grumpy-reviewer

grumpy-reviewer is a skill for Claude Code from mhylle/claude-skills-collection. It costs 0 tokens per session (4,542 once invoked), scanned A, original, MIT.

An independent code review focused only on how easy software will be to maintain over time. It checks structure, responsibilities, method and file size, and whether related work is separated clearly.

In plain words
What is it for?
Use it to inspect a codebase for oversized functions, classes with too many jobs, tangled services, missing helpers, and other maintainability problems.
Why use it?
It reduces the risk that a reviewer excuses messy structure because they know the code's history or original intentions. The isolated review treats the code as work submitted for validation by someone else.

Skill for Claude Code

Written for Claude Code: allowed-tools in frontmatter. Also seen: mentions CLAUDE.md; mentions subagents.

Part of the devflow plugin — 38 skills, 13 agents, 5 hooks shipped together

Good fit Use it to inspect a codebase for oversized functions, classes with too many jobs, tangled services, missing helpers, and other maintainability problems.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/mhylle/claude-skills-collection/grumpy-reviewer
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add mhylle/claude-skills-collection --skill grumpy-reviewer
Clone the repo
git clone --depth 1 https://github.com/mhylle/claude-skills-collection

Made for: Claude Code.

Or install devflow, the plugin that ships this one along with the rest of its 38 skills, 13 agents, 5 hooks.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for grumpy-reviewer

README.md
[![agentmods](https://agentmods.dev/badge/skills/mhylle/claude-skills-collection/grumpy-reviewer/github.svg)](https://agentmods.dev/skills/mhylle/claude-skills-collection/grumpy-reviewer)
Your own site
<a href="https://agentmods.dev/skills/mhylle/claude-skills-collection/grumpy-reviewer"><img src="https://agentmods.dev/badge/skills/mhylle/claude-skills-collection/grumpy-reviewer/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for grumpy-reviewer

Your own site · 80×15
<a href="https://agentmods.dev/skills/mhylle/claude-skills-collection/grumpy-reviewer"><img src="https://agentmods.dev/badge/skills/mhylle/claude-skills-collection/grumpy-reviewer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 0 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 4,542 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits
  • NVIDIA SkillSpector pass 7 Sept 2026
How audits are shown
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00000 $0.04542
Opus 5 $0.00000 $0.02271
Sonnet 5 $0.00000 $0.00908
Haiku 4.5 $0.00000 $0.00454

Measured 11d ago against content hash 04bfbe8ac732, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-11, from the pricing page.

Security

Grade A, and why

grumpy-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.

The scan reads SKILL.md. This mod also ships 3 executable files (evals/fixtures/order-service.ts, evals/fixtures/report_builder.py, evals/fixtures/token-clock.ts), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/grumpy-reviewer/SKILL.md · 262 lines

How it starts

The opening of the file, as written. The whole thing — 262 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Grumpy Reviewer

One reviewer. One obsession: will a human still be able to maintain this in two years?

The Grumpy Reviewer is a curmudgeon who has seen a thousand codebases rot from the inside because nobody pushed back on the small structural decisions. Functions that quietly grew to 200 lines. Classes that accreted a thirteenth responsibility. Files nobody dares open. It judges code purely on maintainability through structure — separation of concerns, service-oriented design, helper-method extraction, file size, and the rule of 7 — and it is blunt about what it finds.

It runs as an isolated subagent that is told only what the code is supposed to do, never how it was built. That isolation is the whole point. Don't skip it.

Why This Skill Exists (and why the isolation matters)

When Claude reviews code it just wrote — or just watched get written — it inherits the author's frame. It knows why that 180-line method "had to" be that way, it remembers the constraint that justified the god-class, it sympathizes. Sympathy is the enemy of a structural review. A future maintainer will have none of that context, and neither should the reviewer.

So the reviewer is dispatched as a subagent with a deliberately thin brief:

  • It gets the code (file paths it can read in full, plus the diff if reviewing changes).
  • It gets one factual line about what the code is supposed to do — supplied by the user, never reconstructed from the build narrative.
  • It does not get: how the code was produced, what was tried and rejected, what Claude concluded, why any tradeoff was made, or any reassurance that "this part is fine."

It then reviews as if a junior programmer handed it an unfamiliar pull request and asked "is this good?" — with the working assumption that it probably isn't, and that its job is to find where. This is not cruelty for its own sake; a reviewer that assumes competence stops looking, and a reviewer that stops looking is useless.

Preserve the isolation. Running the persona in the main context defeats the skill — same context, same sympathy, same blind spots.

Read the full file on GitHub · 262 lines

Files

What ships with it

4 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 11d ago First seen · 262 lines · 0 tokens per session scan A 04bfbe8ac732

Subscribe to this mod's changes

grumpy-reviewer is a skill published in the GitHub repository mhylle/claude-skills-collection (18 stars, last pushed 8d ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 4,542 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.