Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/everywan-dev/claude-code-engineering/review-code-you-did-not-writenpx skills add everywan-dev/claude-code-engineering --skill review-code-you-did-not-writegit clone --depth 1 https://github.com/everywan-dev/claude-code-engineeringWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00052 | $0.01255 |
| Opus 5 | $0.00026 | $0.00628 |
| Sonnet 5 | $0.00010 | $0.00251 |
| Haiku 4.5 | $0.00005 | $0.00126 |
Grade A, and why
review-code-you-did-not-write scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 105 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Review code you did not write
Reviewing your own code is hard because you know what you meant. Reviewing code you did not write is hard for the opposite reason: you have no intent to compare against, so the only thing left to judge is whether it looks right.
Looking right is what generated code is best at. It has the shape of correct code, the naming of correct code and the confidence of correct code. That is not a criticism of the generator; it is the job description.
🔴 You are not reviewing whether the code is plausible. You are reviewing whether you could have caught it being wrong. If nothing in your review could have produced a rejection, you did not review it — you accompanied it.
When to use this
- An agent produced a diff and you are about to merge it
- A dependency, snippet or template arrived from outside and is now yours
- You are approving a pull request in an area you do not own
- Something works and you cannot explain why it works
- You are about to write "LGTM" on more lines than you have read
The procedure
1. Read the diff, not the summary. The summary is written by the same party that wrote the code and shares its blind spots. If the summary and the diff disagree, the diff is the truth — and the disagreement is itself the finding.
2. For each change, ask what it would look like if it were wrong. Not "is this right?" — that question has an easy yes. Ask what a broken version of this would look like, then check whether you would be able to tell the difference. Where you cannot tell, you have found the part that needs a real check.
3. Run the thing the change claims to fix, in the state a user would. Not the test suite: the actual claim. A change that "fixes the install" is verified by installing, from a clean state, using the documented command, and nothing else counts.
4. Hunt for the confident no-op. The most dangerous generated change is the one that runs cleanly and does nothing:
| Shape | How it reads | What it does |
|---|---|---|
| A guard that never triggers | Defensive | Dead code that hides the real path |
| A check comparing a value to itself | Thorough | Passes by construction |
| An exception handler that swallows | Robust | Turns a failure into silence |
| A config written where nothing reads it | Configurable | No effect at all |
| A test asserting on data it just built | Well tested | Cannot disagree with the code |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 105 lines · 52 tokens per session scan A 781948d42b5a
review-code-you-did-not-write is a skill published in the GitHub repository everywan-dev/claude-code-engineering (2 stars, last pushed 13d ago), licensed Apache-2.0. It adds 52 tokens to every session and 1,255 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
claude-project-manifest
Creates annotated bibliography-style manifests for Claude projects, tracking files, conversation threads, and relationships with unique IDs and annotations. Use when documenting project contents, creating file inventories, tracking conversation history, or building navigable knowledge maps.
proofpress
Preserve or inspect decision history for Markdown and static HTML knowledge artifacts with Proofpress. Use when creating or accepting a meaningful revision to an ADR, design doc, PRD, README, strategy note, portable .md artifact, or static .html/.htm artifact in a configured repository, or when receiving a file…
llm-wiki
Maintain a personal team knowledge base using the LLM Wiki pattern — incremental ingest, query, and lint operations on a layered wiki architecture.
PBE Extractor
Extract invariant principles from any text — find the ideas that survive rephrasing.
Principle Synthesizer
Synthesize invariant principles from 3+ sources — find the core that survives across all expressions.
golden-rss
Use when testing the rss golden build.