Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/notysoty/openagentskills/code-review-checklistnpx skills add Notysoty/openagentskills --skill code-review-checklistgit clone --depth 1 https://github.com/Notysoty/openagentskillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/notysoty/openagentskills/code-review-checklist)<a href="https://agentmods.dev/skills/notysoty/openagentskills/code-review-checklist"><img src="https://agentmods.dev/badge/skills/notysoty/openagentskills/code-review-checklist.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00026 | $0.01198 |
| Opus 5 | $0.00013 | $0.00599 |
| Sonnet 5 | $0.00005 | $0.00240 |
| Haiku 4.5 | $0.00003 | $0.00120 |
Grade A, and why
Code Review Checklist scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 130 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Code Review Checklist
What this skill does
This skill directs the agent to perform a structured code review using a proven checklist. It catches bugs, security issues, performance problems, and readability concerns that are easy to miss in a quick scan. The output is a prioritized list of findings — not vague suggestions, but specific line-level feedback with clear explanations.
Use this before merging a PR, after a refactor, or any time you want a second opinion on code quality.
How to use
Claude Code / Cline
Copy this file to .agents/skills/code-review-checklist/SKILL.md in your project root.
Then ask the agent:
- "Review this file using the Code Review Checklist skill."
- "Run the Code Review Checklist skill on my PR diff."
Cursor
Add the contents of the "Prompt / Instructions" section below to your .cursorrules file, then open the file you want reviewed and ask Cursor to review it.
Codex
Paste the code and the instructions from the section below into the Codex chat.
The Prompt / Instructions for the Agent
When asked to review code, work through each section of this checklist in order. For every issue found, output:
- Severity:
critical|major|minor|nit - Location: file name and line number(s)
- Issue: one-sentence description
- Suggestion: what to do instead
1. Correctness
- Does the logic match the intended behavior (based on function name, comments, or context)?
- Are there off-by-one errors in loops or array accesses?
- Are all code paths handled, including edge cases (empty input, null, zero, negative numbers)?
- Are async operations properly awaited? Could there be race conditions?
- Are errors caught and handled appropriately, or silently swallowed?
2. Security
- Is any user input used in SQL queries, shell commands, or file paths without sanitization?
- Are secrets, API keys, or passwords hardcoded or logged?
- Are authentication and authorization checks in place before sensitive operations?
- Is output properly escaped before being rendered in HTML (XSS)?
- Are dependencies pinned to known-good versions?
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 130 lines · 26 tokens per session scan A 4d1d4dc9980c
Code Review Checklist is a skill published in the GitHub repository Notysoty/openagentskills (9 stars, last pushed 22d ago), licensed MIT. It adds 26 tokens to every session and 1,198 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
refactor
Guides a refactor, cleanup, or restructure with the right decomposition. Use when the user asks to refactor, simplify, extract, or modernize code.
remove-ai-slops
Removes AI-generated code smells from branch changes or an explicit file list behind regression tests. Use when the user asks to clean up, deslop, or remove AI-slop patterns from recent changes.
review-work
Post-implementation gate review: run manual QA on the real surface yourself, then launch ONE gate reviewer (never a panel) to audit goal, constraints, code quality, security, missed context, and QA evidence. Use before a PR handoff or when the user explicitly asks to review completed work.
pre-publish-review
Nuclear-grade 12-agent pre-publish release gate. Runs /get-unpublished-changes to detect all changes since last npm release, spawns up to 10 ultrabrain agents for deep per-change analysis, invokes /review-work (orchestrator manual QA plus one gate reviewer) for holistic review, and 1 oracle for overall release…
work-with-pr
Full PR lifecycle in a fresh task-owned git worktree: implement via the ulw-loop skill with mandatory evidence-bound manual QA → reviewer-readable English PR → verification loop (CI + Cubic, where Cubic is skipped only when its quota is exhausted) → merge by default → worktree cleanup. Decomposes one task into the…
tech-debt-audit
Thorough, file-cited technical debt audit across 9 dimensions using AST-grep (tree-sitter), grep, LSP, and language-native tooling. Produces TECHDEBTAUDIT.md with severity, effort estimates, and prioritized fixes. Use when asked for codebase health check, tech debt audit, architecture review, code quality assessment…