Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add open-vela/.claude --skill driver-code-reviewergit clone --depth 1 https://github.com/open-vela/.claudeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/open-vela/.claude/driver-code-reviewer)<a href="https://agentmods.dev/skills/open-vela/.claude/driver-code-reviewer"><img src="https://agentmods.dev/badge/skills/open-vela/.claude/driver-code-reviewer/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/open-vela/.claude/driver-code-reviewer"><img src="https://agentmods.dev/badge/skills/open-vela/.claude/driver-code-reviewer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00127 | $0.03648 |
| Opus 5 | $0.00063 | $0.01824 |
| Sonnet 5 | $0.00025 | $0.00730 |
| Haiku 4.5 | $0.00013 | $0.00365 |
Grade A, and why
driver-code-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 298 lines — stays where its author put it; the contents beside it link to each section on GitHub.
NuttX Driver Code Reviewer
基于 59 Pattern（52 质量 + 7 设计）的驱动代码质量审查，双轮交叉验证 + 量化评分。 不修改被审查代码，Critical 问题仅给出修复建议。
完整 Pattern 定义和维度规格见 references/layer1-code-quality-spec.md。
外部依赖
| 依赖 | 用途 | 缺失时降级方案 |
|---|---|---|
nuttx-driver-development skill |
子系统 pattern 参考 | 仅用本 skill 内置规则 |
feishu skill 或 feishu-mcp |
飞书报告输出（可选） | 跳过飞书，仅本地报告 |
触发格式
review <路径>
review <路径>，对比 <分支名>
维度体系
质量维度（L1-1 ~ L1-7，参与评分，100 分制）
| 维度 | 分值 | Pattern 数 | 审查内容 |
|---|---|---|---|
| L1-1 内存安全 | 20 | 8 | 空指针、UAF、double-free、未初始化、堆泄漏 |
| L1-2 并发安全 | 20 | 7 | 数据竞争、死锁、锁误用、原子性违反 |
| L1-3 资源管理 | 10 | 7 | fd/sem/timer/work_queue 申请释放配对 |
| L1-4 错误处理 | 10 | 4 | 返回值检查、错误传播、状态回滚 |
| L1-5 类型与数值安全 | 10 | 5 | 整数溢出、符号混用、截断、移位 |
| L1-6 输入与边界校验 | 15 | 12 | 缓冲区边界、ioctl 参数、格式串注入 |
| L1-7 嵌入式专项 | 15 | 9 | DMA/cache、ISR、RPMSG、W1C 寄存器、PM |
权重分层依据：
- T0 致命（40%）：L1-1 + L1-2 — 直接导致 crash/数据损坏
- T1 严重（30%）：L1-6 + L1-7 — 攻击入口 + RTOS 独有陷阱
- T2 重要（30%）：L1-3 + L1-4 + L1-5 — 长期影响但很少立即致命
维度适用性判定
如果驱动不涉及某维度的检查场景，该维度标记为 N/A，其分值按比例重分配到其余适用维度。
| 场景 | N/A 维度 | 理由 |
|---|---|---|
| 纯 I2C 线程驱动，无 ISR/中断 | L1-7 中 P-47/P-49 跳过 | 无中断上下文 |
| 无 DMA/RPMSG/PM 关键词 | L1-7 整体 N/A | 嵌入式专项不适用 |
| 无并发访问（单线程 chardev） | L1-2 中 P-09~P-14 部分跳过 | 无共享状态 |
| 无外部输入（纯硬件寄存器驱动） | L1-6 部分 N/A | 无用户空间输入 |
权重重分配公式：N/A 维度的分值按剩余维度原始权重比例分配。例如 L1-7(15分) N/A 时，15 分按 20:20:10:10:10:15 比例分配到 L1-1~L1-6。
独立信号（不参与质量评分）
| 维度 | 扣分上限 | Pattern 数 | 审查内容 |
|---|---|---|---|
| L1-8 设计哲学 | -10 | 7 | 抽象层绕过、命名空间污染、影子状态、重复造轮子 |
| 需求/设计一致性 | 独立报告 | — | 对照 requirement.md/design.md 检查功能完整性 |
评分规则
严重度与扣分（L1-1 ~ L1-7）
| 严重度 | 扣分 | 定义 |
|---|---|---|
| Critical | -15 | 导致 crash、数据损坏或安全漏洞 |
| High | -8 | 显著影响代码质量，但不一定立即致命 |
| Medium | -3 | 值得修改但不阻塞 |
| Low | -1 | 改进建议 |
L1-8 设计哲学扣分（独立）
| 严重度 | 扣分 | 适用 Pattern |
|---|---|---|
| High | -4 | DP-01 绕过抽象层, DP-02 跨层依赖, DP-05 板级侵入, DP-06 影子状态 |
| Medium | -2 | DP-03 头文件泄漏, DP-04 缺少 static, DP-07 重复造轮子 |
What ships with it
5 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 298 lines · 127 tokens per session scan A f083faecdb16
driver-code-reviewer is a skill published in the GitHub repository open-vela/.claude (5 stars, last pushed yesterday), licensed Apache-2.0. It adds 127 tokens to every session and 3,648 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
arch-review
Read-only architecture review of RTL vs uArch spec with area/timing/power tradeoffs. Use for post-RTL architecture sign-off or suspected spec mismatch.
kicad-pcb-review
Use this skill when reviewing, fixing, validating, or preparing KiCad PCB projects with the kicad MCP server.
cdc-tool-profiles
Internal reference: cdc tool profiles (agent-loaded; do not invoke).
rtl-review
Audit RTL code for lint violations, synthesis hazards, coding-style compliance, and readability. Use when the user says "review this Verilog", "check my RTL", "lint this module", "is this code synthesizable", or shares an HDL file and asks for feedback before simulation or tape-in.
kicad-pcb-review
KiCad PCB review and manufacturing readiness agent skill for Cursor.
code-review-policy
Internal reference: code review policy (agent-loaded; do not invoke).