Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add echoVic/blade-code --skill code-reviewgit clone --depth 1 https://github.com/echoVic/blade-codeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/echovic/blade-code/code-review)<a href="https://agentmods.dev/skills/echovic/blade-code/code-review"><img src="https://agentmods.dev/badge/skills/echovic/blade-code/code-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/echovic/blade-code/code-review"><img src="https://agentmods.dev/badge/skills/echovic/blade-code/code-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00029 | $0.00771 |
| Opus 5.5 | $0.00012 | $0.00308 |
| Sonnet 5.5 | $0.00006 | $0.00154 |
| Haiku 4.5 | $0.00003 | $0.00077 |
Grade A, and why
code-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
前端代码审查
对前端代码进行审查，检查最佳实践、潜在错误和改进建议。
Instructions
- 读取指定的文件或目录
- 检查以下方面：
- 代码风格一致性（ESLint、Prettier 等）
- 潜在的 bug 或错误
- 性能问题
- 安全漏洞
- 可读性和可维护性
- 前端特定问题（如 React hooks 规则、状态管理、组件设计等）
- TypeScript 类型安全
- CSS/样式最佳实践
- 提供具体的改进建议
审查要点
JavaScript/TypeScript
- 检查未使用的变量和导入
- 确保正确使用异步操作（async/await, Promise）
- 检查错误处理是否完善
- 验证 React hooks 使用是否符合规则
- 检查状态管理是否合理
- 确保组件设计遵循单一职责原则
性能
- 检查不必要的组件重渲染
- 验证是否使用了适当的 memoization
- 检查是否有内存泄漏风险
- 确保资源（如事件监听器）被正确清理
安全性
- 检查 XSS 漏洞（如 dangerouslySetInnerHTML 的使用）
- 验证用户输入是否被正确验证和转义
- 检查 API 调用是否安全
可访问性 (Accessibility)
- 检查是否使用了适当的 ARIA 属性
- 验证语义化 HTML 标签的使用
- 确保键盘导航支持
TypeScript
- 检查类型定义是否完整和准确
- 验证是否避免了 any 类型的滥用
- 确保接口和类型定义清晰
Output Format
- 问题严重程度：🔴 严重 | 🟡 警告 | 🔵 建议
- 具体位置和代码片段
- 问题描述
- 改进建议和示例代码
- 相关最佳实践链接（如适用）
Examples
严重问题示例
🔴 严重: 潜在 XSS 漏洞
文件: src/components/UserProfile.tsx:25
问题: 使用了 dangerouslySetInnerHTML 且未对内容进行适当清理
建议: 使用 React 组件替代或对内容进行适当的 HTML 转义
警告问题示例
🟡 警告: 性能问题
文件: src/components/ItemList.tsx:42
问题: 在渲染循环中创建新函数，可能导致不必要的重渲染
建议: 将函数移出渲染函数或使用 useCallback 包装
建议改进示例
🔵 建议: 代码可读性
文件: src/utils/helpers.ts:15
问题: 函数名称不够描述性
建议: 将函数名从 processData 更改为更具体的 transformUserData
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 94 lines · 29 tokens per session scan A 959bc3d6eb21
code-review is a skill published in the GitHub repository echoVic/blade-code (180 stars, last pushed 6d ago), licensed MIT. It adds 29 tokens to every session and 771 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
hypotheses
Turns a research direction into testable hypotheses with predictions, competing explanations and the experiments that discriminate between them, including the design (controls, randomization, blocking), sample size or seed count, the pre-specified analysis, and the result that would falsify each hypothesis. Use when a…
install-jazz-github-action
Set up Jazz as a GitHub Action for automated PR code review and on-demand /jazz PR assistance. Use when the user asks to add Jazz to CI, create a GitHub Action workflow, set up PR review automation, enable /jazz commands on PRs, or integrate Jazz with GitHub.
requesting-code-review
Pre-commit review: security scan, quality gates, auto-fix.
github-code-review
Review PRs: diffs, inline comments via gh or REST.
github-pr-workflow
GitHub PR lifecycle: branch, commit, open, CI, merge.
cn-check
Install and run the Continue CLI (cn) to execute AI agent checks on local code changes. Use when asked to "run checks", "lint with AI", "review my changes with cn", or set up Continue CI locally.