Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/heapy/kortex/kotlin-reviewnpx skills add Heapy/kortex --skill kotlin-reviewgit clone --depth 1 https://github.com/Heapy/kortexWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/heapy/kortex/kotlin-review)<a href="https://agentmods.dev/skills/heapy/kortex/kotlin-review"><img src="https://agentmods.dev/badge/skills/heapy/kortex/kotlin-review.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00031 | $0.01779 |
| Opus 5 | $0.00015 | $0.00890 |
| Sonnet 5 | $0.00006 | $0.00356 |
| Haiku 4.5 | $0.00003 | $0.00178 |
Grade A, and why
kotlin-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 158 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Kotlin Review
Route a Kotlin quality review to the right agent, over the right scope, and merge the results into one report. The review criteria live in the agents, not here. This skill decides what to run and reports what came back.
Three agents ship with this plugin:
| Agent | Question it answers | Applies to |
|---|---|---|
kotlin-test-review |
If every test passes, do we know the code works? | any project |
kotlin-architecture-review |
Can this codebase absorb the next change without it spreading? | any project |
kotlin-abi-review |
Will code compiled against the last release still link? | published libraries only |
All three are read-only. None of them edits files or runs a build.
Settle the scope first
Do not start until both of these are fixed. Ask only for what the request leaves open.
1. What to review. One of:
| Scope | How to get it |
|---|---|
| working tree | git status --short, git diff HEAD, and the contents of every untracked file named by status |
| a commit | git show --name-status --format=fuller <ref> and git show --find-renames --format= <ref>; read candidate files from <ref>, not from the checkout |
| a pull request | git diff --name-status <base>...<head> and git diff --find-renames <base>...<head>; read candidate files from <head> |
| the whole repository | the module list from the build files |
Default to the working tree when it is dirty, otherwise to the last commit.
The first three scopes are diff review. Rank only findings introduced or materially worsened by
that diff. Read surrounding code for context, but do not turn pre-existing debt into findings. Mention
legacy only in an unranked Pre-existing context note when it is necessary to explain the change or
blocks a trustworthy verdict. The repository scope is the separate full scan mode.
2. Which review. Tests, architecture, ABI, or a combination.
- Honor an explicit choice exactly. A request for tests only, for example, does not authorize adding architecture or ABI.
- Default to tests and architecture when the scope is the repository or a pull request.
- Default to tests alone when the change touches only test sources.
- When the review type was not explicit, add ABI for modules that have a real publication or external
consumer contract. In Kotlin Toolchain this means
product: jvm/liborkmp/libtogether withsettings.publishing.enabled; in Gradle it means a library publication configured throughmaven-publishor a publishing plugin. API dumps,explicitApi(), and ABI-validation configuration support that conclusion but do not prove publication on their own. - Never run the ABI review on an application. There is no ABI to keep.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 158 lines · 31 tokens per session scan A 4066dc9af35e
kotlin-review is a skill published in the GitHub repository Heapy/kortex (6 stars, last pushed today), licensed Apache-2.0. It adds 31 tokens to every session and 1,779 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
skills-manager-cli
Drive the Skills Manager CLI (skm) to initialize the hub, adopt unmanaged skills, list/enable/disable skills per AI tool, and doctor/fix symlink sync. Use whenever the user or an agent needs to manage skills from a terminal, SSH session, CI job, or headless machine; when a skill is missing in Claude Code, Codex…
ppt-design-skill
Design, generate, review, and revise editable PowerPoint presentations through a rigorous brief-to-PNG workflow using the public pptx-designer Python library.
cesiumjs-primitives
CesiumJS primitives and geometry - Primitive, GeometryInstance, Appearance, BufferPrimitive collections, GeoJsonPrimitive, Billboard/Label/PointPrimitive collections, built-in geometry shapes, ground primitives, classification. Use when rendering performance-critical static or vector geometry, loading GeoJSON without…
cesiumjs-3d-tiles
CesiumJS 3D Tiles - Cesium3DTileset, compressed and CAD-style glTF content, MVTDataProvider, styling, metadata, feature picking, voxels, point clouds, I3S, Gaussian splats, clipping. Use when loading 3D Tiles or Mapbox Vector Tiles, rendering KHR meshopt/CAD content, styling or querying features, working with voxels…
cesiumjs-camera
CesiumJS camera control - Camera, flyTo, lookAt, setView, ScreenSpaceCameraController, CameraEventAggregator, flight animation. Use when positioning the camera, creating flyTo animations, constraining user navigation, tracking entities, or converting between screen and world coordinates.
cesiumjs-custom-shader
CustomShader authoring — vertexShaderText and fragmentShaderText against VertexInput, FragmentInput, FeatureIds, Metadata, czmmodelMaterial. Use when reading EXTmeshfeatures or EXTstructuralmetadata property textures/tables, vertex displacement, or shading VoxelPrimitive.