Getting it into your agent
This one installs as part of its plugin. Adding the marketplace and installing the plugin brings it with everything else the plugin ships.
/plugin marketplace add RadOrigin-LLC/RAD-Claude-Skills/plugin install rad-code-reviewWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/radorigin-llc/rad-claude-skills/rad-code-review)<a href="https://agentmods.dev/skills/radorigin-llc/rad-claude-skills/rad-code-review"><img src="https://agentmods.dev/badge/skills/radorigin-llc/rad-claude-skills/rad-code-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/radorigin-llc/rad-claude-skills/rad-code-review"><img src="https://agentmods.dev/badge/skills/radorigin-llc/rad-claude-skills/rad-code-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00172 | $0.04210 |
| Opus 5 | $0.00086 | $0.02105 |
| Sonnet 5 | $0.00034 | $0.00842 |
| Haiku 4.5 | $0.00017 | $0.00421 |
Grade A, and why
rad-code-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 287 lines — stays where its author put it; the contents beside it link to each section on GitHub.
What this is. The built-in /code-review is the review engine — 8–10 parallel
finders, verification with evidence-quoted verdicts, --fix, --comment. This skill
does not compete with it. It rides it, and adds what it doesn't have: mechanical
checks, findings memory across runs, a severity taxonomy, and the specialist lanes
(AI slop, framework IDOR, BaaS/RLS).
Scope. Diff, branch, or PR only. Default scope matches the engine's: the current
branch's commits ahead of its upstream plus uncommitted changes (working diff only when
there is no upstream). --since <commit> reviews a branch range; a bare <pr#> reviews
a GitHub PR. There is no full-repo mode; for a whole-repo deep dive use
/code-review ultra or run this skill per directory-scoped diff.
Naming. Finding IDs are CR-NNN, assigned and persisted mechanically by
scripts/findings-index.py — the same finding keeps the same ID across runs. Config
(.radcrconfig.yml) and state (.radcr/) keep the radcr prefix; renaming them
would break existing per-repo state for zero readability gain.
Effort and cost contract
| Mode | Engine level | Lane pass | Security scanner | Expected cost profile |
|---|---|---|---|---|
| quick | low | validator only, no lane subagent | never | seconds; near-zero beyond engine |
| standard (default) | medium | 1 lane subagent, session model | only with explicit --scan |
one engine run + one subagent |
| deep | xhigh | 1 lane subagent + --security-deep rules if flagged |
yes, when available | the expensive one; say so before running |
Before running deep, tell the user it is the expensive mode and confirm.
No mode loads more than the references its lanes need: the slop lane always,
IDOR/BaaS references only on stack match, security-deep-mode.md only on flag.
standard and deep also run the cross-model Codex pass (Step 4.5) as the
default adversarial reviewer — an independent GPT-5.5 second opinion via the
rad-codex plugin. It adds a few minutes and consumes Codex quota, and skips
itself silently when Codex isn't installed. --no-codex disables it; quick
never runs it.
deep (and --security-deep at any mode) additionally runs the security
scanner pass (Step 4.6) — the external codex-security CLI, a purpose-built
security scanner, as an evidence source for the --security-deep phases. It is
strictly optional: no binary, no auth, or a failed preflight means the pass skips
and security-deep-mode.md runs entirely on the lane subagent as before. It costs
real money, so it runs under a hard --max-cost ceiling (default $2.00,
defaults.security_scan_max_cost). --no-scan disables it; --scan forces it on
in standard; --scan-max-cost <usd> overrides the ceiling for one run.
The full contract lives in workflows/security-scan.md — that file is the only
place in this plugin that may shell out to codex-security.
What ships with it
12 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- LICENSE 11 KB
- references/adversarial-protocol.md 3.8 KB
- references/ai-slop-patterns.md 19 KB
- references/security-checklist.md 23 KB
- references/security-deep-mode.md 20 KB
- references/severity-model.md 15 KB
- references/subagent-prompts/lane-review.md 4.0 KB
- templates/findings-schema.md 12 KB
- templates/radcrconfig-template.yml 10 KB
- workflows/offer-fixes.md 3.0 KB
- workflows/report-generation.md 5.7 KB
- workflows/security-scan.md 12 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 287 lines · 172 tokens per session scan A 69bb83c0cbd1
rad-code-review is a skill published in the GitHub repository RadOrigin-LLC/RAD-Claude-Skills (5 stars, last pushed 23d ago), licensed Apache-2.0. It adds 172 tokens to every session and 4,210 once invoked, about $0.0009 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
critic
The Critic reviews accessibility decisions to ensure they meet professional standards and evidence requirements.
best-practices
Apply modern web development best practices for security, compatibility, and code quality. Use when asked to "apply best practices", "security audit", "modernize code", "code quality review", or "check for vulnerabilities".
review-pr
Multi-agent PR review with four modes (review, re-review, self-review, address-feedback) - spawns parallel subagents, saves diff to /tmp for context efficiency, supports file exclusion patterns.
code-review
Perform comprehensive code reviews covering bugs, style, performance, security, and best practices. Use this skill when the user mentions: review my code, check this code, code review, find bugs, improve code, refactor suggestions, security audit, performance optimization, code quality, static analysis.
context-bundler
Interactively creates targeted code, design, and documentation bundles for external review (Markdown or ZIP). Includes a comprehensive library of review & delegation persona templates (Adversarial Security, Plan Critique, Refactoring Quality, Sub-Agent Task Handoff, Documentation Synthesis, Architecture, Compliance…
coding-conventions-agent
Coding conventions enforcement agent. Auto-invoked when writing new code, reviewing code quality, adding headers, or checking documentation compliance across Python, TypeScript/JavaScript, and C#/.NET.