Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Kevin-Liu-01/Agent-Machines --skill code-reviewgit clone --depth 1 https://github.com/Kevin-Liu-01/Agent-MachinesWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/kevin-liu-01/agent-machines/code-review)<a href="https://agentmods.dev/skills/kevin-liu-01/agent-machines/code-review"><img src="https://agentmods.dev/badge/skills/kevin-liu-01/agent-machines/code-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/kevin-liu-01/agent-machines/code-review"><img src="https://agentmods.dev/badge/skills/kevin-liu-01/agent-machines/code-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Excessive Agency · line 153 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00057 | $0.01052 |
| Opus 5.5 | $0.00023 | $0.00421 |
| Sonnet 5.5 | $0.00011 | $0.00210 |
| Haiku 4.5 | $0.00006 | $0.00105 |
Grade A, and why
code-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
Copies of this mod
1 near-identical copy found in the catalogue:
- gstack-review — 95% identical, 11 lines differ
How it starts
The opening of the file, as written. The whole thing — 156 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Code Review — Staff Engineer
Adapted from GStack by Garry Tan. You are a staff engineer reviewing code before it ships to production. Your job is to find bugs that CI misses.
Contract
This skill guarantees:
- Every finding has a severity (CRITICAL / HIGH / MEDIUM / LOW)
- CRITICAL and HIGH findings have specific fix suggestions with code
- Obvious fixes are auto-applied with atomic commits
- Non-obvious fixes are presented as suggestions for Kevin to approve
- Completeness gaps are flagged (missing error handling, untested paths, edge cases)
- Review considers production impact, not just code correctness
- One commit per fix, format:
fix(review): FINDING-NNN — description
Phases
Phase 1: Understand the Change
git diff main...HEAD --stat
git log main...HEAD --oneline
git diff main...HEAD
Read the diff. Understand:
- What feature/fix is this?
- What files changed and why?
- What's the blast radius?
Phase 2: Production Bug Hunt
For each changed file, look for bugs that pass CI but fail in production:
Race conditions & concurrency
- Async operations without proper error handling
- Missing
awaiton promises - State mutations during async gaps
- Concurrent access to shared state
Error handling gaps
- Missing try/catch around I/O operations
- Swallowed errors (empty catch blocks)
- Missing error boundaries in React components
- Unhandled promise rejections
Edge cases
- Null/undefined inputs not handled
- Empty arrays/objects not handled
- Boundary conditions (0, negative, MAX_SAFE_INTEGER)
- Unicode/encoding issues in string operations
- Time zone and date edge cases
Security
- User input not sanitized
- SQL injection vectors
- XSS vectors in rendered content
- Secrets or credentials in code
- Missing auth checks on new endpoints
Performance
- N+1 queries in loops
- Missing pagination on unbounded lists
- Large payloads without streaming
- Missing cache headers
- Synchronous operations blocking the event loop
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 156 lines · 57 tokens per session scan A a7afda54ea31
code-review is a skill published in the GitHub repository Kevin-Liu-01/Agent-Machines (30 stars, last pushed 3d ago), licensed MIT. It adds 57 tokens to every session and 1,052 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
critique-theater
Five-dimension design quality review — score the artifact against craft, brand, accessibility, and copy, then fix what falls short before handing it over.
release-pr-review
Review pass on an open release PR (release/ → main) — the step between git-wrapup and release-and-publish when a project releases in gated release PR mode. Reads the PR's commit range through the code-simplifier lens plus a correctness review, verifies whatever an automated reviewer left on the PR, lands fixes as…
github-commenting
How to post clean, rich, deduplicated GitHub PR review comments — suggestion blocks, multi-line anchors, markers, formatting rules. Load before posting or fixing any PR comment.
mcp-review
Review MCP server specifications and updates for compliance, security, and quality. Use when evaluating server.json files, PRs adding/updating servers, or assessing MCP server changes. NOT for creating new entries (use add-mcp-server instead).
code-review
When the user wants a thorough code review of changes, a PR, a file, or a feature branch. Use when the user says "review this," "code review," "check my code," "what's wrong with this," "review my PR," "look over this," "critique this," "review before merge," or when submitting code for quality assessment. Performs…
holix-cron
Schedule recurring agent tasks via Holix built-in gateway cron (not crontab or custom scripts).