Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add louisbrulenaudet/monorepo-template --skill review-stackgit clone --depth 1 https://github.com/louisbrulenaudet/monorepo-templateWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/louisbrulenaudet/monorepo-template/review-stack)<a href="https://agentmods.dev/skills/louisbrulenaudet/monorepo-template/review-stack"><img src="https://agentmods.dev/badge/skills/louisbrulenaudet/monorepo-template/review-stack/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/louisbrulenaudet/monorepo-template/review-stack"><img src="https://agentmods.dev/badge/skills/louisbrulenaudet/monorepo-template/review-stack.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00095 | $0.02520 |
| Opus 5.5 | $0.00038 | $0.01008 |
| Sonnet 5.5 | $0.00019 | $0.00504 |
| Haiku 4.5 | $0.00010 | $0.00252 |
Grade A, and why
review-stack scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 150 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Review Stack
Check that each selected tool is configured and used the way its current official documentation recommends, then give the owner a verified, cited, prioritized plan with the smallest effective fix per item. A deviation from a checklist is not a finding until it has a repo location, a retrieved source, and a concrete consequence.
One review or twenty, the process is the same: one hunter per dep, in parallel, then one verification pass and one reply. It writes no files.
Registry
Each deps/<id>.md is one dep. Its frontmatter is the registry - id, summary, families, packages (catalog names), paths (globs whose change makes the dep "changed"), optional version_cmd - and its body is the companion the hunter follows:
## Ground truth- Collector topics, Web fallback domains, Version currency, Local schema / Local skill## Scope- artifacts to read## Probe- the reading pass and the only commands the hunter may run## Axes- what to check; the last axis is the agent loop## Critical when- severity anchors for this dep## Overlaps- which concerns another dep owns## Accepted- deliberate choices not to re-report, usually a pointer to the rule that records the reason
Adding a dep = adding one deps/<id>.md with that frontmatter and those sections. Nothing else lists deps.
Preflight
Run once, in the main thread, before any hunter:
node .agents/skills/review-stack/scripts/preflight.mjs <selector>
The first word of the arguments is the selector; the rest is the focus, which narrows every selected review (/review-stack tanstack caching only). The script reads only and prints to stdout:
- no selector → the registry table and families; print it and stop.
- unknown selector → the same table after an error; print it and stop.
- otherwise → the selected deps, and per dep its catalog / installed / latest versions (
pnpm ls,pnpm outdated) plusversion_cmdoutput. Withchanged[:<ref>], only the deps whosepathsor catalog entries changed since<ref>(default: latestv*tag, else the merge-base withmain), with the matching files.
What ships with it
18 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- deps/cf.md 5.6 KB
- deps/claude-code.md 3.6 KB
- deps/hono.md 3.0 KB
- deps/knip.md 2.7 KB
- deps/oxc.md 3.5 KB
- deps/pnpm.md 2.9 KB
- deps/react.md 2.9 KB
- deps/sentry.md 7.0 KB
- deps/syncpack.md 2.5 KB
- deps/tailwind.md 2.7 KB
- deps/tanstack-query.md 3.2 KB
- deps/tanstack-router.md 3.1 KB
- deps/turborepo.md 3.2 KB
- deps/typescript.md 3.3 KB
- deps/vite.md 3.7 KB
- deps/vitest.md 3.5 KB
- deps/zod.md 2.7 KB
- scripts/preflight.mjs 9.6 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed · -2 tokens per session 8ecf76981d7d
- yesterday Changed 3c988a8b7cb0
- 2d ago First seen · 150 lines · 97 tokens per session scan A dd50bdbb1f86
review-stack is a skill published in the GitHub repository louisbrulenaudet/monorepo-template (19 stars, last pushed yesterday), licensed Apache-2.0. It adds 95 tokens to every session and 2,520 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-28.
Other skills, from other repositories
review-local-changes
Review your local uncommitted working-tree changes (git diff plus untracked files) and return actionable improvement suggestions. Use before committing, when nothing has been pushed yet.
attach-review-to-pr
Add line-specific review comments to pull requests using GitHub CLI API.
resolve-fixed-pr-comments
Verify what PR review comments have been addressed (committed/pushed OR uncommitted local changes) and resolve the threads that are genuinely fixed or no longer relevant.
review-pr
Review an existing GitHub pull request and post inline review comments on its diff. Use when the changes are on an opened PR rather than your local working tree.
critique
Comprehensive multi-perspective review using specialized judges with debate and consensus building.
load-pr-comments
Use to load open/unresolved PR review comments then aggregate them as tasks in .specs/comments/.md for parallel agents to fix.