Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add marconae/speq-skill --skill speq-code-reviewgit clone --depth 1 https://github.com/marconae/speq-skillWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/marconae/speq-skill/speq-code-review)<a href="https://agentmods.dev/skills/marconae/speq-skill/speq-code-review"><img src="https://agentmods.dev/badge/skills/marconae/speq-skill/speq-code-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/marconae/speq-skill/speq-code-review"><img src="https://agentmods.dev/badge/skills/marconae/speq-skill/speq-code-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00031 | $0.01615 |
| Opus 5.5 | $0.00012 | $0.00646 |
| Sonnet 5.5 | $0.00006 | $0.00323 |
| Haiku 4.5 | $0.00003 | $0.00161 |
Grade A, and why
speq-code-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 107 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Code Review Taxonomy
Analyze each changed file for the categories below.
1. Guardrail Violations
Per /speq-code-guardrails:
[TOO_MANY_ARGUMENTS]: more than 3 arguments[SIDE_EFFECT]: function has a side effect its name and contract do not announce (a query that mutates, a command that touches unrelated state)[BOOLEAN_FLAG_PARAMETER]: boolean flag parameter[MAGIC_NUMBER]: magic number without a named constant (standing in for a failure, it is[SENTINEL_ERROR_VALUE], not this tag)[MISSING_DOC_COMMENT]: missing doc comment on a public interface[INLINE_COMMENT]: inline comment present (TODOs and other work-tracking comments are[WORK_TRACKING_COMMENT], not this tag)[SELECTOR_ARGUMENT]: an argument (of any type, not just boolean) that picks which branch a function takes[OUTPUT_PARAMETER]: a value returned via a mutated argument instead of the return value[MIXED_ABSTRACTION_LEVEL]: a function mixes high-level orchestration with low-level detail[COMMAND_QUERY_MIX]: a single call both mutates something and hands back an answer[VAGUE_NAME]: a name that states no responsibility (Manager, Processor, Handler, Data, Info, Util)[IMPLEMENTATION_IN_NAME]: a name that bakes in a transport, vendor, or format instead of the abstraction
2. Dead Code
[UNUSED_FUNCTION]: unused function or method[UNREACHABLE_CODE]: unreachable code path[UNUSED_IMPORT]: import not used[UNUSED_VARIABLE]: variable assigned but never read
3. Test Quality
[OBSOLETE_TEST]: tests removed functionality[DUPLICATE_TEST]: duplicate test coverage[ASSERTION_FREE_TEST]: test always passes, no assertions[VAGUE_TEST_NAME]: test name does not state the condition and expected behavior[NONDETERMINISTIC_TEST]: test depends on real clock, network, filesystem, or unseeded randomness[IMPLEMENTATION_COUPLED_TEST]: test asserts internal state instead of observable behavior[UNTESTED_ERROR_PATH]: a failure path with no test[MISSING_BOUNDARY_TEST]: no test for empty, single, maximum, off-by-one, or transition input[SKIPPED_TEST]: test is skipped or ignored rather than fixed or deleted[SUPPRESSED_WARNING]: a lint or compiler warning is silenced instead of resolved
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed · -5 lines · -36 tokens per session a3f067700355
- 11d ago Changed · +15 tokens per session 5e8dcc35adf4
- 18d ago Changed · -4 lines 4adbea85cb81
- 1mo ago Changed 3008096f87ad
- 1mo ago First seen · 116 lines · 52 tokens per session scan A 4a5888a573c1
speq-code-review is a skill published in the GitHub repository marconae/speq-skill (55 stars, last pushed yesterday), licensed MIT. It adds 31 tokens to every session and 1,615 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
code-reviewer
Review completed implementation batches for spec compliance and code quality. Invoke after execution batches complete, before merging, or when a review gate is reached in the workflow.
review
Uses a fresh agent to review an implementation change without editing it. Checks behavior, security, regressions, complexity, tests, docs, and missing proof. Use for code, PR, diff, security, second-opinion, or pre-merge reviews.
security-specialist
Runs security audits on codebases — full scans, diff reviews, threat models, vulnerability triage, remediation guidance, and finding tracking. Activate when the user says "security scan", "audit this repo", "review this PR for security", "threat model", "triage vulnerabilities", "fix this vuln", or "track findings".
agent-plugin-eval
Audit, score, and compare repositories containing portable Agent Plugins against the official Agent Plugins specification. Use when asked to review a plugin repo, check plugin.json or mcp.json conformance, assess bundled skills and MCP servers, produce an evidence-cited 0–100 plugin scorecard, identify release…
architecture-review
Reviews a technical proposal before implementation. Use for system architectures, feature specs, RFCs, ADRs, and issues that define how a system change should work. Finds material ambiguity and flaws in correctness, scalability, performance, security, operations, and proof.
task-to-pr
Delivers specs or decided tasks as tested, independently reviewed pull requests. Runs the CI and review repair loop, then leaves passing pull requests open unless merging was explicitly authorized.