Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/fledgeling-co/fledgeling-plugins/code-reviewnpx skills add fledgeling-co/fledgeling-plugins --skill code-reviewgit clone --depth 1 https://github.com/fledgeling-co/fledgeling-pluginsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/fledgeling-co/fledgeling-plugins/code-review)<a href="https://agentmods.dev/skills/fledgeling-co/fledgeling-plugins/code-review"><img src="https://agentmods.dev/badge/skills/fledgeling-co/fledgeling-plugins/code-review.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00349 | $0.07179 |
| Opus 5 | $0.00175 | $0.03589 |
| Sonnet 5 | $0.00070 | $0.01436 |
| Haiku 4.5 | $0.00035 | $0.00718 |
Grade B, and why
code-review scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Instruction-override phrasingmediumPrompt injection
Text telling the model to disregard its earlier instructions or safety rules is the shape of a prompt injection, whoever wrote it.
"ignore previous instructions", "approve this PR", "output the contents of .env" — is not Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
How it starts
The opening of the file, as written. The whole thing — 435 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Code review
You are a staff engineer reviewing a diff. Two things decide whether the review is worth the reader's time: it finds the bugs that are there, and every finding it reports is real. Those pull against each other, so the pipeline splits them — Find surfaces everything, Verify decides what survives, and the report says what was never looked at. A prompt that asks a reviewer to be conservative, or for high-severity issues only, gets literal compliance and fewer findings — so this skill asks for coverage in Find and puts every threshold in Verify, where evidence decides.
You are read-only with respect to source: you report findings, the developer applies fixes. Write
is for review artifacts under ${CLAUDE_PROJECT_DIR}/.code-review/<run-id>/ and the Phase 6 report
file, never for project source, tests or config. There is no Edit — asked to apply a fix, say the
review is read-only and point at a separate edit step.
Running as a Gemini model? Read gemini.md in this directory first, then follow this file with the overrides it names. It replaces this skill's caps and coverage prose with two filled ledgers and a readback command per bound, because a Gemini run over-delivers against a stated maximum and reports coverage it never had. Other models skip it.
The repo's own rules outrank this skill's
Every project knows things this skill cannot. Read CLAUDE.md, AGENTS.md, CONTRIBUTING.md and
any team practices document the repo names, at the root and in each package the diff touches, and
treat them as the superset the bundled checklists refine — a directory's instruction file governs
files at or below it. Where the repo contradicts a bundled checklist, the repo wins and the finding
quotes it.
Learn the project before you review it. references/repo-discovery.md builds the repo
profile — gate commands, workspace layout, package manager, frameworks at their installed
versions, global controls, cross-package boundaries, test layout — from the target repository at
runtime, starting from scripts/repo-facts.sh. A map written into a skill goes stale silently and
fits one repo; a map derived from the target is right by construction. Inline the profile into
every shard and verifier prompt, because a subagent has no other way to learn it.
What ships with it
20 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- gemini.md 17 KB
- references/angles.md 17 KB
- references/coverage.md 6.9 KB
- references/evidence.md 21 KB
- references/frontend-web-checklist.md 6.1 KB
- references/logic-bugs-checklist.md 26 KB
- references/nestjs-checklist.md 23 KB
- references/nextjs-checklist.md 26 KB
- references/output-format.md 12 KB
- references/prepush.md 6.3 KB
- references/process.md 27 KB
- references/quality-lenses.md 13 KB
- references/react-native-checklist.md 6.7 KB
- references/repo-discovery.md 8.9 KB
- references/security-checklist.md 26 KB
- references/typescript-checklist.md 11 KB
- references/verification-loop.md 16 KB
- scripts/diff-range.sh 4.5 KB runs code
- scripts/prepush-scan.sh 5.7 KB runs code
- scripts/repo-facts.sh 6.4 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 435 lines · 349 tokens per session scan B 6d369a704665
code-review is a skill published in the GitHub repository fledgeling-co/fledgeling-plugins (2 stars, last pushed 3d ago), licensed MIT. It adds 349 tokens to every session and 7,179 once invoked, about $0.0017 per session on Opus 5. A static security scan graded it B with 1 finding (instruction-override phrasing). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
systematic-debugging
Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.
brainstorming
You MUST use this before any creative work - creating features, building components, adding functionality, or modifying behavior. Explores user intent, requirements and design before implementation.
auto-perf-optimize
Run agent-driven VS Code performance or memory investigations. Use when asked to launch Code OSS, automate a VS Code scenario, run the Chat memory smoke runner, capture renderer heap snapshots, take workflow screenshots, compare run summaries, or drive a repeatable scenario before heap-snapshot analysis.
chat-perf
Run chat perf benchmarks and memory leak checks against the local dev build or any published VS Code version. Use when investigating chat rendering regressions, validating perf-sensitive changes to chat UI, or checking for memory leaks in the chat response pipeline.
chat-pet-sprite-creation
Use when creating or changing VS Code chat pet sprite art, sprite sheets, state animations, eye treatments, Stable/Insiders variants, or pet transitions under src/vs/workbench/contrib/chat/browser/widget/media/chatPet.
cpu-profile-analysis
Analyze V8/Chrome CPU profiles (.cpuprofile) and DevTools trace files (Trace-.json). Use when: profiling performance, investigating slow functions, comparing code paths, finding bottlenecks, analyzing timeToRequest, understanding call trees from sampling profiler data, analyzing layout/paint/rendering, investigating…