swag2mcp: Skill for Claude Code

.agents/skills/codereviewer/SKILL.md

codereviewer is a skill for Claude Code, Codex from mmadfox/swag2mcp. It costs 60 tokens per session (1,597 once invoked), scanned A, original, Apache-2.0.

A strict code-review guide for a specific Go project called swag2mcp. It checks changes against that project’s own developer rules, including naming, formatting, errors, concurrency, and tests.

In plain words
What is it for?
Reviewing swag2mcp Go code for compilation and security issues, naming and formatting, error handling, concurrency, testing patterns, and required conventions.
Why use it?
It gives reviews a consistent standard and catches project-specific problems that a general Go review might miss.

Skill for Claude CodeCodex

Written for no agent in particular: nothing here depends on one. Also seen: installed under .agents/ (shared by several agents).

This is mmadfox/swag2mcp's own configuration. It tells Claude Code and Codex how to work on swag2mcp itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything swag2mcp configures →

Reuse

Borrowing it

Nothing to install: this file belongs to mmadfox/swag2mcp. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/mmadfox/swag2mcp/main/.agents/skills/codereviewer/SKILL.md
Clone the repo
git clone --depth 1 https://github.com/mmadfox/swag2mcp

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for codereviewer

README.md
[![agentmods](https://agentmods.dev/badge/skills/mmadfox/swag2mcp/codereviewer/github.svg)](https://agentmods.dev/skills/mmadfox/swag2mcp/codereviewer)
Your own site
<a href="https://agentmods.dev/skills/mmadfox/swag2mcp/codereviewer"><img src="https://agentmods.dev/badge/skills/mmadfox/swag2mcp/codereviewer/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for codereviewer

Your own site · 80×15
<a href="https://agentmods.dev/skills/mmadfox/swag2mcp/codereviewer"><img src="https://agentmods.dev/badge/skills/mmadfox/swag2mcp/codereviewer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 60 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,597 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00060 $0.01597
Opus 5.5 $0.00024 $0.00639
Sonnet 5.5 $0.00012 $0.00319
Haiku 4.5 $0.00006 $0.00160

Measured 2mo ago against content hash bbe02b36326c, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

codereviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.agents/skills/codereviewer/SKILL.md · 102 lines

How it starts

The opening of the file, as written. The whole thing — 102 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Go Code Reviewer Skill — swag2mcp

🎯 ROLE & CORE PRINCIPLE

You are a Principal Go Developer and a strict Code Reviewer for the swag2mcp project. Your absolute Source of Truth is the set of rules defined in the godeveloper skill.

  • If a rule in godeveloper contradicts general Go best practices, the godeveloper rule has absolute priority.
  • You must not suggest changes that violate godeveloper.
  • If the code is perfect and fully complies with the rules, you must explicitly state this.

🧠 REVIEW ALGORITHM (CHAIN OF THOUGHT)

Before generating your response, you are required to mentally evaluate the code against the following categories:

  1. Compilation & Security: Are there obvious compilation errors? Are there security vulnerabilities (e.g., Zip Slip without filepath.Rel)?
  2. Naming & Formatting: MixedCase usage, correct acronyms (ServeHTTP), file names (snake_case.go), import grouping, early returns (guard clauses), and mutex granularity.
  3. Error Handling: Errors are never ignored (_) and are wrapped using %w. For LLM responses, LLMError is strictly used (correct code, <=80 chars per line, ASCII only, explains the problem + next steps).
  4. Architecture & Patterns: Context is always the first parameter and is NEVER stored in structs. Interfaces belong to the consumer package. Request/Response structs have validate and jsonschema tags.
  5. Testing (if applicable): Presence of t.Parallel(), use of require instead of assert, table-driven tests, use of newTestService()/seedTestData(), and absence of time.Sleep.

✅ REVIEW CHECKLIST (FROM godeveloper)

1. Naming & Files

  • Variables/Functions: MixedCase, no underscores. Short names for local variables, descriptive for exported ones.
  • Acronyms: ID, HTTP, URL (not Id, Http, Url).
  • Files: lowercase with underscores (oauth2_cc.go, parse_v3.go).
  • Receivers: 1-2 characters reflecting the type (s *Service, h *handler), consistent across the type.
  • Interfaces: -er suffix for single-method interfaces (Authenticator), belong to the consumer package.

Read the full file on GitHub · 102 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2mo ago First seen · 102 lines · 60 tokens per session scan A bbe02b36326c

Subscribe to this mod's changes

codereviewer is a skill published in the GitHub repository mmadfox/swag2mcp (0 stars, last pushed 2mo ago), licensed Apache-2.0. It adds 60 tokens to every session and 1,597 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Related

Other skills, from other repositories

code-review-go

Deep Go-specific code review covering goroutine lifecycle, data races, error wrapping, domain modeling, and interface design. Applied in addition to the generic code-review skill when Go code is detected. Invoked when reviewing Go PRs, Go code changes, or performing Go-specific quality checks.

soulcodex/agentic · 61 tokens

pr-to-go-linter

Generate a new pkg/linters analyzer from a merged or open PR pattern.

github/gh-aw · 22 tokens

golang-refactoring

Golang refactoring — safe, at-scale restructuring of existing Go code: a coverage-adaptive safety net, behavior-preserving transforms (gopls Rename/Extract, gofmt -r, gopatch), the Fowler catalog mapped to Go, breaking import cycles, and small stacked PRs. Apply when a function or type has grown too large, a code…

samber/cc-skills-golang · 220 tokens

goai

GoAI is a Go SDK for AI applications. One unified API across 25+ LLM providers. Inspired by the Vercel AI SDK, adapted to Go idioms (generics, interfaces, channels).

zendev-sh/goai · 0 tokens

agents-md

Generate AGENTS.md files for Go, Rust, TypeScript, and Java projects. Use this skill whenever the user asks to create, scaffold, bootstrap, update, or review an AGENTS.md (or agent-instructions, CLAUDE.md, repo guide for agents) file in a codebase. Also trigger when the user says "add AGENTS.md", "make this repo…

dimetron/pi-go · 138 tokens

ring:verifying-code

Verifying a Go project: runs every quality check (lint, vet, imports, format, docs, unit, integration, E2E) and returns a single MERGEREADY or NEEDSFIX verdict. Report-only: never fixes anything. Use for a quick pre-merge or pre-PR check outside a full dev-cycle. Skip when not a Go project, when you want a single…

LerianStudio/ring · 101 tokens