Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/srnichols/plan-forge/code-reviewnpx skills add srnichols/plan-forge --skill code-reviewgit clone --depth 1 https://github.com/srnichols/plan-forgeWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00070 | $0.02842 |
| Opus 5 | $0.00035 | $0.01421 |
| Sonnet 5 | $0.00014 | $0.00568 |
| Haiku 4.5 | $0.00007 | $0.00284 |
Grade A, and why
code-review scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Runs shell commandslowCapability
Expected in a hook, worth knowing in a rule or an instructions file.
- Plan-Forge-specific: dual-shell parity (every PowerShell entry point has a matching Bash one), no sync `child_process` in the orchestrator hot path, `path.join(...)` everywhere (no hardcoded `\` or `/`) How it starts
The opening of the file, as written. The whole thing — 184 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Code Review Skill — Plan Forge
Run
/clean-code-reviewFIRST. That skill is the mechanical/quantitative pass: 44 CHECKS across 11 languages (JS/TS, Python, .NET, Java/Kotlin, Go, Rust, PHP, Swift, Ruby, PowerShell, Bicep) — module size, function complexity, parameter counts, duplication (jscpd + literal/regex scanners), engineering hygiene (empty catches, magic numbers, dead imports, TODO/FIXME, hardcoded secrets, SQL-injection, command-injection patterns), shell-parity (PS/Bash twins), enums-drift (pforge-mcp/enums.mjs), cross-package dependency boundaries, and ESLint. This skill is the qualitative/judgment pass. Mechanical findings clear the noise so this review can focus on what actually requires judgment.
Trigger
"Review my code" / "Run code review" / "Check before merge" / "Code review --quorum"
Steps
0. Forge Analysis
Use the forge_analyze MCP tool with the current plan (if available) to get a structured consistency score. Use the forge_diff MCP tool to detect scope drift and forbidden file edits.
If --quorum was specified: Use forge_analyze with quorum: true to dispatch multi-model analysis. Each changed file is independently reviewed by multiple AI models, and findings are synthesized with consensus confidence levels.
1. Identify Changed Files
# What changed since the merge-base with planning/main?
git diff --name-only origin/planning/main...HEAD
# Or since last commit
git diff --name-only HEAD~1
2. Public Surface Diff (consumer impact)
node scripts/audit/surface-diff.mjs
node scripts/audit/surface-diff.mjs --base origin/master
Parse docs/plans/cleanup-findings/raw/surface-diff-report.json. Three layers are diffed against the merge-base:
| Layer | Source | What's compared |
|---|---|---|
| Module exports | every .mjs outside tests/ |
added/removed named exports |
| MCP tools | pforge-mcp/server.mjs TOOLS array |
added/removed tool names + inputSchema property keys |
| CLI commands | pforge.ps1, pforge.sh |
added/removed top-level dispatch branches |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 184 lines · 70 tokens per session scan A 3d800cf9a6c3
code-review is a skill published in the GitHub repository srnichols/plan-forge (5 stars, last pushed 22d ago), licensed MIT. It adds 70 tokens to every session and 2,842 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 1 finding (runs shell commands). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
aspire
Build, upgrade, and operate Aspire 13.5.x C# or TypeScript application hosts with the current CLI, AppHost, ServiceDefaults, integrations, dashboard, testing, MCP, and deployment patterns for distributed apps. USE FOR: Aspire.AppHost.Sdk, Aspire.Hosting., DistributedApplication.CreateBuilder, apphost.mts…
microsoft-agent-framework
Build .NET AI agents, harnesses, and multi-agent workflows with Microsoft Agent Framework using the right agent type, sessions, tools, workflows, hosting protocols, and enterprise guardrails. USE FOR: building or reviewing .NET code that uses Microsoft.Agents., Microsoft.Extensions.AI, AIAgent, HarnessAgent…
signalr
Implement or review SignalR hubs, streaming, reconnection, transport, and real-time delivery patterns in ASP.NET Core applications. USE FOR: building chat, notification, collaboration, or live-update features; debugging hub lifetime, connection state, or transport issues; deciding whether SignalR or another. DO NOT…
wpf
Build and modernize WPF applications on .NET with correct XAML, data binding, commands, threading, styling, and Windows desktop migration decisions. USE FOR: working on WPF UI, MVVM, binding, commands, or desktop modernization; migrating WPF from .NET Framework to .NET; integrating newer Windows capabilities into a…
worker-services
Build long-running .NET background services with BackgroundService, Generic Host, graceful shutdown, configuration, logging, and deployment patterns suited to workers and daemons. USE FOR: background services; scheduled workers; hosted services; worker extraction; graceful shutdown, health checks, and service hosting…
azure-functions
Build, review, or migrate Azure Functions in .NET with correct execution model, isolated worker setup, bindings, DI, and Durable Functions patterns. USE FOR: working on Azure Functions in .NET; migrating from the in-process model to the isolated worker model; adding Durable Functions, bindings, or host configuration.…