Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/openscribbler/syllago/code-reviewnpx skills add OpenScribbler/syllago --skill code-reviewgit clone --depth 1 https://github.com/OpenScribbler/syllagoWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00005 | $0.00239 |
| Opus 5 | $0.00003 | $0.00120 |
| Sonnet 5 | $0.00001 | $0.00048 |
| Haiku 4.5 | $0.00001 | $0.00024 |
Grade A, and why
code-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Code Review
Perform a systematic code review across four dimensions:
Correctness
- Does the logic handle edge cases (empty input, boundary values, concurrent access)?
- Are error paths handled and propagated correctly?
- Do tests cover the happy path and at least one failure path?
- Does the implementation match the spec or PR description?
Clarity
- Are names accurate and self-documenting?
- Is each function focused on one responsibility?
- Would a new contributor understand this in 5 minutes without explanation?
Safety
- Are there injection risks at system boundaries (SQL, shell, HTML output)?
- Is untrusted input validated before use?
- Are secrets or credentials accidentally exposed in code or logs?
Completeness
- Are there missing test cases for documented behavior?
- Is documentation updated if behavior changed?
- Are breaking changes backwards-compatible or flagged?
Output format
Report findings as:
- Must Fix — correctness or security issues that block merge
- Should Fix — meaningful improvements worth addressing now
- Consider — observations that may improve the code but aren't blocking
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 41 lines · 5 tokens per session scan A 882bb33d051e
code-review is a skill published in the GitHub repository OpenScribbler/syllago (15 stars, last pushed 5d ago), licensed Apache-2.0. It adds 5 tokens to every session and 239 once invoked, about $0.0000 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
go-safe-move-refactor
Safely move Go source files between packages with zero compilation downtime. Handles package declarations, import updates, symbol exports, type renames, test migration, and forwarding stubs. Validates compilation after every atomic step.
go-source-documentation
Add idiomatic, godoc-compliant documentation to Go source and test files. Use when user asks to document Go files, add doc comments, improve Go documentation, or mentions /document-go. Covers file headers, package comments, types, functions, interfaces, constants, variables, tests (with detailed explanations)…
increase-test-coverage
Increase Go test coverage to 90%+ using a Research → Plan → Implement pipeline. Analyzes coverage gaps, generates table-driven tests with httptest mocks, and validates results with go test -coverprofile. Designed for Go MCP server projects using the official go-sdk and gitlab.com/gitlab-org/api/client-go/v2.
modularize-go-package
Modularize a monolithic Go package into domain-specific sub-packages. Extracts shared utilities, moves domain files, updates imports, renames types, creates registration functions, and validates compilation+tests at every step. Designed for large-scale refactoring of 50-100+ file packages.
create-mcp-tool
Create a new MCP tool end-to-end: sub-package, input/output structs, handler, ActionSpec metadata, markdown formatter, tests, catalog projection, and documentation. Use when adding a new GitLab API endpoint as an MCP tool.
generate-project-documentation
Generate comprehensive project documentation including architecture overview, package/component docs, MCP tools/resources/prompts reference, developer onboarding guide, and configuration/deployment guide. Uses Diátaxis framework and Mermaid diagrams.