Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add n24q02m/better-code-review-graph --skill onboard-repogit clone --depth 1 https://github.com/n24q02m/better-code-review-graphWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/n24q02m/better-code-review-graph/onboard-repo)<a href="https://agentmods.dev/skills/n24q02m/better-code-review-graph/onboard-repo"><img src="https://agentmods.dev/badge/skills/n24q02m/better-code-review-graph/onboard-repo/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/n24q02m/better-code-review-graph/onboard-repo"><img src="https://agentmods.dev/badge/skills/n24q02m/better-code-review-graph/onboard-repo.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00038 | $0.01606 |
| Opus 5 | $0.00019 | $0.00803 |
| Sonnet 5 | $0.00008 | $0.00321 |
| Haiku 4.5 | $0.00004 | $0.00161 |
Grade A, and why
onboard-repo scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
Copies of this mod
1 near-identical copy found in the catalogue:
- onboard-repo — 100% identical, 0 lines differ
How it starts
The opening of the file, as written. The whole thing — 103 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Onboard Repo
Take a codebase you have never seen and turn it into a queryable graph, then read the graph to produce an orientation map. Use this on first contact with a repository, before answering questions about it or changing anything in it.
Scope: this skill builds and reads a knowledge graph. It does not modify source files, CI configuration, or project conventions. The only files it creates are the graph database under .code-review-graph/ (already self-ignored) and, when you choose to add one, a .code-review-graphignore.
Command surface: run the local CLI through the coding harness shell. Examples
use the installed better-code-review-graph command; from a source checkout,
prefix it with uv run. No MCP mapping is required.
Steps
-
Check what already exists with
better-code-review-graph graph stats --repo-root "<path>". A non-empty graph can go directly to step 5; a missing-graph error means continue with a build. -
Decide the indexing scope before building:
- Single repository: pass only
--repo-root "<path>". - A repository that vendors or embeds others: add a
.code-review-graphignoreat the repo root (onefnmatchpattern per line,#for comments) so vendored trees, build output, and fixtures do not inflate the graph. Common additions:vendor/*,third_party/*,**/generated/*,**/*.min.js. - Several sibling repositories that call each other: federate them in one graph with
--rootsin step 3, then useimpact-auditfor cross-repo questions.
- Single repository: pass only
-
Build the graph with
better-code-review-graph graph build --full-rebuild --repo-root "<path>".- For a federated build:
better-code-review-graph graph build --full-rebuild --repo-root "<path-a>" --roots "<path-b>". Each root is registered in the repo registry and its files are tagged with arepo_id, which later lets you scope any query with--repo "<repo_id>". - Parsing is Tree-sitter based and needs no language servers, toolchains, or compilation -- an unbuildable checkout still indexes.
- For a federated build:
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 103 lines · 38 tokens per session scan A 9c53ca394db2
onboard-repo is a skill published in the GitHub repository n24q02m/better-code-review-graph (67 stars, last pushed today), licensed Apache-2.0. It adds 38 tokens to every session and 1,606 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
review-work
Post-implementation review orchestrator. Launches 5 parallel background sub-agents: Oracle (goal/constraint verification), Oracle (code quality), Oracle (security), unspecified-high (hands-on QA execution), unspecified-high (context mining from GitHub/git/Slack/Notion). All must pass for review to pass. MUST USE after…
code-review
Reviews Spec Kit code changes for positive and negative test coverage, regression evidence for bug fixes, and consistent repository terminology. Use when reviewing a diff or pull request. Do not use for implementing changes or posting GitHub review actions.
skill-coverage-audit
Trace codepaths in diffs, map against tests, auto-generate missing coverage — use before shipping PRs.
mantis-plan
Formulates a targeted defensive security reviewing plan based on the active threat model and historical learnings. Use when starting a security review campaign to map the codebase boundaries and generate a roadmap (workspace/plan.json). Don't use for executing code reviews, writing test scripts, or patching code.
gentle-ai-bench
Trigger: bench, journey, journeys, driven mode, gentle-ai-bench, journey corpus, j-numbers, bench axis. Author and verify gentle-ai bench journeys; go test ./bench never proves driven execution.
go-testing
Trigger: Go tests, go test coverage, Bubbletea teatest, golden files. Apply focused Go testing patterns.