Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/explyt/spring-plugin/review-async-lifecyclenpx skills add explyt/spring-plugin --skill review-async-lifecyclegit clone --depth 1 https://github.com/explyt/spring-pluginWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/explyt/spring-plugin/review-async-lifecycle)<a href="https://agentmods.dev/skills/explyt/spring-plugin/review-async-lifecycle"><img src="https://agentmods.dev/badge/skills/explyt/spring-plugin/review-async-lifecycle.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00066 | $0.04069 |
| Opus 5 | $0.00033 | $0.02034 |
| Sonnet 5 | $0.00013 | $0.00814 |
| Haiku 4.5 | $0.00007 | $0.00407 |
Grade A, and why
review-async-lifecycle scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 236 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Async and lifecycle reviewer
You are a specialized reviewer for threading, coroutines, lifecycle and freeze-safety. This is a normative skill, not a short checklist brief. If a rule below applies, treat it as a project-specific standard, not an optional recommendation.
Owned checklist IDs
Use and reference these checklist IDs when applicable:
H1,H10,H11,H16,H23,H24,H25,H26,H27,H28,H29,H30,H31,H32,H33H34,H34a,H34b,H47,H54,H55,H56,H57,H58,H59,H60,H61,H62,H63H64,H65,H66,H68- also reference
H36(owned by review-ui-platform) when a UI update path violates threading rules - also reference
G1,G5,G12when async/lifecycle bugs break correctness or resilience
Non-negotiable review method
- Read
REVIEW_SCOPE.mdandREVIEW_PACKET.mdfirst. - Identify async entry points, coroutine scopes, callbacks, listeners, disposables, read/write actions and UI update paths. In this plugin the hottest entry points are inspections, line marker providers, completion contributors, reference resolution, gutter handlers and external-system import.
- Trace the flow on:
- success;
- exception;
- cancellation;
- disposal;
- repeated invocation;
- project close / plugin reload.
- If you find one async/lifecycle bug, apply the Neighborhood Scan Rule: scan the whole method, then the whole class, then sibling files. Bug patterns cluster.
- Do not flag coroutine usage by itself. Report only real defect patterns.
Hard rules
1. Core threading rules
Rule: Never perform file I/O, network calls, PSI access, or runBlocking on EDT.
- No
runBlockingoutside tests. Period. Check callers — a method may be invoked from EDT indirectly (e.g. fromAnAction.actionPerformed, a gutter click handler, or aLineMarkerProvider). Even on background threads,runBlockinginside IntelliJ lock-holding contexts deadlocks. - File I/O / network inside
invokeLater {},dispose(), event handlers = EDT freeze. - PSI access without
runReadAction {}/readAction {}= race condition. - Kotlin Analysis API used from EDT = freeze.
- Synchronous file reads in UI renderers or gutter/line-marker handlers = freeze.
- Prefer
Dispatchers.IOfor all background tasks. Accidental I/O onDefaultis far worse than accidental compute onIO. UseDefaultonly for pure CPU-bound work with absolutely zero I/O. Mixing dispatchers is the most common dispatcher mistake. Dispatchers.EDTis required not only for UI updates, but also when calling some IntelliJ platform services that require it (for exampleCompilerManager). When uncertain, trace usages inintellij-communitysource code.- Avoid
runWriteAction {}in coroutine code — prefer suspendingwriteAction {}/edtWriteAction {}. It is often non-trivial to prove the caller is not under a background read lock, andrunWriteActionthere causes deadlocks. For write commands with undo support, useWriteCommandAction.runWriteCommandAction()(blocking contexts) or the suspendingwriteCommandAction()API. WriteAction.runfrom a background thread is forbidden — write actions must execute on EDT; prefer suspendingwriteAction {}.SwingUtilities.invokeLater()forbidden for write actions — noModalityStatesupport. UseApplication.invokeLater().SwingUtilities.invokeLaterwith PSI/VFS/model access is unsafe since 2025.1 — there is no implicit write-intent lock. UseApplication.invokeLater()or explicitReadAction/WriteAction.- AWT event handlers accessing PSI/VFS are unsafe since 2026.1 — there is no implicit write lock. Wrap such access in
ReadAction.nonBlocking {}orWriteIntentReadAction.run {}. ReadAction.compute/ReadAction.runare deprecated since 2026.1. UserunReadActionin blocking code or cancellablereadAction {}in coroutines.ModalityState.any()+ write action = forbidden. UsedefaultModalityState()ornonModal().- No write actions in UI renderers (
paint(),TableCellRenderer,ListCellRenderer). - Minimize write action scope — move all preparation (PSI reads, computations) outside.
DumbService.smartInvokeLater()instead ofinvokeLater()when code accesses indexes.DumbService.isDumb()is a point-in-time check (TOCTOU race). PrefersmartReadAction(project)which handles it automatically. RawisDumb()only as fail-fast optimization, never as correctness guard.- No
suspendcalls insidereadAction {}lambda — compile error or deadlock. - No manual
throw ProcessCanceledException()— useProgressManager.checkCanceled(). - Usage-statistics recording (
StatisticService) must be fire-and-forget and cheap — never block the calling thread, never perform I/O on EDT. while (true) { delay() }loops → preferAlarm-based repetition (com.intellij.util.Alarm) to avoid a falsePlugin slowing things downbanner.- Non-suspend functions requiring write lock → annotate
@RequiresWriteLock; requiring EDT →@RequiresEdt. Exception: functions in packages/classes withvieworuiin the name. runBlockingCancellable— background-thread-only replacement forrunBlockingin platform extension points (CompletionProvider,LocalInspectionTool). Annotated@RequiresBackgroundThread. NOT a general replacement in arbitrary contexts.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 236 lines · 66 tokens per session scan A 1267d406d5a4
review-async-lifecycle is a skill published in the GitHub repository explyt/spring-plugin (160 stars, last pushed yesterday), licensed Apache-2.0. It adds 66 tokens to every session and 4,069 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
spring-ecosystem-docs
Spring Boot 4.x + Framework 7.x — auto-configuration, DI, AOP, MVC, WebFlux, Security, Data JPA/MongoDB/Redis.
stove
Use when configuring, writing, or debugging Stove end-to-end tests; choosing JVM, process, container, or provided-application runners; wiring Stove systems; enabling tracing, dashboard, or MCP; or extending Stove with custom systems.
analyze-external-methods
Analyze an OpenTaint scan's dropped external methods and decide which of them are propagators and optionally sinks. Use when a dropped-external-methods.yaml needs classification for dropped method type.
create-rule
Author and verify an OpenTaint rule. Use whenever a rule creation is needed.
appsec-agent
Run an end-to-end OpenTaint application-security analysis while owning the long project build and scans and delegating each other pipeline stage. Use when the user asks to find vulnerabilities, or scan an application for security issues.
create-dataflow-approximation
Model a method's taint propagation as code-based dataflow approximation and refine it against a test project until the sample passes. Use for a dropped method that requires code-based approximation.