Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/int2t05/engineering-skills/code-reviewnpx skills add int2t05/engineering-skills --skill code-reviewgit clone --depth 1 https://github.com/int2t05/engineering-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/int2t05/engineering-skills/code-review)<a href="https://agentmods.dev/skills/int2t05/engineering-skills/code-review"><img src="https://agentmods.dev/badge/skills/int2t05/engineering-skills/code-review.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00112 | $0.02175 |
| Opus 5 | $0.00056 | $0.01087 |
| Sonnet 5 | $0.00022 | $0.00435 |
| Haiku 4.5 | $0.00011 | $0.00217 |
Grade A, and why
code-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 130 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Code Review
Four review modes, each a different moment and posture. Pick by when the review happens and who's giving vs receiving it.
When to use
- pre-merge (default) — before merging a PR/change: two-axis review, Standards (repo conventions + smell baseline) and Spec (faithful to the originating issue/spec)
- in-flight — during implementation, before a decision stands: adversarial cross-examination biased to disprove, not approve
- evidence-gate — before claiming a task done/fixed/passing: produce fresh verification evidence, not assertion
- receiving — when review feedback arrives: verify the feedback is correct before acting on it; technical rigor over performative agreement
- Triggers on "review this", "code review", "before merge", "代码审查", "合并前审查", "帮我看看这代码", "能合并吗", "are you sure", "verify before done", "收到评审意见"
Not for: deep security review (use security-review); machine-detectable lint/style (use linting); runtime behavior bugs (use debugging).
Steps
1. Pick the mode
- Merging a PR / evaluating a diff → pre-merge (Step 2)
- Mid-implementation, a non-trivial decision is about to stand → in-flight (load references/review-modes.md §in-flight)
- About to claim "done" / "fixed" / "passing" → evidence-gate (load references/review-modes.md §evidence-gate)
- Review feedback just arrived and you're deciding whether to act on it → receiving (load references/review-modes.md §receiving)
2. Pre-merge review (default mode)
2a. Pin the fixed point + gather sources
Capture the diff once: git diff <fixed-point>...HEAD (three-dot, against the merge-base). Confirm
the ref resolves (git rev-parse <fixed-point>) and the diff is non-empty before going further.
Identify, in order:
- Spec source — issue refs in commit messages (
#123,Closes #45), a user-supplied path, or a spec underdocs//specs/. If none found, ask; if there isn't one, the Spec axis reports "no spec available". - Standards sources — anything documenting how code should be written (
CODING_STANDARDS.md,CONTRIBUTING.md, lint configs). On top of repo docs, the Standards axis always carries the smell baseline below.
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 130 lines · 112 tokens per session scan A 1f1da23352d3
code-review is a skill published in the GitHub repository int2t05/engineering-skills (3 stars, last pushed 15d ago), licensed MIT. It adds 112 tokens to every session and 2,175 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
systematic-debugging
Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.
brainstorming
You MUST use this before any creative work - creating features, building components, adding functionality, or modifying behavior. Explores user intent, requirements and design before implementation.
writing-skills
Use when creating new skills, editing existing skills, or verifying skills work before deployment.
finishing-a-development-branch
Use when implementation is complete, all tests pass, and you need to decide how to integrate the work.
test-driven-development
Use when implementing any feature or bugfix, before writing implementation code.
receiving-code-review
Use when receiving code review feedback, before implementing suggestions, especially if feedback seems unclear or technically questionable - requires technical rigor and verification, not performative agreement or blind implementation.