Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/melodic-software/claude-code-plugins/code-reviewnpx skills add melodic-software/claude-code-plugins --skill code-reviewgit clone --depth 1 https://github.com/melodic-software/claude-code-pluginsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/melodic-software/claude-code-plugins/code-review)<a href="https://agentmods.dev/skills/melodic-software/claude-code-plugins/code-review"><img src="https://agentmods.dev/badge/skills/melodic-software/claude-code-plugins/code-review.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00063 | $0.00893 |
| Opus 5 | $0.00032 | $0.00447 |
| Sonnet 5 | $0.00013 | $0.00179 |
| Haiku 4.5 | $0.00006 | $0.00089 |
Grade A, and why
code-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 81 lines — stays where its author put it; the contents beside it link to each section on GitHub.
CI code review (/review:code-review)
Org-owned review logic for the claude-review reusable workflow
(ci-workflows#258). The lane's workflow wrapper supplies REPO / PR NUMBER /
HEAD SHA and the event-class reporting mechanics (inline-comment MCP on
pull_request, gh pr review/gh pr comment on workflow_dispatch). This
skill owns what to look for; the wrapper owns how to post.
Gotchas
- Command/skill frontmatter
allowed-toolsgrants permission but does not install the inline-comment MCP server. That server only installs when named in the action'sclaude_args(--allowedTools mcp__github_inline_comment__create_inline_comment). Rely on the lane wrapper's grant; do not assume this frontmatter installed it. - Do not invent a 0–100 confidence-score gate. Prefer adversarial validation (producer ≠ verifier) when spawning subagents.
- Scope security findings out of this lane wherever the consumer carries a
claude-security-reviewworkflow file. Leave those to/review:security-review.
Skip gate (cheap)
Before deep review, stop early when any of these hold (say so in the summary and post nothing else):
- PR is closed or not open
- PR is a draft
- Change is trivial/automated with no meaningful review surface
- This head already has a successful review from this lane that still applies
Criteria
This is the CODE-REVIEW lane. Review the pull request for correctness and
alignment with the project's CLAUDE.md guidelines (and REVIEW.md criteria
when present). Focus on architecture decisions, error handling, test coverage,
and maintainability. Where REVIEW.md splits review scope across lanes. It
scopes security review to the dedicated security lane wherever a
claude-security-review workflow exists. Follow that split.
Scope the review to files changed in this PR. Use gh pr diff to identify what
changed, then review those files. Do not explore unrelated parts of the
codebase.
Never restate the PR author's own claimed verification (e.g. a Test plan's described commands or output) as evidence you independently confirmed. Only claim to have verified something you yourself ran with a tool available to you; label anything else as author-claimed and unverified.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today First seen · 81 lines · 63 tokens per session scan A 6eef655d91df
code-review is a skill published in the GitHub repository melodic-software/claude-code-plugins (14 stars, last pushed yesterday), licensed MIT. It adds 63 tokens to every session and 893 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
ci-log-interpretation
Use this skill when reading or analyzing CI logs from a Shopware GitHub Actions workflow to figure out why a build failed — phrases like "why did CI fail", "what broke the build", "check the pipeline", "interpret these logs", "debug this red build" — or whenever raw run logs, job logs, or check annotations from a…
comfy-registry-lifecycle
Comfy Registry release pipeline: release-please + lockfile drift traps, the empty-web/dist publish bug, version status states, phantom versions, icon/banner generation. Use when debugging a pack's publish pipeline.
blueprint-autonomy-level3
Install blueprint autonomy level 3 (ADR-0020): scheduled-autorun + approved-work-order-execution GitHub workflows. Use when enabling out-of-band blueprint automation in a repo.
configure-all
Run all infrastructure standards checks and fixes. Use when onboarding a new project, doing a full compliance audit, or batch-fixing with --fix.
configure-reusable-workflows
Reusable GitHub Actions workflows for security, quality, accessibility. Use when adding OWASP/secret/code-smell scans or WCAG checks to PR pipelines.
configure-workflows
GitHub Actions CI/CD workflows for container builds, tests, releases. Use when updating outdated action versions, adding multi-platform builds, or auditing workflows.