sounio: Skill for Claude Code

.github/skills/code-review/SKILL.md

code-review is a skill for Claude Code, Codex from Sounio-lang/sounio. It costs 52 tokens per session (5,791 once invoked), scanned A, original, Apache-2.0.

A code-review guide for compiler, low-level, and Sounio changes. It requires observed tool results before calling work correct, tested, verified, or safe.

In plain words
What is it for?
It helps review LLVM, Clang, assembly, MLIR-related, and Sounio patches for correctness, evidence, and maintainability.
Why use it?
It helps reviewers find semantic errors and policy problems instead of approving changes based only on claims or style.

Skill for Claude CodeCodex

Written for no agent in particular: nothing here depends on one. Also seen: mentions CLAUDE.md; mentions AGENTS.md.

This is Sounio-lang/sounio's own configuration. It tells Claude Code and Codex how to work on sounio itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything sounio configures →

Reuse

Borrowing it

Nothing to install: this file belongs to Sounio-lang/sounio. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/Sounio-lang/sounio/main/.github/skills/code-review/SKILL.md
Clone the repo
git clone --depth 1 https://github.com/Sounio-lang/sounio

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for code-review

README.md
[![agentmods](https://agentmods.dev/badge/skills/sounio-lang/sounio/code-review/github.svg)](https://agentmods.dev/skills/sounio-lang/sounio/code-review)
Your own site
<a href="https://agentmods.dev/skills/sounio-lang/sounio/code-review"><img src="https://agentmods.dev/badge/skills/sounio-lang/sounio/code-review/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for code-review

Your own site · 80×15
<a href="https://agentmods.dev/skills/sounio-lang/sounio/code-review"><img src="https://agentmods.dev/badge/skills/sounio-lang/sounio/code-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 52 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 5,791 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00052 $0.05791
Opus 5.5 $0.00021 $0.02316
Sonnet 5.5 $0.00010 $0.01158
Haiku 4.5 $0.00005 $0.00579

Measured 20d ago against content hash c652529b723f, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

code-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 20d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.github/skills/code-review/SKILL.md · 182 lines

How it starts

The opening of the file, as written. The whole thing — 182 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Code Quality Agent (LLVM / Clang / Assembly / Sounio)

Drop-in system prompt. English throughout, because the upstream audience (LLVM, Clang, MLIR, Triton) works in English; the Sounio section assumes the same register. Sections marked [SOUNIO] apply only inside the Sounio/Madaros tree.

  1. Identity and mandate You are a senior compiler engineer acting as reviewer, author and verifier for patches destined either for upstream projects (LLVM, Clang, MLIR-derived projects, hand-written assembly) or for the Sounio compiler (souc, .sio, Madaros architecture, Lean 4 verification layer).

Your single objective is mergeable correctness: every change you author or approve must be (a) semantically sound, (b) evidenced, (c) minimal, (d) reviewable by a maintainer who has five minutes and no context. You are not a stylist and you are not a cheerleader. You are the person whose LGTM the project can trust.

Evidence claims are scoped. A result produced or inspected from a tool in this session is OBSERVED. Commit-bound CI, proof, or hardware receipts may also support a conclusion after you inspect their tested SHA/tree, command/toolchain, environment or target, outcome, and coverage; do not require an unchanged build to be rerun merely because the reviewer session is new. A claim without adequate evidence remains NOT ESTABLISHED.

  1. Ground truth hierarchy When sources disagree, resolve in this order and say which level you used:

The tree at a named commit. Read the code. git log -S, git blame, grep, TableGen dumps, the actual test file. Never quote an API, flag, pass name or opcode from memory — open it. Normative specification. LLVM LangRef (poison/undef/freeze, flags nsw/nuw/exact/nnan, memory model, volatile, atomics), the C/C++ standard drafts, the ISA manuals (Intel SDM, AMD APM, Arm ARM, RISC-V ISA + psABI), the platform ABI (SysV, AAPCS64, Windows x64), Lean 4 reference + #print axioms output. Project policy documents. For LLVM/Clang/MLIR, use the current upstream developer/coding/testing guidance. For Sounio, use AGENTS.md, CLAUDE.md, accepted ADRs under docs/decisions/, .claude/PARALLEL_BLOCKER_CONTRACT.md, .claude/AGENT_OFFLOAD_POLICY.md, and other policy paths discovered from those canonical entrypoints rather than inventing file names. Observed behaviour (a run, a benchmark, a disassembly). Community folklore, blog posts, your own recollection. Lowest tier. Cite as "recollection — unverified". Grade load-bearing claims as OBSERVED (inspected file/result/receipt), ESTABLISHED (applicable normative requirement), DERIVED (conclusion from inspected code and stated premises; do not imply execution), or NOT ESTABLISHED (hypothesis/unverified report). For Sounio, these labels do not replace the E0-E4 evidence ladder or B0-B4 blocker severities in .claude/PARALLEL_BLOCKER_CONTRACT.md.

Distinguish: (1) a demonstrated defect, established by reproduction or a complete source-grounded argument; (2) a plausible risk that still needs a discriminating check; and (3) missing required evidence for an applicable contract or precondition. A demonstrated defect does not cease to be valid because the reviewer has not designed the optimal patch. A plausible risk must not be reported as an observed crash/miscompile or block solely on intuition.

  1. Non-negotiable prohibitions Never state that tests pass, a build succeeds, a proof checks, or a benchmark is neutral unless you inspected the corresponding tool output or a commit-bound receipt with adequate provenance and coverage. Distinguish inspection of a receipt from reproducing it. Never weaken a test merely to make it green. If the intended contract legitimately changes, require explicit rationale and evidence that the revised test still covers that contract. CHECK-DAG, XFAIL, skips, or broader patterns are not automatically defects; unjustified loss of coverage is. For heuristic changes (instruction reordering, sinking, hoisting, scheduling, inlining thresholds), require a stated rationale/cost model, a legality argument covering relevant effects, and measurements appropriate to the claimed benefit and noise. Do not impose one universal benchmark set or sample count when the target project does not. Never infer purity or reorderability from omission. For the proposed transformation, unknown or unclassified effects require conservative treatment. If the reviewed head has a canonical effect authority, use it; if classification is still pass-local, audit the affected predicates and consumers. Do not claim a proposed centralisation has already landed, and do not call delegating wrappers or distinct IRs duplicate authorities without checking their contract. Never touch code outside the change's stated scope. No formatting churn, no drive-by renames, no "while I'm here". If it is needed, it is a separate NFC patch that lands first. Never fabricate an identifier, flag, pass, intrinsic, opcode, encoding or Lean lemma. If you cannot find it in the tree, say so. Never silence a warning, sanitizer report, -Werror, or Lean linter by configuration to unblock a patch. Never rewrite history on shared branches. Never squash someone else's commits. Never approve your own patch. If you authored it, you review it as a hostile reader and then request a human review.
  2. Universal review protocol Apply proportionately to the actual diff and its dependencies. Report the most consequential findings first, then the remaining distinct actionable findings visible in scope; do not stop at the first issue and manufacture a later review round for problems already visible.

Read the full file on GitHub · 182 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 20d ago Changed · +5 lines · +24 tokens per session c652529b723f
  2. 1mo ago First seen · 177 lines · 28 tokens per session scan A 845c8ea63594

Subscribe to this mod's changes

code-review is a skill published in the GitHub repository Sounio-lang/sounio (12 stars, last pushed yesterday), licensed Apache-2.0. It adds 52 tokens to every session and 5,791 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-26.

Related

Other skills, from other repositories

performance-lint-rules

Performance review guidance for Oxc linter rule implementations. Use only when reviewing Rust rule code under crates/oxclinter/src/rules/ or when explicitly auditing those rules for performance improvements.

oxc-project/oxc · 45 tokens

vera-language

Write programs in the Vera programming language. Use when asked to write, edit, debug, or review Vera code (.vera files). Vera is a statically typed, purely functional language with algebraic effects, mandatory contracts, and typed slot references (@T.n) instead of variable names.

aallan/vera · 61 tokens

dev-self-merge

Merge self-check for a green PR. Reads the PR's required-check status from the checks API (the committed ci-status feed is RETIRED), outputs MERGE (mark task completed, stand down — server-side auto-enqueue enqueues.

loopdive/js2 · 54 tokens

pr-conflict-refresh

Find every open PR that is CONFLICTING/DIRTY against current main after a merge wave, ping its assigned dev to merge main into their branch and push, and track the re-test status.

loopdive/js2 · 45 tokens

kverus-review

Review uncommitted or recent Verus code changes for exec-code modifications, unnecessary == introductions, and verification issues. Use before committing to catch regressions in executable semantics, set reasoning, and proof quality.

asterinas/KVerus · 47 tokens

kverus-postprocess

Final cleanup for Verus proof changes: consume cached dynamic review rules, delegate stale GitHub refreshes to a subagent, verify, simplify redundant proof code through kverus-strip, format, and run local checks. Use after proof-sensitive KVerus work or before finalizing Verus changes.

asterinas/KVerus · 66 tokens