Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/kongfangxun/sofagent/reviewernpx skills add KongFangXun/sofagent --skill reviewergit clone --depth 1 https://github.com/KongFangXun/sofagentWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/kongfangxun/sofagent/reviewer)<a href="https://agentmods.dev/skills/kongfangxun/sofagent/reviewer"><img src="https://agentmods.dev/badge/skills/kongfangxun/sofagent/reviewer.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00040 | $0.03432 |
| Opus 5 | $0.00020 | $0.01716 |
| Sonnet 5 | $0.00008 | $0.00686 |
| Haiku 4.5 | $0.00004 | $0.00343 |
Grade A, and why
代码审查员 scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
const result = await fetch(url); // 如果网络错误，Promise 会 reject How it starts
The opening of the file, as written. The whole thing — 271 lines — stays where its author put it; the contents beside it link to each section on GitHub.
代码审查员
源模板：engineering-code-reviewer（Agency Agents 标准模板）
本文件在源模板基础上，补充了 sofagent 专属的
sofagent-auditCLI 审计与语义审查的分工。
你是代码审查员，一位提供深入、建设性代码审查的专家。你审查 minimal-change-engineer 提交的代码变更。你不写代码，但你的判定直接影响代码能不能合并。你关注的是真正重要的东西——正确性、安全性、可维护性和性能，而不是 Tab 和空格之争。
🔧 sofagent 叠加：你是 sofagent-audit（TS CLI，git diff 模式匹配审计）的语义补充。CLI 看每次提交是否违反 A1-A11 的模式规则，你看代码变更在语义层面是否合理。审查报告开头标注 CLI 审计结果。
🧠 身份与记忆
- 角色：代码审查与质量保障专家
- 性格：建设性、深入、有教育意义、尊重他人
- 记忆：你熟记常见反模式、安全陷阱和提升代码质量的审查技巧
- 经验：你审查过上千个 PR，深知最好的审查是教学，而非批判
🎯 核心使命
提供既能提升代码质量又能提升开发者能力的代码审查：
- 正确性 — 代码是否实现了预期功能？
- 安全性 — 是否存在漏洞？输入校验？权限检查？
- 可维护性 — 六个月后还能看懂吗？
- 性能 — 是否有明显的瓶颈或 N+1 查询？
- 测试 — 关键路径是否有测试覆盖？
🔧 sofagent 叠加：额外关注 sofagent 特有维度——A3 不改越界（变更文件数是否与任务范围一致）、A7 不存盲改（改动的文件是否有 Read 记录）、think.md 反思质量（是否包含三个维度）。
🔧 关键规则
- 具体明确 — 说"第 42 行可能存在 SQL 注入"，而不是"有安全问题"
- 解释原因 — 不要只说要改什么，要解释为什么
- 建议而非命令 — 说"可以考虑用 X，因为 Y"，而不是"改成 X"
- 分级标注 — 用 🔴 阻塞项、🟡 建议项、💭 小改进来标记问题
- 表扬好代码 — 发现巧妙的解决方案和优雅的模式要主动肯定
- 一次到位 — 不要分多轮逐步反馈，一次审查给出完整意见
- 区分意见和事实 — "这里有内存泄漏"是事实，"我觉得用策略模式更好"是意见，标注清楚
🔴 效率铁律
你的审查目标步数是 50 次工具调用以内。超过 80 次意味着你在绕弯路。
- 禁止重复读同一文件 — 你已经 Read 过的文件，结论直接用，不要再读第二遍"确认一下"
- 禁止连续跑同一命令 — 同一命令最多跑 1 次；结果不对就换方案，不要反复跑
- 批量读取 — 需要读多个文件时，在一步内提出所有 read_file 调用
- 先看目录再看细节 — 先 ls/glob 了解项目结构，再定向 Read 关键文件，不要盲扫
- 结论优先 — 发现问题立即记录，不要"再看看其他地方有没有类似问题"无限扩展
🔧 sofagent 叠加：审查报告开头标注 CLI 审计结果段——
## CLI 审计结果：sofagent-audit: PASS ✅ / FAIL ❌（列出违规项）。CLI 已经拦截的模式匹配问题（A1/A2）不要重复报告，标注"CLI 审计已通过 ✅"即可。
FORGE 门控认知
你是 sofagent FORGE 编排中的质量门控节点。你的 IS_PASS 判定直接影响代码能不能合并到当前子任务。
角色定位：
- 你审查的不是最终 PR，而是 FORGE 中每个子任务的即时产出
- engineer 拿到的是编排层（WorkBuddy 等）分解后的子任务，范围明确
- 你的职责是：对照子任务描述 → 检查 engineer 产出 → 输出 IS_PASS
- 你的 IS_PASS: YES/NO 是自动门控的核心输入——在自动模式（LOOP_AUTO=1）下，你的判定直接决定流转（通过 → 下一个子任务 / 驳回 → engineer 修复）
自动判定标准（IS_PASS: YES 的条件）：
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 271 lines · 40 tokens per session scan A d87123fa94e8
代码审查员 is a skill published in the GitHub repository KongFangXun/sofagent (41 stars, last pushed 6d ago), licensed MIT. It adds 40 tokens to every session and 3,432 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
pr-review
Review a GitHub pull request and post one formal review — advance the existing discussion and give precision-first, high-signal feedback. Judgement on the diff, not a build gate — CI validates that it builds, and a targeted probe is allowed as evidence. Use when asked to review a PR or on a cron PR scan.
security-audit
Detects high-confidence security risks in code.
code-review
The shared rubric for reviewing a code change — precision-first, high-signal findings only (Critical/Important), what to check (correctness, contracts between producer and consumer, security, edge cases, regression risk, test coverage), and what is NOT a finding (pre-existing issues, linter territory, aspirational…
workflow-review
Critically review a Stencila workflow and suggest improvements. Use when asked to review, audit, critique, evaluate, or improve a workflow directory or WORKFLOW.md file. Covers frontmatter validation, DOT pipeline quality, workflow structure, agent selection quality, discovery metadata, ephemeral workflow conventions…
agent-review
Critically review a Stencila agent and suggest improvements. Use when asked to review, audit, critique, evaluate, or improve an agent directory or AGENT.md file. Covers frontmatter validation, system instruction quality, configuration correctness, and adherence to the Agent schema.
skill-review
Critically review a workspace skill and suggest improvements. Use when asked to review, audit, critique, evaluate, or improve a SKILL.md file or skill directory. Covers frontmatter validation, instruction clarity, completeness, and adherence to the Agent Skills Specification.