Borrowing it
Nothing to install: this file belongs to jmrplens/gitlab-mcp-server. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/jmrplens/gitlab-mcp-server/main/.github/skills/review-and-refactor/SKILL.mdgit clone --depth 1 https://github.com/jmrplens/gitlab-mcp-serverWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/jmrplens/gitlab-mcp-server/review-and-refactor)<a href="https://agentmods.dev/skills/jmrplens/gitlab-mcp-server/review-and-refactor"><img src="https://agentmods.dev/badge/skills/jmrplens/gitlab-mcp-server/review-and-refactor.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00050 | $0.00391 |
| Opus 5 | $0.00025 | $0.00196 |
| Sonnet 5 | $0.00010 | $0.00078 |
| Haiku 4.5 | $0.00005 | $0.00039 |
Grade A, and why
review-and-refactor scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Review and Refactor
Role
You are a senior expert software engineer with extensive experience in maintaining projects over a long time and ensuring clean code, security, and best practices.
Process
Follow this structured three-phase approach:
Phase 1: Context Gathering
- Read all coding guidelines in
.github/instructions/*.mdand.github/copilot-instructions.md - Identify the scope of files to review (user-specified or full project)
- Understand the project architecture and conventions
Phase 2: Review
Review code systematically, checking for:
Code Quality
- Naming conventions and readability
- Single Responsibility Principle compliance
- DRY violations and code duplication
- Error handling completeness and actionable messages
- Context cancellation respect (for Go/MCP)
MCP-Specific (if applicable)
- Tool naming follows snake_case with service prefix
- Tool annotations set (readOnlyHint, destructiveHint, idempotentHint, openWorldHint)
- Pagination metadata present for list operations
- Response format support (JSON + Markdown)
Security
- No hardcoded secrets or credentials
- Input validation on all user inputs
- Proper error messages (no internal details exposed)
Testing
- Test coverage for critical paths
- Descriptive test names
- Table-driven tests where appropriate
Phase 3: Refactor
- Prioritize issues: Critical (security, correctness) → Important (quality, tests) → Suggestions (readability)
- Apply refactorings while keeping existing file structure intact
- Verify tests still pass after changes
- Summarize all changes made with rationale
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 59 lines · 50 tokens per session scan A bf75e8f6ff9e
review-and-refactor is a skill published in the GitHub repository jmrplens/gitlab-mcp-server (33 stars, last pushed today), licensed MIT. It adds 50 tokens to every session and 391 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
crit-cli
Use when an agent needs to author or reply to crit inline comments programmatically (including multi-agent workflows commenting on shared code/plans/docs/proposals), publish or unpublish a crit review with crit share, sync a crit review to or from a GitHub PR or GitLab MR, or read/interpret a crit review JSON file.…
crit
Review code changes, a plan, a live page (running dev server), or a local HTML file with Crit inline comments and structured human feedback. Use only when the user explicitly invokes /crit or directly asks to use Crit; a generic review request does not count.
crit-story
Author a crit story only when the user explicitly invokes crit-story or directly asks you to generate a crit story. Do not infer this skill from generic review, PR, or diff-review requests.
code-review
This skill should be used when the user asks for a code review of a change — a pull request, merge request, branch, commit range, working-tree change, or pasted diff — covering correctness, security, performance, structure, and repository-specific rules. Trigger on phrases like "review this PR", "review this MR"…
security-audit
This skill should be used when the user asks to review code for security vulnerabilities, audit a pull request or merge request for risks, check if code is safe, find injection flaws or hardcoded secrets, or assess the security posture of a feature or codebase area. Use this skill even when the user doesn't say…
go-code-review
Use when reviewing Go code or checking code against community style standards. Also use proactively before submitting a Go PR or when reviewing any Go code changes, even if the user doesn't explicitly request a style review. Does not cover language-specific syntax — delegates to specialized skills.