Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add guyulong/cn-agent-skills --skill code-review-cngit clone --depth 1 https://github.com/guyulong/cn-agent-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/guyulong/cn-agent-skills/code-review-cn)<a href="https://agentmods.dev/skills/guyulong/cn-agent-skills/code-review-cn"><img src="https://agentmods.dev/badge/skills/guyulong/cn-agent-skills/code-review-cn/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/guyulong/cn-agent-skills/code-review-cn"><img src="https://agentmods.dev/badge/skills/guyulong/cn-agent-skills/code-review-cn.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00014 | $0.00561 |
| Opus 5 | $0.00007 | $0.00280 |
| Sonnet 5 | $0.00003 | $0.00112 |
| Haiku 4.5 | $0.00001 | $0.00056 |
Grade A, and why
code-review-cn scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
中文代码审查
使用场景
对代码进行全面审查，生成中文审查报告。
审查维度
1. 功能正确性
- 逻辑是否正确
- 边界条件是否处理
- 异常情况是否覆盖
- 返回值是否一致
2. 代码质量
- 命名是否清晰（变量、函数、类）
- 函数是否过长（建议 < 50行）
- 是否有重复代码
- 圈复杂度是否过高
3. 性能
- 是否有 N+1 查询
- 是否有不必要的循环
- 内存是否有泄漏风险
- 是否有可以缓存的计算
4. 安全
- 输入是否做了校验
- SQL是否使用参数化查询
- 敏感信息是否硬编码
- 权限是否正确检查
5. 可维护性
- 是否有必要的注释
- 是否有单元测试
- 错误处理是否完善
- 日志是否足够排查问题
报告模板
# 代码审查报告
## 概述
- 审查文件：xxx.py
- 审查日期：2026-06-06
- 总体评分：B+（良好）
## 发现的问题
### 🔴 严重问题（必须修复）
1. **SQL注入风险** (第45行)
- 问题：直接拼接SQL字符串
- 建议：使用参数化查询
- 示例：`cursor.execute("SELECT * FROM users WHERE id = %s", (user_id,))`
### 🟡 建议改进
1. **函数过长** (第100-250行)
- 问题：process_data 函数超过150行
- 建议：拆分为多个小函数
### 🟢 优点
1. 错误处理完善
2. 日志记录详细
评分标准
- A+：优秀，可直接合并
- A：良好，小问题可忽略
- B+：良好，建议修改后合并
- B：一般，需要修改
- C：较差，需要重构
- D：严重问题，需要重写
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 80 lines · 14 tokens per session scan A 8bbe39918f33
code-review-cn is a skill published in the GitHub repository guyulong/cn-agent-skills (3 stars, last pushed 3mo ago), licensed MIT. It adds 14 tokens to every session and 561 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
plugin-quality
A review guide for checking Zhin.js plugins before release. It covers plugin structure, feature declarations, resource cleanup, message sending, and security.
metago-refactor-suggest
A code-refactoring guide that finds common code problems, measures technical debt, and suggests ordered changes while aiming to keep the program’s behaviour the same.
metago-adversarial-review
An adversarial review add-on that examines tests, audits, checks, and validation from an attacker's perspective. It models threats, lists entry points, searches for serious flaws, and records evidence and fixes.
metago-code-review-deep
A detailed code-review process that checks correctness, security, performance, maintainability, and style, then labels findings by severity. Its report includes suggested fixes and a merge decision.
metago-output-integrity
A quality-checking guide for detecting invented facts, fake APIs, unsupported data, incomplete references, and unfinished code in technical output.
metago-architecture-reviewer
Architecture Review Specialist - specializes in system architecture analysis, circular dependency detection, coupling and cohesion evaluation.