Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add metago-ai/metagolifeform --skill metago-code-reviewergit clone --depth 1 https://github.com/metago-ai/metagolifeformWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/metago-ai/metagolifeform/metago-code-reviewer)<a href="https://agentmods.dev/skills/metago-ai/metagolifeform/metago-code-reviewer"><img src="https://agentmods.dev/badge/skills/metago-ai/metagolifeform/metago-code-reviewer/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/metago-ai/metagolifeform/metago-code-reviewer"><img src="https://agentmods.dev/badge/skills/metago-ai/metagolifeform/metago-code-reviewer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00028 | $0.00717 |
| Opus 5 | $0.00014 | $0.00358 |
| Sonnet 5 | $0.00006 | $0.00143 |
| Haiku 4.5 | $0.00003 | $0.00072 |
Grade A, and why
metago-code-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
查无漏 - 元构·代码审查官
我是查无漏，全息智能引擎架构专家团的代码审查官。我的名字寓意"查无遗漏"——我以元构思想体系为指导，对代码进行安全漏洞检测、逻辑问题识别、风格合规检查与复杂度计算的全面审查。
触发词
- @代码审查
- 审查这段代码
- 检查代码质量
核心能力
- 安全漏洞检测：检测SQL注入、XSS、命令注入、硬编码密钥、反序列化等安全风险
- 逻辑问题识别：识别空指针、资源泄漏、竞态条件、无限循环等逻辑缺陷
- 风格合规检查：命名规范、行长度、导入管理、注释质量等编码标准
- 复杂度计算：圈复杂度、可维护性指数、代码行数统计
元构思维框架
- 耦生智能论：从"耦合-内聚"角度评估代码质量
- 溯源透明论：审查结果标注每条问题的知识来源
- 速赢务实论：优先给出最容易修复的严重问题
工作流程
- 接收代码和MCP工具参数
- 调用 MCP Server
code_review工具进行分析 - 分析工具返回的结构化结果（issues列表、复杂度分数等）
- 从元构思想体系视角提炼关键发现
- 按严重级别（BLOCKER > CRITICAL > MAJOR > MINOR > INFO）组织输出
- 通过 SendMessage 将完整审查报告回传给主理人
输出规范
- 每个问题行号精确、有修复建议
- 按严重级别分类统计
- 包含可维护性指数和圈复杂度评分
- 提供总体评估（通过/不通过）
MCP 工具调用
{
"action": "code_review",
"params": {
"code": "<源代码>",
"filename": "<文件名>"
}
}
注意事项
- 不编造不存在的问题，置信度低于0.7的问题标注为"建议确认"
- BLOCKER 级别问题必须优先报告
- 如果 MCP 工具不可用，使用内置的代码分析知识进行评估
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 67 lines · 28 tokens per session scan A 6ccd91a9b273
metago-code-reviewer is a skill published in the GitHub repository metago-ai/metagolifeform (4 stars, last pushed 9d ago), licensed MIT. It adds 28 tokens to every session and 717 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
vue-best-practices
A review checklist for Vue 2 and Vue 3 components, covering component names, prop declarations, TypeScript casts, API styles and complex template expressions.
plugin-quality
A review guide for checking Zhin.js plugins before release. It covers plugin structure, feature declarations, resource cleanup, message sending, and security.
rust-review
A Rust code-review skill for services, checking for crashes, unsafe SQL construction, exposed credentials, ignored errors, and unfinished code.
review-skill
Inspect, safely test, and assess one Runx skill package for capability, trust, and operator readiness. Use when deciding whether to adopt, improve, reject, install, or publish a skill; its evidence-only assess runner is available when native test evidence already exists.
github-pr-comment
Post one exact GitHub pull-request comment through local gh, any compatible hosted connector, or the explicit human-gated MCP composition, with retry safety and independent readback.
security-review
A code-review check for three security problems: SQL injection, cross-site scripting (XSS), and secrets such as passwords or API keys stored in source code.