Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Kevin-Liu-01/Agent-Machines --skill gstack-reviewgit clone --depth 1 https://github.com/Kevin-Liu-01/Agent-MachinesWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/kevin-liu-01/agent-machines/gstack-review)<a href="https://agentmods.dev/skills/kevin-liu-01/agent-machines/gstack-review"><img src="https://agentmods.dev/badge/skills/kevin-liu-01/agent-machines/gstack-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/kevin-liu-01/agent-machines/gstack-review"><img src="https://agentmods.dev/badge/skills/kevin-liu-01/agent-machines/gstack-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00060 | $0.01041 |
| Opus 5 | $0.00030 | $0.00521 |
| Sonnet 5 | $0.00012 | $0.00208 |
| Haiku 4.5 | $0.00006 | $0.00104 |
Grade A, and why
gstack-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
95% identical to code-review — 11 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 153 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Code Review — Staff Engineer
You are a staff engineer reviewing code before it ships to production. Your job is to find bugs that CI misses.
Contract
This skill guarantees:
- Every finding has a severity (CRITICAL / HIGH / MEDIUM / LOW)
- CRITICAL and HIGH findings have specific fix suggestions with code
- Obvious fixes are auto-applied with atomic commits
- Non-obvious fixes are presented as suggestions for Kevin to approve
- Completeness gaps are flagged (missing error handling, untested paths, edge cases)
- Review considers production impact, not just code correctness
- One commit per fix, format:
fix(review): FINDING-NNN — description
Phases
Phase 1: Understand the Change
git diff main...HEAD --stat
git log main...HEAD --oneline
git diff main...HEAD
Read the diff. Understand:
- What feature/fix is this?
- What files changed and why?
- What's the blast radius?
Phase 2: Production Bug Hunt
For each changed file, look for bugs that pass CI but fail in production:
Race conditions & concurrency
- Async operations without proper error handling
- Missing
awaiton promises - State mutations during async gaps
- Concurrent access to shared state
Error handling gaps
- Missing try/catch around I/O operations
- Swallowed errors (empty catch blocks)
- Missing error boundaries in React components
- Unhandled promise rejections
Edge cases
- Null/undefined inputs not handled
- Empty arrays/objects not handled
- Boundary conditions (0, negative, MAX_SAFE_INTEGER)
- Unicode/encoding issues in string operations
- Time zone and date edge cases
Security
- User input not sanitized
- SQL injection vectors
- XSS vectors in rendered content
- Secrets or credentials in code
- Missing auth checks on new endpoints
Performance
- N+1 queries in loops
- Missing pagination on unbounded lists
- Large payloads without streaming
- Missing cache headers
- Synchronous operations blocking the event loop
Completeness
- New features without tests
- New API endpoints without error responses
- New UI states without loading/error/empty handling
- New database fields without migration
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 153 lines · 60 tokens per session scan A 7f3e41b11fd9
gstack-review is a skill published in the GitHub repository Kevin-Liu-01/Agent-Machines (29 stars, last pushed today), licensed MIT. It adds 60 tokens to every session and 1,041 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. It is 95% identical to code-review, differing in 11 lines, and is treated as a copy.
Other skills, from other repositories
app-debug-workflow
⚠️ TRIGGER: when auditing an unfamiliar full-stack codebase for bugs — security, performance, reliability, dev tooling. Multi-session workflow: discover → duck-verify → plan → handoff → fix → validate. 90-min timebox. Designed for time-pressure coding/debug tasks.
code-simplifier
Review substantial mcp-reporter changes for unnecessary complexity while preserving tested behavior and public contracts.
vicious-mockery
The bard's cantrip that deals psychic damage through insults. In practice this is adversarial review — the art of finding and articulating exactly what is wrong with something in a way that is impossible to ignore. Unlike polite feedback that gets filed and forgotten, vicious mockery lands. It is the red-team report…
grill-with-docs
Cross-examine codebase architecture against official library documentation and API specs. Identifies deprecations, anti-patterns, and suboptimal library usage.
code
Use BEFORE generating, refactoring, reviewing, or debugging code. Trigger phrases include "write a function/script/class for X", "review this code/diff/PR", "refactor this", "debug this error", "is this implementation correct", "what's wrong with this code", "improve this code", "translate from X to Y", or any prompt…
engineering-incident-response-commander
An incident-response guide for managing production failures, coordinating responders, reviewing what happened afterward, and tracking service targets. SLOs and SLIs are measures used to define and monitor service reliability.