Borrowing it
Nothing to install: this file belongs to rshade/finfocus. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/rshade/finfocus/main/.github/skills/code-review/SKILL.mdgit clone --depth 1 https://github.com/rshade/finfocusWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/rshade/finfocus/code-review)<a href="https://agentmods.dev/skills/rshade/finfocus/code-review"><img src="https://agentmods.dev/badge/skills/rshade/finfocus/code-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/rshade/finfocus/code-review"><img src="https://agentmods.dev/badge/skills/rshade/finfocus/code-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00057 | $0.03476 |
| Opus 5.5 | $0.00023 | $0.01390 |
| Sonnet 5.5 | $0.00011 | $0.00695 |
| Haiku 4.5 | $0.00006 | $0.00348 |
Grade A, and why
code-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 275 lines — stays where its author put it; the contents beside it link to each section on GitHub.
FinFocus Code Review
Use this skill when reviewing a pull request in this repository. General
conventions (build commands, testify, RunE, error wrapping, import order) are
in .github/copilot-instructions.md and .github/instructions/. This file
lists the project invariants that break silently, so a review should check
them explicitly.
Do not rely on a tool or Go version quoted in any prose file, including this
one. mise.toml pins every tool version (Go, golangci-lint, markdownlint,
actionlint, shellcheck) and go.mod holds the Go and finfocus-spec versions.
Read them from there, and flag a PR that changes a pin in one place but not
the files that mise.toml says must change with it.
Review Order and Severity
Review in this order, and label each comment with its severity:
- CRITICAL (block merge): secret or credential exposure, wrong cost output, corrupted output on stdout, data loss in the cache or history databases, broken plugin protocol compatibility.
- IMPORTANT (needs discussion): missing tests for a new path, a broken project invariant from this file, a mismatch with the linked issue or spec.
- SUGGESTION (non-blocking): simplification, naming, docs.
Use this comment shape:
**[SEVERITY] Area: short title**
What breaks, for which input or state.
**Suggested fix:** the smallest change, with code when it helps.
**Reference:** the rule in this skill, CLAUDE.md, or the spec.
How to Comment
- Report a defect only with a concrete failure scenario: the input or state, and the wrong output, leak, or crash it produces.
- Comment only on problems the PR introduces or makes reachable. Group findings that share one cause into one comment.
- Do not comment on formatting, import order, or anything golangci-lint, markdownlint, or actionlint already enforces.
- Passing CI is not evidence of correctness. Many rules below are not checked by any test.
- Do not flag a convention below as a bug when the code follows it on purpose. Several conventions look like errors at first glance (see "Intentional Conventions").
specs/**is planning material. Review it only for contradictions with the code in the same PR.CHANGELOG.mdis generated by release-please. Flag hand edits to it.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago Changed 5b5c2c9c6ba6
- 16d ago Changed · +8 lines 2f921cea089e
- 18d ago First seen · 267 lines · 57 tokens per session scan A dec302b7a225
code-review is a skill published in the GitHub repository rshade/finfocus (10 stars, last pushed 2d ago), licensed Apache-2.0. It adds 57 tokens to every session and 3,476 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-06.
Other skills, from other repositories
prowler-compliance-review
Reviews Pull Requests that add or modify compliance frameworks. Trigger: When reviewing PRs with compliance framework changes, CIS/NIST/PCI-DSS additions, or compliance JSON files.
prowler-pr
Creates Pull Requests for Prowler following the project template and conventions. Trigger: When working on pull request requirements or creation (PR template sections, PR title Conventional Commits check, changelog gate/no-changelog label), or when inspecting PR-related GitHub workflows like conventional-commit.yml…
pr-review
Automated code review using ReadLints and Shell for technical validation.
pr-threshold
Track commit accumulation and trigger PR when thresholds crossed.
compliance-audit
Audit Value Delivery compliance after PR push.
code-review
Review code changes against hard rules and conventions.