, the author's no more than a reviewer's. "This breaks X" and "fixed in the latest push" are hypotheses until the code, the data, the cited source or the current target says otherwise.
Done when every reference has been opened or recorded as unreachable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 144 lines · 36 tokens per session scan A 28de734d272c
maintainer-review is a skill published in the GitHub repository eai-org/agent-toolkit (43 stars, last pushed 2d ago), licensed MIT. It adds 36 tokens to every session and 1,851 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
persona-author
Author or improve an ADD-method persona file (a .add/personas/ slug.md) — the project-fit requirements LENS the ADD engine validates and the design/build/verify/advisor surfaces load. Use when adding a domain expert to the ADD roster, when the add-worker persona mode must DRAFT a persona because none fits the task…
wikispec-wiki
This skills instructs the agent how to maintain the knowledge base in the wiki. Use it when you want to ingest documents or query the wiki.
wikispec-propose
Create specs and designs for a new change. Use this when you need to specify a new change or continue to work on the specification of an existing change.
wikispec-apply
Use the task list for the change to implement the actual change.
wikispec-plan
Create a tasks list to prepare for the implementation of a change. Use this before implementation to understand what needs to be done.
wikispec-validate
Drive the agent through the full validate step for a wikispec change. You will use the wikispec tool which is a binary in the path, no need to install anything.