Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add LeeYudok/agents-scaffold --skill reviewgit clone --depth 1 https://github.com/LeeYudok/agents-scaffoldWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/leeyudok/agents-scaffold/review)<a href="https://agentmods.dev/skills/leeyudok/agents-scaffold/review"><img src="https://agentmods.dev/badge/skills/leeyudok/agents-scaffold/review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/leeyudok/agents-scaffold/review"><img src="https://agentmods.dev/badge/skills/leeyudok/agents-scaffold/review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00045 | $0.00563 |
| Opus 5.5 | $0.00018 | $0.00225 |
| Sonnet 5.5 | $0.00009 | $0.00113 |
| Haiku 4.5 | $0.00005 | $0.00056 |
Grade A, and why
review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 29d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
코드 리뷰 (래퍼)
code-reviewer + security-audit 에이전트를 순차로 실행해 완전한 리뷰를 수행한다.
실행 순서
Step 1 — 변경 범위 파악
base=$(for r in origin/HEAD origin/main origin/master main master; do git merge-base HEAD "$r" 2>/dev/null && break; done) # 기본 브랜치 분기점
[ -n "$base" ] || base=$(git rev-parse --verify -q HEAD~1) # 그래도 비면 범위를 사용자에게 묻고 중단
git diff --stat "$base" # 커밋 + 미커밋 변경 전부
git diff --name-only "$base"
변경이 없으면 종료.
Step 2 — 코드 리뷰 (code-reviewer 에이전트)
Agent(subagent_type: "code-reviewer") 호출:
- 보안: 하드코딩 키/토큰, 입력 검증 누락
- 성능: N+1 쿼리, 불필요한 동기 I/O
- 품질: any 타입, 50줄 초과 함수, 중복, 죽은 코드
- 컨벤션:
.claude/rules/규약 위반
Step 3 — 보안 감사 (security-audit 에이전트)
Agent(subagent_type: "security-audit") 호출:
- P0 보안 12개 항목 grep 스캔
- 취약한 암호화, SQL Injection, CORS 와일드카드
Step 4 — 종합 보고
## 코드 리뷰 종합 — {{PROJECT_NAME}}
### 코드 리뷰
CRITICAL N건 / WARNING M건 / SUGGESTION K건
### 보안 감사
P0 위반 N건 / P1 위반 M건
### 머지 권고
✅ 머지 가능 / ❌ CRITICAL 또는 P0 위반으로 머지 보류
CRITICAL 또는 P0 위반이 하나라도 있으면 머지 보류 권고.
빠른 리뷰 (인자 있으면)
/review quick — security-audit 생략, code-reviewer만 실행.
Learned warnings
(실행 중 발견한 주의사항이 여기에 누적됩니다)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 29d ago Changed · +2 lines 49596bd537fb
- 1mo ago First seen · 59 lines · 45 tokens per session scan A 80996ed975fe
review is a skill published in the GitHub repository LeeYudok/agents-scaffold (36 stars, last pushed today), licensed MIT. It adds 45 tokens to every session and 563 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
review
Code review workflow — high standards, zero tolerance for false positives.
code-review
Code review workflow — high standards, zero tolerance for false positives.
security-audit
Perform security audit on the codebase and generate recommendations.
review-pr
Review a GitHub PR with security, performance, and quality checks.
memstack-development-code-reviewer
Use this skill when the user says 'review code', 'code review', 'check my code', 'audit this', 'review PR', 'review changes', 'what's wrong with this', or is requesting a structured review of code quality, security, performance, or maintainability. Do NOT use for refactoring plans or test generation.
pr-review
Focused pull request review practices with severity-ranked, file-and-line-cited findings across four angles: security, performance, tests, and architecture. Use when asked to review a pull request, review a diff or set of changes, review "this PR," or provide a code review before merge.