Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add paullukic/coograph --skill coograph-reviewgit clone --depth 1 https://github.com/paullukic/coographWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/paullukic/coograph/coograph-review)<a href="https://agentmods.dev/skills/paullukic/coograph/coograph-review"><img src="https://agentmods.dev/badge/skills/paullukic/coograph/coograph-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/paullukic/coograph/coograph-review"><img src="https://agentmods.dev/badge/skills/paullukic/coograph/coograph-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00046 | $0.01523 |
| Opus 5.5 | $0.00018 | $0.00609 |
| Sonnet 5.5 | $0.00009 | $0.00305 |
| Haiku 4.5 | $0.00005 | $0.00152 |
Grade A, and why
coograph-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 130 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Review the changes in scope for spec compliance, convention violations, logic bugs, and architectural issues. You review — you do not author. Never edit files.
Phase 0 — Orient with Code-Graph (MANDATORY — non-negotiable)
Before reading any file or running any search, this is the HARD RULE — code-graph first, no exceptions:
- Call
detect_changes()thenget_review_context(files=[...changed files...]). ALWAYS start here. Use the returned file set and risk scores to drive the review. High-risk files first. - Fall back to
sqlite3 .code-graph/graph.dbONLY when the MCP code-graph server is not registered (tools literally do not exist) OR every attempted MCP call returned an error. - Fall back to standard search/read tools ONLY when Step 1 AND Step 2 are both impossible because the code-graph DB is absent from the workspace.
"Slow", "unwieldy", "I already know the file", or "it's a small diff" are NOT valid reasons to bypass. When tracing consumers or write paths use query_graph("importers_of", file) and query_graph("callers_of", fn) before grepping. Every finding must still be verified from a fresh file read regardless of graph output.
Phase 1 — Anchor & Scope
- Read
AGENTS.md§ Hard rules and.github/copilot-instructions.md(whenAGENTS.mdhas no Hard rules section,.github/copilot-instructions.mdholds them all): the binding rules and project conventions. Also read.github/instructions/review.instructions.mdwhen it exists (review depth). - Run
git diff origin/main --statto list changed files with line counts. - If the project uses OpenSpec, read the active change's
proposal.md,specs/, andtasks.md.
Phase 2 — Build the Change Manifest
The manifest is the primary review input — NOT raw diffs. Raw diffs cause misreads and phantom findings.
- For each changed file, run
git diff origin/main -- <file>one at a time. - Write a 1-2 line summary per file: what was renamed, added, removed, or rewired. Note old sources for nulled fields, old→new types for type changes.
- Group changes by logical unit. Mark auto-generated files as "auto-generated, skip."
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago Changed 716e8c6b13bb
- 20d ago Changed · +4 lines b65f31121284
- 25d ago Changed · +15 lines ae59ab927fd1
- 1mo ago First seen · 111 lines · 46 tokens per session scan A 5eddbe03f651
coograph-review is a skill published in the GitHub repository paullukic/coograph (17 stars, last pushed 9d ago), licensed MIT. It adds 46 tokens to every session and 1,523 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-16.
Other skills, from other repositories
generic-fullstack-code-reviewer
Review full-stack code for bugs, security vulnerabilities, performance issues, accessibility gaps, and CLAUDE.md compliance. Enforces TypeScript strict mode, input validation, GPU-accelerated animations, and design system consistency. Use when completing features, before commits, or reviewing pull requests.
generic-react-code-reviewer
Review React/TypeScript code for bugs, security vulnerabilities, performance issues, accessibility gaps, and CLAUDE.md workflow compliance. Enforces TypeScript strict mode, GPU-accelerated animations, WCAG AA accessibility, bundle size limits, and surgical simplicity. Use when completing features, before commits, or…
generic-static-code-reviewer
Review static site code for bugs, security issues, performance problems, accessibility gaps, and CLAUDE.md compliance. Enforces pure HTML/CSS/JS standards, minimal page weight, mobile-first design. Use when completing features, before commits, or reviewing changes.
generic-code-reviewer
Review code for bugs, security vulnerabilities, performance issues, accessibility gaps, and CLAUDE.md workflow compliance. Supports any tech stack - HTML/CSS/JS, React, TypeScript, Node.js, Python, NestJS, Next.js, and more. Use when completing features, before commits, or reviewing pull requests.
plan-review-architecture
Architecture-dimension reviewer for written plans. Use when running plan-review or directly when an architectural review is wanted. Activate for keywords like "architecture review", "data flow", "failure modes", "rollback", "edge cases", "test matrix". Scores 5 sub-dimensions 0-10, produces ranked fixes. Always cite…
code-review-loop
Use when opening a PR for review or when receiving review feedback. Activate for keywords like "code review", "PR review", "request review", "review feedback", "address comments", "reviewer said". Covers both ends of the loop: preparing a reviewable PR and acting on feedback rigorously. Always engage with every…