Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add ntaffzii/Skill-Agents --skill code-reviewgit clone --depth 1 https://github.com/ntaffzii/Skill-AgentsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ntaffzii/skill-agents/code-review)<a href="https://agentmods.dev/skills/ntaffzii/skill-agents/code-review"><img src="https://agentmods.dev/badge/skills/ntaffzii/skill-agents/code-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/ntaffzii/skill-agents/code-review"><img src="https://agentmods.dev/badge/skills/ntaffzii/skill-agents/code-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00054 | $0.00481 |
| Opus 5.5 | $0.00022 | $0.00192 |
| Sonnet 5.5 | $0.00011 | $0.00096 |
| Haiku 4.5 | $0.00005 | $0.00048 |
Grade A, and why
code-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Code Review
Use a reviewer stance. Findings come first. Summaries are secondary.
Review Order
-
Understand the intent
- Read the user request, PR description, issue, or nearby docs.
- Identify the expected behavior change.
-
Ask whether the change should exist
- Look for simpler alternatives, existing helpers, smaller scope, or a better layer for the change.
- Flag avoidable risk when the same outcome can be achieved with less behavioral surface.
-
Inspect the actual diff
- Trace changed code paths end to end.
- Check callers, data shapes, error paths, async paths, and boundary conditions.
- Look for behavior that differs from the stated intent.
-
Verify tests
- Check whether tests cover the changed behavior.
- Prefer tests that would fail on the discovered issue.
- Flag missing regression coverage when risk is real.
-
Report findings
- Lead with issues ordered by severity.
- Include file and line references.
- Explain why the issue matters and how it can fail.
- Keep praise and general commentary out of the findings section.
Severity
- P0: breaks core production behavior, data loss, security exposure, or prevents release.
- P1: likely user-facing bug, broken important workflow, serious regression.
- P2: edge-case bug, missing important test, maintainability risk with plausible impact.
- P3: minor issue or cleanup suggestion.
Output Format
If issues exist:
Findings
- [P1] Title - path:line
Explanation.
Open Questions
- ...
Summary
Brief context only.
If no issues:
No findings.
Residual risk: mention any tests not run or areas not inspected.
Rules
- Do not rewrite the code unless the user asks.
- Do not bury findings under a long summary.
- Avoid style comments unless style creates a real defect or conflicts with established local patterns.
- Distinguish what the code claims from what was actually verified.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 73 lines · 54 tokens per session scan A bf86e8506720
code-review is a skill published in the GitHub repository ntaffzii/Skill-Agents (4 stars, last pushed 15d ago), licensed MIT. It adds 54 tokens to every session and 481 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
conductor-review
Reviews a completed track against its plan and guidelines; auto-archives on pass, auto-deletes and restarts on fail.
requesting-code-review
Pre-commit review: security scan, quality gates, auto-fix.
gh-issues
Fetch GitHub issues, spawn sub-agents to implement fixes and open PRs, then monitor and address PR review comments. Usage: /gh-issues [owner/repo] [--label bug] [--limit 5] [--milestone v1.0] [--assignee @me] [--fork user/repo] [--watch] [--interval 5] [--reviews-only] [--cron] [--dry-run] [--model glm-5]…
adk-go-self-review
Review an ADK Go change the way a maintainer will — a fresh-context pass over the whole diff, five lenses (correctness and tests, scope, simplicity, style, adk-python parity), and the mutation check that proves your tests pin the change. Use before opening a PR, before any later push that changes code, and when asked…
verify-change
A change-checking skill that reviews code differences and checks whether related documentation, tests, and records were updated.
verify-quality
A code-quality checker that measures complexity, size, naming, and common code smells. It reports problems such as duplicated code, unused code, and overly long functions.