Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add fabioc-aloha/Alex_Skill_Mall --skill code-reviewgit clone --depth 1 https://github.com/fabioc-aloha/Alex_Skill_MallWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/fabioc-aloha/alex_skill_mall/code-review)<a href="https://agentmods.dev/skills/fabioc-aloha/alex_skill_mall/code-review"><img src="https://agentmods.dev/badge/skills/fabioc-aloha/alex_skill_mall/code-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/fabioc-aloha/alex_skill_mall/code-review"><img src="https://agentmods.dev/badge/skills/fabioc-aloha/alex_skill_mall/code-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00019 | $0.02007 |
| Opus 5.5 | $0.00008 | $0.00803 |
| Sonnet 5.5 | $0.00004 | $0.00401 |
| Haiku 4.5 | $0.00002 | $0.00201 |
Grade A, and why
code-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 196 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Code Review Skill
Good reviews catch bugs. Great reviews teach the author something.
Review Priority (What Matters Most)
- Correctness — Does it do what it's supposed to?
- Security — Can it be exploited?
- Maintainability — Will the next person understand this?
- Performance — Will it scale?
- Style — Is it consistent? (ideally enforced by linters, not humans)
3-Pass Review
| Pass | Focus | What You're Looking For | Time |
|---|---|---|---|
| 1. Orientation | Big picture | Does the approach make sense? Is the scope right? Over-engineered? | 2-3 min |
| 2. Logic | Deep read | Edge cases, null handling, error paths, concurrency, off-by-one | 10-15 min |
| 3. Polish | Surface | Naming, duplication, test coverage, docs | 3-5 min |
Pass 1 shortcut: Read the PR description and test names first. They reveal intent faster than code.
Comment Prefixes
| Prefix | Meaning | Author Response |
|---|---|---|
[blocking] |
Must fix before merge | Fix it |
[suggestion] |
Better approach exists | Consider it, explain if declining |
[question] |
I don't understand | Clarify (in code, not just in reply) |
[nit] |
Trivial style issue | Fix if easy, skip if not |
[praise] |
This is well done | Appreciate it |
Good vs Bad Comment Examples
| Bad | Why | Good |
|---|---|---|
| "This is confusing" | Vague, unhelpful | "[suggestion] This nested ternary is hard to follow. Consider extracting to a named function like isEligibleForDiscount()." |
| "Fix this" | No context | "[blocking] This accepts user input without sanitization. Use escapeHtml() before rendering." |
| "Why?" | Sounds hostile | "[question] What's the motivation for the custom sort here vs Array.sort()? Is there a performance concern?" |
| "LGTM" (on 500-line PR) | Rubber stamp | "Pass 1: Approach looks right. Pass 2 comments below. Pass 3: naming is clean." |
Review Checklist
Security
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 196 lines · 19 tokens per session scan A 615ec9874c58
code-review is a skill published in the GitHub repository fabioc-aloha/Alex_Skill_Mall (5 stars, last pushed 9d ago), licensed MIT. It adds 19 tokens to every session and 2,007 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
refactor
Analyze code for SOLID violations and suggest targeted improvements.
cva-analysis
Systematic abstraction discovery using Commonality Variability Analysis. Build matrix of what varies vs what's constant, then let patterns emerge. Prevents wrong abstractions by deferring pattern selection until requirements are analyzed. Use when facing multiple similar requirements and need to discover natural…
memory-enhancement
Manage memory citations, verify code references, and track confidence scores. Use when adding citations to memories, checking memory health, or verifying code references are still valid. Use when you say "add a citation", "verify this memory's code refs", "check memory health". Do NOT use for searching or creating…
panning-for-gold
Triage raw unstructured input (transcripts, brain dumps) into evaluated thread inventories and a synthesized gold-found file. Four phases: front-gate, extract, evaluate, synthesize. Use when you say "pan for gold", "triage transcript", "synthesize gold-found", or hand it a voice transcript or brain dump. Do NOT use…
prompt-engineer
Optimize system prompts for Claude Code agents using proven prompt engineering patterns. Use when users request prompt improvement, optimization, or refinement for agent workflows, tool instructions, or system behaviors. Use when you say "optimize this prompt", "improve this system prompt", or "review my agent prompt".
context-gather
Gather comprehensive context from Serena memory, Context7 docs, DeepWiki, and web sources before planning or implementation. Searches across all knowledge tiers and returns a focused summary ending in a CONTEXTLOADED marker that this skill scans to skip a repeat fetch in the same conversation. Use when you say "gather…