Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/pingfanfan/hello-dsh/code-review-cnnpx skills add pingfanfan/hello-dsh --skill code-review-cngit clone --depth 1 https://github.com/pingfanfan/hello-dshWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/pingfanfan/hello-dsh/code-review-cn)<a href="https://agentmods.dev/skills/pingfanfan/hello-dsh/code-review-cn"><img src="https://agentmods.dev/badge/skills/pingfanfan/hello-dsh/code-review-cn.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00062 | $0.01173 |
| Opus 5 | $0.00031 | $0.00587 |
| Sonnet 5 | $0.00012 | $0.00235 |
| Haiku 4.5 | $0.00006 | $0.00117 |
Grade A, and why
code-review-cn scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
中文代码审查
这是判断指引，不是打分表。一条有证据的阻断项，胜过二十条风格意见。
审查前先读够上下文：只看 diff 无法判断正确性。至少读懂被改函数的调用方、被改接口的两侧、以及这段代码失败时会发生什么。看不懂就说看不懂，不要用泛泛的建议填充。
顺序
按这个优先级走，在高优先级问题没查完之前不要下沉到低优先级：
- 正确性 —— 逻辑是否成立，边界是否处理
- 生命周期与并发 —— 资源是否释放，异步是否有竞态
- 安全 —— 输入是否可信，权限是否收敛
- 契约一致性 —— 文档、类型、注释是否与实现同步
- 测试强度 —— 测试是否真能捕获这个改动引入的回归
- 可读性与风格 —— 最后，且大多数时候可以不提
阻断项
只有这几类值得阻断合并。其余都是建议。
- 正确性缺陷：能构造出具体输入让它产生错误结果或崩溃。必须给出这个输入，说不出来就不是阻断项。
- 资源泄漏：注册了监听器、定时器、订阅、文件句柄、子进程，但没有对应的清理路径；或清理只在成功路径上执行。
- 静默失败：错误被吞掉、被替换成通用错误、或用默认值兜底，导致调用方无法区分"成功"和"出错了但没说"。
- 越界权限：新增的文件写入、命令执行、网络请求超出了这个模块本该有的范围。
- 测试与实现同构：测试只是把实现逻辑重写了一遍，改动实现时测试跟着改，无法捕获任何回归。
逐项检查
正确性
- 边界值：空、单元素、超长、零、负数、并发为 1
- 错误路径：抛错后状态是否一致，是否留下半完成的写入
- 类型断言与非空断言：每一个
!和as都要问凭什么
生命周期
- 每个创建操作是否有配对的销毁，且销毁在所有退出路径上都会执行
- 销毁是否幂等——重复调用不应破坏状态
- 中途失败时，是否只回收已经成功创建的部分
- 异步操作被取消时，回调是否还会触发
安全
- 外部输入是否直接进入 shell、SQL、文件路径、正则
- 路径拼接是否可能穿越到预期目录之外
- 凭据是否可能进入日志、错误信息、快照
契约一致性
- 改了行为，README、JSDoc、类型注释是否同步改了
- 注释是否在解释"为什么"而非复述"做了什么"——复述型注释建议删除
- 错误信息是否说明了下一步该做什么
测试强度
- 这个测试在实现回退到改动前时，会不会失败？不会就是无效测试
- 断言的是外部可观察的状态（返回值、副作用、日志、事件），还是内部实现细节
- 是否覆盖了失败路径，不只是成功路径
输出格式
按严重程度排序，不要按文件顺序。每条包含三部分：
【阻断】src/session.ts:142 — 监听器未在错误路径上移除
当 loadConfig() 抛错时，第 138 行注册的 'change' 监听器不会被移除，
每次重试都会累加一个，最终导致同一事件被处理多次。
建议：把注册移到 try 内，或用 try/finally 保证移除。
- 【阻断】 必须修复才能合并
- 【建议】 值得改，但不阻断
- 【疑问】 我没看懂，需要作者解释——这是诚实的表达，不是弱点
没有阻断项就明确说没有。不要为了显得认真而凑数。
不要做的事
- 不要因为"风格不一致"阻断合并，除非项目有明文规范
- 不要建议引入新抽象，除非当前设计已经产生了具体的重复或缺陷
- 不要复述代码在做什么
- 不要在没有读调用方的情况下断言接口设计有问题
- 不要把"我会这样写"当成审查意见
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 92 lines · 62 tokens per session scan A 214248f32b94
code-review-cn is a skill published in the GitHub repository pingfanfan/hello-dsh (88 stars, last pushed 22d ago), licensed MIT. It adds 62 tokens to every session and 1,173 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
dsh-plugin-guide
Use when developing, reviewing, packaging, debugging, or answering questions about DeepSeek Harness (DSH) plugins — the plugin-based agent harness on vendored Cordis. Applies the official plugin-development constraints (plugin contract, cordis.yml layers, services/events/effects, tool DSL, bundles/profiles) backed by…
dsh-web-release
Release and publish the dsh-web monorepo (DSH Web GUI plugin family + skin collection) — bump all packages to one unified version, commit and tag (tags are cut from main after dev integration; dev is the integration branch), push the vX.Y.Z tag that triggers the GitHub Actions publish pipeline, and verify the npm…
dsh-web-community-plugin-developer
Develop a DSH community plugin and register it in the dsh-web Community Plugins index — author the plugin in the contributor's own repository following the official cordis bundle standard, add its entry to packages/dsh-community-plugins/community.json, regenerate the index with scripts/community-index, rebuild and…
dsh-web-skin-developer
Build a new skin for the dsh-web skin collection (DSH Web GUI) and publish it into the Skin Center — the first-level settings section — scaffold with scripts/dsh-skin-new, author the v2 skin.json manifest plus skin.css token remap (pure asset directory, no package.json, no build step), validate with scripts/dsh-skin…
dsh-web-pre-push-checks
Use before pushing, opening or updating a pull request, or claiming dsh-web checks pass. Selects the required repository gates and diff-specific generation, build, and GUI evidence.
dsh-web-documentation
Use when adding or editing dsh-web README files, docs, AGENTS.md instructions, user-facing configuration text, or bilingual documentation pairs.