Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/echovic/blade-code/code-reviewnpx skills add echoVic/blade-code --skill code-reviewgit clone --depth 1 https://github.com/echoVic/blade-codeWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00029 | $0.00771 |
| Opus 5 | $0.00015 | $0.00385 |
| Sonnet 5 | $0.00006 | $0.00154 |
| Haiku 4.5 | $0.00003 | $0.00077 |
Grade A, and why
code-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
前端代码审查
对前端代码进行审查，检查最佳实践、潜在错误和改进建议。
Instructions
- 读取指定的文件或目录
- 检查以下方面：
- 代码风格一致性（ESLint、Prettier 等）
- 潜在的 bug 或错误
- 性能问题
- 安全漏洞
- 可读性和可维护性
- 前端特定问题（如 React hooks 规则、状态管理、组件设计等）
- TypeScript 类型安全
- CSS/样式最佳实践
- 提供具体的改进建议
审查要点
JavaScript/TypeScript
- 检查未使用的变量和导入
- 确保正确使用异步操作（async/await, Promise）
- 检查错误处理是否完善
- 验证 React hooks 使用是否符合规则
- 检查状态管理是否合理
- 确保组件设计遵循单一职责原则
性能
- 检查不必要的组件重渲染
- 验证是否使用了适当的 memoization
- 检查是否有内存泄漏风险
- 确保资源（如事件监听器）被正确清理
安全性
- 检查 XSS 漏洞（如 dangerouslySetInnerHTML 的使用）
- 验证用户输入是否被正确验证和转义
- 检查 API 调用是否安全
可访问性 (Accessibility)
- 检查是否使用了适当的 ARIA 属性
- 验证语义化 HTML 标签的使用
- 确保键盘导航支持
TypeScript
- 检查类型定义是否完整和准确
- 验证是否避免了 any 类型的滥用
- 确保接口和类型定义清晰
Output Format
- 问题严重程度：🔴 严重 | 🟡 警告 | 🔵 建议
- 具体位置和代码片段
- 问题描述
- 改进建议和示例代码
- 相关最佳实践链接（如适用）
Examples
严重问题示例
🔴 严重: 潜在 XSS 漏洞
文件: src/components/UserProfile.tsx:25
问题: 使用了 dangerouslySetInnerHTML 且未对内容进行适当清理
建议: 使用 React 组件替代或对内容进行适当的 HTML 转义
警告问题示例
🟡 警告: 性能问题
文件: src/components/ItemList.tsx:42
问题: 在渲染循环中创建新函数，可能导致不必要的重渲染
建议: 将函数移出渲染函数或使用 useCallback 包装
建议改进示例
🔵 建议: 代码可读性
文件: src/utils/helpers.ts:15
问题: 函数名称不够描述性
建议: 将函数名从 processData 更改为更具体的 transformUserData
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 94 lines · 29 tokens per session scan A 959bc3d6eb21
code-review is a skill published in the GitHub repository echoVic/blade-code (177 stars, last pushed 2d ago), licensed MIT. It adds 29 tokens to every session and 771 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
golang-testing
Production-ready Golang tests — table-driven tests, testify suites and mocks, parallel tests, fuzzing, fixtures, goroutine leak detection with goleak, snapshot testing, code coverage, integration tests, idiomatic test naming. Use when writing or reviewing Go tests, choosing a testing approach, setting up Go test CI…
golang-benchmark
Golang benchmarking, profiling, and performance measurement. Use when writing, running, or comparing Go benchmarks, profiling hot paths with pprof, interpreting CPU/memory/trace profiles, analyzing results with benchstat, setting up CI benchmark regression detection, or investigating production performance with…
golang-continuous-integration
CI/CD pipeline configuration using GitHub Actions for Golang projects — testing, linting, SAST, security scanning, code coverage, Dependabot, Renovate, GoReleaser, code review automation, and release pipelines. Use when setting up or improving Go project CI, configuring GitHub Actions workflows, adding linters or…
golang-dependency-injection
Comprehensive guide for dependency injection (DI) in Golang. Covers why DI matters (testability, loose coupling, separation of concerns, lifecycle management), manual constructor injection, and DI library comparison (google/wire, uber-go/dig, uber-go/fx, samber/do). Use this skill when designing service architecture…
golang-design-patterns
Idiomatic Golang design patterns — functional options, constructors, error flow and cascading, resource management and lifecycle, graceful shutdown, resilience, architecture, dependency injection, data handling, streaming, and more. Apply when explicitly choosing between architectural patterns, implementing functional…
golang-documentation
Comprehensive documentation guide for Golang projects, covering godoc comments, README, CONTRIBUTING, CHANGELOG, Go Playground, Example tests, API docs, and llms.txt. Use when writing or reviewing doc comments, documentation, adding code examples, setting up doc sites, or discussing documentation best practices.…