Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add rootbr/rooted --skill reviewing-javagit clone --depth 1 https://github.com/rootbr/rootedWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/rootbr/rooted/reviewing-java)<a href="https://agentmods.dev/skills/rootbr/rooted/reviewing-java"><img src="https://agentmods.dev/badge/skills/rootbr/rooted/reviewing-java/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/rootbr/rooted/reviewing-java"><img src="https://agentmods.dev/badge/skills/rootbr/rooted/reviewing-java.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00181 | $0.04735 |
| Opus 5.5 | $0.00072 | $0.01894 |
| Sonnet 5.5 | $0.00036 | $0.00947 |
| Haiku 4.5 | $0.00018 | $0.00473 |
Grade A, and why
reviewing-java scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 20d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directorieslowAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
description: Java code review — branches, PRs, diffs. Trigger on "review this branch", "find bugs", "what's wrong with this PR", "audit changes", "check diff", "review these Java changes", or any request to review Java c Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
How it starts
The opening of the file, as written. The whole thing — 227 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Java Reviewer
You orchestrate a Java code review and deliver verified findings. The rules live as atomic cards in references/review-cards/ — one checkable claim each, an openable source each; a deterministic pre-pass selects the cards a diff triggers and writes a dispatch plan; one Workflow runs a finder per (card by slice) plus a logic pass per slice, aggregates deterministically, and runs a skeptic per finding; a render script writes the two reports. Every finding cites concrete code from the diff — no anchor in the diff, no finding — and the skeptics exist to reject: the report carries only what survived refutation, the decision the design note under research/ at the repository root records.
Quick rules:
- One confirmation with the user, at the end of Scope; no other question unless every context source is empty.
- Read-only on the repository: the scripts write only under
review/and the finders and skeptics read; a tree that changed during the run is a compromised review, so the integrity check in Follow-ups is mandatory. - No stage runs on Fable; the tiers are
claude-opus-5-5athigh,xhighandmax. - The plan is never retyped:
scripts/bundle-run.pyembeds it, and the Workflow call namesreview/run.js. - Before committing a card, an agent prompt or this file:
scripts/validate-review-cards.pyon the corpus, then the audit (repository Quality Gate).
Phases: Scope → Context → Pre-pass → Workflow → Follow-ups → Report.
Runtime layout under the target repository's review/ (or the config-set report path for the two reports):
review/
├── plan.json # pre-pass output: inventory, card index, jobs, slices, candidates, project cards
├── plan.log # every merge, split, drop and skip the pre-pass performed
├── run.js # the workflow script with this run's arguments embedded (scripts/bundle-run.py)
├── findings.json # aggregated findings after the find stage (the cross-session checkpoint)
├── verdicts.json # findings with verdicts (and rulings) after the verify stage
├── java-review-<branch>.md # deliverable 1
└── java-review-<branch>-rejections.md # deliverable 2
Paths below are relative to this skill's directory unless they start with review/ (the target repository) or plugins/.
What ships with it
60 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- evals/evals.json 8.4 KB
- evals/expected.json 8.8 KB
- evals/fixture/base/.claude/reviewing-java/config.md 442 B
- evals/fixture/base/src/main/java/com/example/app/Cache.java 420 B
- evals/fixture/base/src/main/java/com/example/app/LogScanner.java 348 B
- evals/fixture/base/src/main/java/com/example/app/Repo.java 666 B
- evals/fixture/base/src/main/java/com/example/app/RequestContext.java 313 B
- evals/fixture/base/src/main/java/com/example/app/Stats.java 199 B
- evals/fixture/base/src/main/java/com/example/app/Totals.java 465 B
- evals/fixture/head/.claude/reviewing-java/config.md 1.0 KB
- evals/fixture/head/src/main/java/com/example/app/Cache.java 997 B
- evals/fixture/head/src/main/java/com/example/app/Formatter.java 1.5 KB
- evals/fixture/head/src/main/java/com/example/app/LogScanner.java 633 B
- evals/fixture/head/src/main/java/com/example/app/OrderService.java 1.3 KB
- evals/fixture/head/src/main/java/com/example/app/Repo.java 1.4 KB
- evals/fixture/head/src/main/java/com/example/app/RequestContext.java 626 B
- evals/fixture/head/src/main/java/com/example/app/Stats.java 567 B
- evals/fixture/head/src/main/java/com/example/app/Totals.java 1.3 KB
- evals/fixture/head/src/main/java/com/example/app/UserLookup.java 2.2 KB
- evals/fixture/make-fixture.sh 1.0 KB runs code
- evals/grade.py 4.3 KB runs code
- evals/runs/2026-09-25-extended-fixture-rejections.md 2.4 KB
- evals/runs/2026-09-25-extended-fixture-review.md 67 KB
- README.md 6.8 KB
- references/gotchas.md 5.9 KB
- references/java-invariants-review-checklist.md 20 KB
- references/maintenance.md 1.7 KB
- references/pending-evidence.md 26 KB
- references/report-format.md 2.3 KB
- references/review-cards-provenance.md 317 KB
- references/review-cards-taxonomy.md 9.8 KB
- references/review-cards/cc-01--a-shared-field-is-volatile-atomic-final-or-lock-guarded.md 4.5 KB
- references/review-cards/cc-02--a-non-final-static-field-is-volatile-atomic-or-written-and-read-under-one-lock.md 3.6 KB
- references/review-cards/cc-03--a-lock-region-contains-no-call-that-can-block-on-io-a-remote-service-or-another-task.md 3.7 KB
- references/review-cards/cc-04--a-compound-operation-on-lock-guarded-state-runs-inside-one-lock-region.md 4.1 KB
- references/review-cards/cc-05--a-synchronized-block-locks-a-private-final-field-never-this-a-class-or-a-reassignable-field.md 5.0 KB
- references/review-cards/cc-06--nested-lock-acquisitions-take-their-locks-in-one-global-order-on-every-path.md 3.8 KB
- references/review-cards/cc-07--a-lock-is-acquired-before-the-try-block-and-released-in-its-finally.md 3.6 KB
- references/review-cards/cc-08--check-then-act-on-a-concurrent-map-is-one-compute-call.md 3.4 KB
- references/review-cards/cc-09--read-modify-write-on-a-shared-field-is-an-atomic-operation.md 3.8 KB
- references/review-cards/cc-10--two-fields-that-must-change-together-are-updated-in-one-lock-region-or-as-one-snapshot.md 4.2 KB
- references/review-cards/cc-11--a-compute-function-never-touches-the-same-concurrent-map.md 3.7 KB
- references/review-cards/cc-12--a-long-or-double-field-shared-between-threads-is-volatile-atomic-or-lock-guarded.md 3.8 KB
- references/review-cards/cc-13--double-checked-lazy-initialization-uses-a-volatile-field-read-once-into-a-local-or-a-holder-class.md 4.1 KB
- references/review-cards/cc-14--a-class-shared-without-synchronization-declares-every-field-final-and-exposes-no-mutable-state.md 4.1 KB
- references/review-cards/cc-15--a-constructor-does-not-let-this-escape-before-it-returns.md 3.7 KB
- references/review-cards/cc-16--a-shared-collection-is-exposed-as-an-unmodifiable-view-or-a-copy-and-not-modified-after-publication.md 4.3 KB
- references/review-cards/cc-17--a-shared-field-never-holds-a-type-whose-javadoc-says-it-is-not-synchronized.md 4.9 KB
- references/review-cards/cc-18--a-servlet-controller-or-singleton-bean-holds-no-mutable-instance-field.md 4.5 KB
- references/review-cards/cc-19--every-executorservice-the-code-creates-is-shut-down-by-its-owner.md 4.7 KB
- references/review-cards/cc-20--after-shutdown-the-result-of-awaittermination-is-checked-and-false-escalates-to-shutdownnow.md 3.9 KB
- references/review-cards/cc-21--an-executor-that-accepts-production-load-bounds-threads-and-queue.md 4.6 KB
- references/review-cards/cc-22--an-interruptedexception-is-rethrown-or-the-interrupt-status-is-restored.md 4.0 KB
- references/review-cards/cc-23--a-cancellable-task-honors-the-interrupt-by-polling-the-status-in-cpu-bound-loops.md 4.1 KB
- references/review-cards/cc-24--parallel-stream-lambda-touches-no-shared-mutable-state.md 4.8 KB
- references/review-cards/cc-25--custom-collector-combiner-is-associative.md 4.0 KB
- references/review-cards/cc-26--parallel-stream-performs-no-blocking-io.md 4.9 KB
- references/review-cards/cc-27--stampedlock-optimistic-read-is-validated-before-use.md 4.3 KB
- references/review-cards/cc-28--cas-on-a-recyclable-reference-carries-a-stamp.md 4.8 KB
- references/review-cards/cc-29--virtual-threads-are-never-pooled.md 3.9 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 20d ago Changed · -200 lines · +29 tokens per session ff8f971f6c4a
- 1mo ago First seen · 427 lines · 152 tokens per session scan A 86a3b1b11965
reviewing-java is a skill published in the GitHub repository rootbr/rooted (21 stars, last pushed 2d ago), licensed Apache-2.0. It adds 181 tokens to every session and 4,735 once invoked, about $0.0007 per session on Opus 5.5. A static security scan graded it A with 1 finding (reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
solid-principles
SOLID principles checklist with Java examples. Use when a class has too many responsibilities, an abstraction leaks, or a dependency points the wrong way, and when the user asks about Single Responsibility, Open/Closed, Liskov, Interface Segregation or Dependency Inversion. For naming, duplication and method length…
concurrency-review
Review Java concurrency code for thread safety, race conditions, deadlocks, and modern patterns (Virtual Threads, CompletableFuture, @Async). Use when user asks "check thread safety", "concurrency review", "async code review", or when reviewing multi-threaded code.
java-code-review
Systematic code review for Java with null safety, exception handling, concurrency, and performance checks. Use when user says "review code", "check this PR", "code review", or before merging changes.
814-regulations-iso-25010
Use when reviewing, designing, or modifying Java enterprise systems and need a structured, repeatable ISO/IEC 25010:2023 quality-attribute review covering Functional Suitability, Performance Efficiency, Compatibility, Interaction Capability, Reliability, Security, Maintainability, Flexibility, and Safety, producing an…
121-java-object-oriented-design
Use when reviewing, improving, or refactoring Java object-oriented design, including applying SOLID, DRY, or YAGNI; improving classes and interfaces; correcting encapsulation, inheritance, or polymorphism; resolving God Class, Feature Envy, or Data Clumps; and improving object creation, methods, or exception…
053-design-simple-rules
Use when Java design, refactoring, or implementation tradeoffs should be evaluated with Kent Beck's simple design rules, including passes the tests, reveals intention, has no duplication, and has the fewest elements. This should trigger for requests such as Apply simple design rules; Review this design with Beck's…