Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/sammcj/agentic-coding/self-reviewnpx skills add sammcj/agentic-coding --skill self-reviewgit clone --depth 1 https://github.com/sammcj/agentic-codingWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/sammcj/agentic-coding/self-review)<a href="https://agentmods.dev/skills/sammcj/agentic-coding/self-review"><img src="https://agentmods.dev/badge/skills/sammcj/agentic-coding/self-review.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00024 | $0.00608 |
| Opus 5 | $0.00012 | $0.00304 |
| Sonnet 5 | $0.00005 | $0.00122 |
| Haiku 4.5 | $0.00002 | $0.00061 |
Grade A, and why
self-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 38 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Critically review your recent changes and fix any issues you find. Choose one of the two paths below, based on the size of the change. When in doubt, delegate - the cost is low and the unbiased read is the point.
Option A: Review it yourself (small or simple changes)
For a single file, or one focused fix or feature: Re-read what you changed with a sceptical eye - correctness, completeness, regressions, over-engineering, unwarranted verbosity.
Then fix what you find directly.
Option B: Delegate to the reviewer (larger changes)
For changes spanning multiple files, features, or fixes: Delegate to the critical-reviewer subagent(s) for a fresh, unbiased read, then act on what they report.
- A fresh reviewer catches what you've talked yourself into, and keeps the review reasoning out of your context.
- The reviewer is read-only and returns prioritised findings (each with a severity and a
file:linelocation); you triage by severity and apply the fixes.
When you delegate:
- Provide a high signal brief. The agent operates outside of this conversation's context. Give it: the list of changed files (names only, e.g.
git diff --name-only), the task you were originally asked to do and what was in / out of scope, and anything intentional that looks wrong but isn't. - Parallelise only on independent slices. Spawn one reviewer per group of changes that don't interact (by subsystem, layer, or requirement), and give each an explicit boundary - the files or area it owns - so they don't overlap. When slices share an interface or contract, brief at least one reviewer on both sides, or use a single reviewer - a fresh reviewer that sees only one side can't catch the interaction. Don't split for its own sake.
- Stay fresh by default. A fresh reviewer gives the unbiased read that makes self-review worth doing. Fork only if the review genuinely needs this conversation's nuance; never fork it for the adversarial read, since a fork inherits this agent's bias and defeats the point.
- Write the brief in terse notes. Keywords and bullets, not full prose; the reviewer is a capable model, not an audience.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 38 lines · 24 tokens per session scan A 6298a58e32bc
self-review is a skill published in the GitHub repository sammcj/agentic-coding (159 stars, last pushed today), licensed Apache-2.0. It adds 24 tokens to every session and 608 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
Canvas Skill
Present interactive HTML, visualizations, dashboards, and generated interfaces on connected Cybara nodes.
api-debug
Debug REST, GraphQL, webhook, and OAuth/API-key integrations with layered request, auth, schema, and response checks.
code-wiki
Generate architecture wiki docs, module maps, and Mermaid diagrams for a codebase using Cybara file/search/write tools.
comfyui
Drive ComfyUI (local Stable Diffusion / image-gen pipeline) via its HTTP API to generate and edit images. Use when the user has ComfyUI running and wants image generation/upscale/img2img workflows.
mactop
Retrieve real-time hardware metrics from Apple Silicon Macs using mactop. Provides CPU, RAM, GPU, power, thermal, network, disk I/O, and Thunderbolt bus information. Use when the user wants system stats, hardware monitoring, or performance metrics on Apple Silicon Macs.
huggingface-jobs
Plan, launch, inspect, monitor, and cancel authenticated Hugging Face Jobs for CPU, GPU, TPU, batch, inference, and data workloads.