Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/roedyrustam/vibes-plug/coderabbitnpx skills add roedyrustam/vibes-plug --skill coderabbitgit clone --depth 1 https://github.com/roedyrustam/vibes-plugWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00038 | $0.01991 |
| Opus 5 | $0.00019 | $0.00996 |
| Sonnet 5 | $0.00008 | $0.00398 |
| Haiku 4.5 | $0.00004 | $0.00199 |
Grade A, and why
coderabbit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 199 lines — stays where its author put it; the contents beside it link to each section on GitHub.
CodeRabbit (2026 Edition — CodeRabbit 2.x)
English
Orchestration & Integration
Connects and orchestrates with relevant domain skills like brainstorming, zero-to-prod-orchestrator, and project-context-mapper to ensure cohesive execution.
Description
Expert guide for configuring and leveraging CodeRabbit 2.x — AI-powered automated code review, pull request summarization, and interactive developer feedback. Covers configuration, custom review rules, integration with CI/CD, and agentic review mode.
Trigger Conditions
- Setting up CodeRabbit on a GitHub or GitLab repository.
- Configuring custom review rules for your tech stack.
- Using CodeRabbit's agentic mode for deep architectural reviews.
- Integrating CodeRabbit feedback into CI/CD quality gates.
- Writing CodeRabbit-compatible custom instructions in
.coderabbit.yaml.
CodeRabbit 2.x Key Features
| Feature | Description |
|---|---|
| PR Summary | Auto-generates structured PR description with walkthrough |
| Line-by-line Review | Inline comments with specific fix suggestions |
| Agentic Review | Deep analysis spanning multiple files for architectural issues |
| Learnable Rules | Learns from review dismissals and approvals over time |
| CI Integration | Blocks PR merge if critical issues found |
| Chat Mode | Ask CodeRabbit questions about the PR in review thread |
Configuration (.coderabbit.yaml)
# .coderabbit.yaml — place in repository root
version: "2"
language: "en-US"
tone_instructions: "Be concise and direct. Prioritize security and performance issues."
reviews:
auto_review:
enabled: true
drafts: false # Don't review draft PRs
base_branches: ["main", "develop"]
profile: "chill" # assertive | chill | default
request_changes_workflow: false
high_level_summary: true
commit_message_instructions: "Use Conventional Commits format: feat/fix/chore/docs"
# Ignore paths from review
path_filters:
- "!**/*.lock"
- "!**/migrations/**"
- "!**/generated/**"
- "!**/__snapshots__/**"
# Stack-specific review instructions
path_instructions:
- path: "apps/api/**"
instructions: |
- Check for missing input validation (Zod schemas required on all handlers)
- Flag any database queries without proper RLS consideration
- Ensure all async functions have try/catch or error boundaries
- Check for N+1 query patterns (missing .include() or DataLoader usage)
- path: "apps/web/**"
instructions: |
- Check for missing `key` props in .map() renders
- Flag `useEffect` without proper cleanup functions
- Check for missing `alt` attributes on images
- Verify Server Actions are properly validated with Zod
- path: "apps/admin/**"
instructions: |
- All admin routes must verify isSuperAdmin === true
- Flag any direct DB access without service role client
- Check for proper audit logging on destructive operations
# Custom review rules for the entire codebase
instructions: |
Review with these priorities:
1. SECURITY: SQL injection, XSS, auth bypass, exposed secrets
2. CORRECTNESS: Logic bugs, off-by-one errors, type unsafety
3. PERFORMANCE: N+1 queries, unnecessary re-renders, bundle size
4. MAINTAINABILITY: Code duplication, naming, SOLID violations
5. STYLE: Only comment if it's a significant clarity issue
# PR summary format
summary:
auto_title_placeholder: "🤖 AI Title"
description: |-
## Summary
<!-- Concise description of what changed -->
## Changes
<!-- Structured list by area -->
## Testing
<!-- What was tested -->
# Enable chat for interactive Q&A
chat:
auto_reply: true
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 199 lines · 38 tokens per session scan A 6546a3927d14
coderabbit is a skill published in the GitHub repository roedyrustam/vibes-plug (48 stars, last pushed 15d ago), licensed MIT. It adds 38 tokens to every session and 1,991 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
performance-optimization
Optimizes application performance across frontend, backend, queries, and databases. Use when performance requirements exist, when you suspect performance regressions, when Core Web Vitals or load times need improvement, when N+1 query patterns need fixing, or when profiling reveals bottlenecks.
doubt-driven-development
Subjects every non-trivial decision to a fresh-context adversarial review before it stands. Use when correctness matters more than speed, when working in unfamiliar code, when stakes are high (production, security-sensitive logic, irreversible operations), or any time a confident output would be cheaper to verify now…
test-driven-development
Drives development with tests. Use when implementing any logic, fixing any bug, or changing any behavior. Use when you need to prove that code works, when a bug report arrives, or when you're about to modify existing functionality.
ci-cd-and-automation
Automates CI/CD pipeline setup. Use when setting up or modifying build and deployment pipelines. Use when you need to automate quality gates, configure test runners in CI, or establish deployment strategies.
context-engineering
Optimizes agent context setup. Use when starting a new session, when agent output quality degrades, when switching between tasks, or when you need to configure rules files and context for a project.
documentation-and-adrs
Records decisions and documentation. Use when making architectural decisions, changing public APIs, shipping features, or when you need to record context that future engineers and agents will need to understand the codebase.