Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/i-stack/ai-coding-kit/auto-code-reviewnpx skills add i-stack/ai-coding-kit --skill auto-code-reviewgit clone --depth 1 https://github.com/i-stack/ai-coding-kitWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00106 | $0.01112 |
| Opus 5 | $0.00053 | $0.00556 |
| Sonnet 5 | $0.00021 | $0.00222 |
| Haiku 4.5 | $0.00011 | $0.00111 |
Grade A, and why
auto-code-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 53 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Auto Code Review
强制入口
命中本 skill 时，必须完整阅读 references/auto_code_review.md 并按其中条款执行。
- 不得以 preamble、Cursor 规则摘要或其它二次摘要代替详规全文。
- 未获得当前请求中的显式授权时，不得探测 reviewer CLI、调用 reviewer 或创建审查归档。
- 运行前置依赖（不随 skill 同步包分发，需宿主环境另行提供）：
env/review.json（模板env/review.json.example）、项目内.auto-review-config.json、以及AUTO_REVIEW_*环境变量。配置加载优先级与字段含义见AGENT-BRIEF.md与docs/auto-code-review.md。
九条核心规则
- [ACR-001] 显式授权门：只有用户明确触发本 skill 才进入审查；代码修改完成本身不是触发条件。配置只能控制能力是否可用，不能代表当前请求已授权。
- [ACR-002] 范围可追溯：优先审查当前请求中可精确追踪的变更；无法证明范围时，先让用户选择 staged 或 worktree，不得把
git diff HEAD冒充为“本轮修改”。 - [ACR-003] reviewer 只读：reviewer 始终只读运行，只输出审查意见，不修改文件。
- [ACR-004] 写权限分层：默认
review-only，主 agent 只仲裁并报告；只有用户明确指定--fix或“审查并修复”时，主 agent 才可修复并再次审查。 - [ACR-005] MAX_ROUNDS=3：
review-only只运行一轮；review-and-fix最多运行 3 轮。未收敛时输出 deadlock，不假装通过。 - [ACR-006] 授权后闭环：显式启动后，执行 review → archive → sync → merge；历史召回已由全局
historical-recall负责，本处不再内联 recall。归档写入.plan-reviews/，且仅属于已授权的审查会话。 - [ACR-007] 可配置 reviewer：允许配置 reviewer、轮次和单模型降级；
AUTO_REVIEW_ENABLED=false是能力级禁用开关，true不构成用户授权。 - [ACR-008] 单模型降级需显式允许：默认不做同模型自审；只有配置明确允许时才降级，并在日志中标注可信度降低。
- [ACR-009] 执行包与 quorum 证明：调用 reviewer 前必须生成同一份 review package；每轮必须记录 selected reviewers、Expected reviewer count、raw 输出路径、合法 verdict 和通过/未通过原因。只有同一轮所有 selected reviewers 都输出合法
VERDICT: APPROVED才能通过；缺失 reviewer、缺失 raw、超时或非法 verdict 一律按未通过处理。review-only模式不得声明 gate 已通过，只能报告 reviewers approved, no code changes made。
模式
/auto-review：只读审查，不修改工作区。/auto-review --fix：审查、由主 agent 修复已采纳问题、再次审查。- 普通实现请求：不触发本 skill。
与相邻 skill 的分工
| Skill | 分工 |
|---|---|
plan-grill |
盘问并锁定 PLAN.md（Act 1） |
cross-model-review |
显式审查 PLAN.md（Act 2） |
| auto-code-review | 用户显式启动的代码实现审查（Act 3） |
engineering-discipline |
约束主 agent 的工程改动 |
epistemic-integrity |
约束审查结论的证据与置信度 |
工作流
实施完成 → 用户显式触发 → 选择范围/模式 → 生成唯一 review package 并冻结 selected reviewers → reviewer 只读审查
├─ review-only：报告并归档（不声明 gate 通过）
└─ review-and-fix：修复 → 再审查 → 归档
What ships with it
7 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 53 lines · 106 tokens per session scan A abb4a1f1b5de
auto-code-review is a skill published in the GitHub repository i-stack/ai-coding-kit (3 stars, last pushed yesterday), licensed MIT. It adds 106 tokens to every session and 1,112 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
extension-creator
Create AiderDesk extensions by setting up extension files, defining metadata, implementing Extension interface methods, and updating documentation. Use when building a new extension, creating extension commands, tools, or event handlers.
theme-factory
Create new AiderDesk UI themes by defining SCSS color variables, registering theme types, and adding i18n display names. Use when adding a theme, creating a color scheme, customizing appearance, or implementing dark mode and light mode variants.
agent-creator
Create and configure AiderDesk agent profiles by defining tool groups, approval rules, system prompts, subagent settings, subagent filtering, and provider/model selection. Use when setting up a new agent, creating a profile, or configuring agent tools, permissions, and subagent behavior.
writing-tests
Write unit tests, component tests, and integration tests for AiderDesk using Vitest and React Testing Library. Use when creating new tests, adding test coverage, configuring mocks, setting up test files, or debugging failing tests.
ppt-design-skill
Design, generate, review, and revise editable PowerPoint presentations through a rigorous brief-to-PNG workflow using the public pptx-designer Python library.
githits-onboarding
Set up GitHits from an agent session: detect supported coding tools, install GitHits MCP configuration, start account sign-in/signup, verify auth, and recover from setup issues. Use when the user asks to install, connect, set up, sign up for, or start using GitHits.