Borrowing it
Nothing to install: this file belongs to ly1836/spring-ai-rag-demo. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/ly1836/spring-ai-rag-demo/main/.cursor/skills/review/SKILL.mdgit clone --depth 1 https://github.com/ly1836/spring-ai-rag-demoWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ly1836/spring-ai-rag-demo/review)<a href="https://agentmods.dev/skills/ly1836/spring-ai-rag-demo/review"><img src="https://agentmods.dev/badge/skills/ly1836/spring-ai-rag-demo/review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/ly1836/spring-ai-rag-demo/review"><img src="https://agentmods.dev/badge/skills/ly1836/spring-ai-rag-demo/review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00064 | $0.00663 |
| Opus 5 | $0.00032 | $0.00331 |
| Sonnet 5 | $0.00013 | $0.00133 |
| Haiku 4.5 | $0.00006 | $0.00066 |
Grade A, and why
review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
代码审查
请对提供的代码变更进行全面审查。
审查前准备
- 阅读
openspec/config.yaml获取通用约束。 - 阅读
openspec/context/spring-ai-rag-demo.md获取项目架构、租户隔离、计费扣费、前端规范。 - 本项目是单模块 Spring Boot 应用，不使用其他项目的模块前缀或专属架构检查。
审查重点
1. 功能性缺陷
- 逻辑错误或边界条件缺失
- 业务逻辑与需求不符
- 错误处理不完整
- 后端 API 改动是否同步评估前端影响
2. 安全问题
- 潜在的安全漏洞（注入、越权、信息泄露等）
- API Key 等敏感信息是否写入日志
- SQL 是否参数化（JdbcTemplate
?占位符 / MyBatis#{}占位符） - 多租户查询是否正确通过
TenantContext、BaseTool或 MyBatis-Plus 租户插件隔离 - Controller 是否直接暴露 Entity，是否应转换为 VO
3. 性能与事务
- 缺失的数据库索引或分页限制
- 事务范围是否合理
- 禁止在本地事务内包含第三方 LLM 调用或长耗时操作
- 计费扣费是否保证账户、流水、用量聚合的一致性
4. 代码质量
- 是否使用构造器注入 +
private final - Controller 是否保持薄层，只做参数绑定、调用 Service、返回
RespVO - 是否遵循业务域包结构：
chat/billing/conversation/tool/config/vo/dao - 代码可读性、重复代码、注释是否准确
输出要求
- 使用中文回复
- 先简要说明本次审查覆盖的业务域
- 按 功能性缺陷、安全问题、性能与事务、代码质量 组织发现的问题
- 每个问题请注明：
- 位置：文件及行号（如可获取）
- 问题描述：具体是什么问题
- 风险等级：高/中/低
- 建议修改：具体的修复建议
- 如未发现问题，请明确说明「未发现重大问题」
审查范围
- 如未指定具体代码，请审查最近变更的文件
- 如已选中代码片段，仅审查选中部分
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 63 lines · 64 tokens per session scan A a89ac7e17c4a
review is a skill published in the GitHub repository ly1836/spring-ai-rag-demo (86 stars, last pushed 3d ago), licensed Apache-2.0. It adds 64 tokens to every session and 663 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
clawrouter
Hosted-gateway LLM router — save 84% on inference costs. A local proxy that forwards each request to the blockrun.ai gateway, which routes to the cheapest capable model across 78 models from OpenAI, Anthropic, Google, DeepSeek, xAI, Z.AI, and more. 7 free open-weight models included. Also exposes realtime market data…
advisor-orchestrator-worker
Use when a task is too large for one model pass, needs parallel research or generation across many subtasks (like researching a dozen competitors at once), or the user asks to orchestrate multiple models, split work across a model team, run an advisor-worker loop, have a stronger model review the plan while cheap…
rag-knowledge
Work with the RAG knowledge base — ingest documents, run semantic search, manage collections, or add a sync source/connector (Google Drive, S3). Use when populating or debugging the knowledge base, tuning retrieval, or adding a new document source. This project uses {{ cookiecutter.vectorstore }} + {{…
rag-code-review
When performing code review on a PR, diff, snippet, or "look at this change" request, first consult the corpus for related ADRs, coding standards, prior patterns, and similar files. Grounds review comments in the team's actual decisions instead of generic best practices. Trigger on any review-style request — "review"…
ai-architect-expert
Expert-level AI system design, MLOps, architecture patterns, and AI infrastructure. Use when the user mentions AI architecture, MLOps, system design, AI infrastructure, or scalability, or when the task involves AI System Architecture, MLOps Infrastructure, Scalability Patterns, or Architecture Design.
ai-engineer-expert
Expert-level AI implementation, deployment, LLM integration, and production AI systems. Use when the user mentions AI engineering, LLM, deployment, production AI, or integration, or when the task involves LLM Patterns, LLM Integration, or Production Systems.