Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add MageByte-Zero/spec-superflow --skill code-reviewergit clone --depth 1 https://github.com/MageByte-Zero/spec-superflowWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/magebyte-zero/spec-superflow/code-reviewer)<a href="https://agentmods.dev/skills/magebyte-zero/spec-superflow/code-reviewer"><img src="https://agentmods.dev/badge/skills/magebyte-zero/spec-superflow/code-reviewer/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/magebyte-zero/spec-superflow/code-reviewer"><img src="https://agentmods.dev/badge/skills/magebyte-zero/spec-superflow/code-reviewer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00035 | $0.01272 |
| Opus 5.5 | $0.00014 | $0.00509 |
| Sonnet 5.5 | $0.00007 | $0.00254 |
| Haiku 4.5 | $0.00003 | $0.00127 |
Grade A, and why
code-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 21d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 92 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Code Reviewer
Bundled runtime
Before executing a CLI line below, replace its leading SSF with node "<plugin-root>/scripts/spec-superflow.mjs"; <plugin-root> is the absolute directory two levels above this file. Never run SSF literally or call an ssf from PATH.
Two responsibilities: reviewing the recorded Git range and acting on findings with technical rigor. Review according to the persisted policy; verify feedback before implementing it.
Part 1: Requesting Review
Mandatory: one whole-range review for Native final; one review per planned wave for wave and legacy plans. Avoid redundant per-task or final reviews of unchanged evidence.
Optional: when stuck, before refactoring, after fixing complex bugs.
Procedure
- Get the review range from recorded execution evidence. For final review resolve the base in order: the recorded
state.review_basestart anchor, then thereview_basein the recorded isolation context, thengit merge-base <target-branch> HEADfor a legacy/manual branch with an unambiguous target; head isgit rev-parse HEAD. The CLI verifies this complete range. A failed final review retains the same base across fixes; wave repairs use the prior wave head. For a wave review use the recorded wave-start base. Never substituteHEAD~1; it misses earlier commits in multi-commit work. - For Native
final, the current executor reviews the complete diff locally and writes the report; do not dispatch a reviewer subagent. For user-authorized SDD withwavereview, dispatch at most one reviewer for that wave usingskills/code-reviewer/code-reviewer-prompt.md. If dispatch is unavailable, review locally. - When dispatching, fill only
[DESCRIPTION],[PLAN_OR_REQUIREMENTS],[BASE_SHA],[HEAD_SHA],[WAVE_ID], and[REVIEW_REPORT_FILE]. Do not send the whole planning bundle. - Write a non-empty report at
.superpowers/sdd/reviews/<wave-id>.md, then record that path withSSF execution review <change-dir> --wave <wave-id> --base <base-sha> --head <head-sha> --report .superpowers/sdd/reviews/<wave-id>.md --verdict <pass|fail>. For schema-2 plans, failed receipts also require--issue <stable-finding-id>for the blocking defect being repaired; reuse its ID across retries. Other findings keep their own IDs in the report. Identical failed input cannot consume another attempt.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 21d ago Changed 5056c96e2e28
- 23d ago Changed · +4 lines 58b1320793d5
- 25d ago Changed · -31 lines d76a9029e259
- 1mo ago Changed · +1 lines 89099758b287
- 1mo ago First seen · 118 lines · 35 tokens per session scan A ab93a12cb26c
code-reviewer is a skill published in the GitHub repository MageByte-Zero/spec-superflow (864 stars, last pushed 15d ago), licensed MIT. It adds 35 tokens to every session and 1,272 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
chinese-code-review
A Chinese-language code-review communication guide with templates and severity levels for review comments.
receiving-code-review
A guide for handling code-review feedback carefully. Code review is the process of checking proposed changes before they are accepted into a project.
requesting-code-review
A code-review procedure for checking completed work against its requirements before it spreads or is merged. A code reviewer is a person or agent who looks for defects and missing parts.
review
Uses a fresh agent to review an implementation change without editing it. Checks behavior, security, regressions, complexity, tests, docs, and missing proof. Use for code, PR, diff, security, second-opinion, or pre-merge reviews.
architecture-review
Reviews a technical proposal before implementation. Use for system architectures, feature specs, RFCs, ADRs, and issues that define how a system change should work. Finds material ambiguity and flaws in correctness, scalability, performance, security, operations, and proof.
task-to-pr
Delivers specs or decided tasks as tested, independently reviewed pull requests. Runs the CI and review repair loop, then leaves passing pull requests open unless merging was explicitly authorized.