Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Stanshy/AgentHub --skill sop-reviewgit clone --depth 1 https://github.com/Stanshy/AgentHubWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/stanshy/agenthub/sop-review)<a href="https://agentmods.dev/skills/stanshy/agenthub/sop-review"><img src="https://agentmods.dev/badge/skills/stanshy/agenthub/sop-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/stanshy/agenthub/sop-review"><img src="https://agentmods.dev/badge/skills/stanshy/agenthub/sop-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00029 | $0.01185 |
| Opus 5 | $0.00015 | $0.00593 |
| Sonnet 5 | $0.00006 | $0.00237 |
| Haiku 4.5 | $0.00003 | $0.00119 |
Grade A, and why
sop-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
L1 Code Review SOP
L1 審核任務時,必須依序完成以下所有步驟,不得跳過任何 ⛔ CHECKPOINT。
使用方式
/sop-review <task-id>
參數
$0: 任務 ID(如T3)
執行步驟
⛔ STEP 1 — 載入任務
找到任務檔案:使用 Glob tool 搜尋 .tasks/**/$0-*.md,若無結果再搜尋 .tasks/**/$0.md,用 Read tool 讀取。
確認並記錄:
- 任務描述與目標
- 驗收標準清單(逐項列出)
- 指派對象(確認是正確的 L2)
- 完工時間(確認事件紀錄有記錄)
✋ 確認任務內容清楚後再繼續。
⛔ STEP 2 — 載入審查規範
必讀:
.knowledge/coding-standards.md(或.knowledge/company/standards/coding-standards.md)
依任務類型額外讀取:
| 任務類型 | 必讀規範 |
|---|---|
| 後端 / API | .knowledge/specs/api-design.md + .knowledge/specs/data-model.md |
| 前端 / UI | .knowledge/specs/feature-spec.md |
| 全端 | 以上全部 |
輸出:
📋 審查規範載入完成
- coding-standards ✅
- [對應規範] ✅
審查重點(從規範中提取):
- [與本任務相關的規範條目]
✋ 確認規範已讀、審查重點已列出後再繼續。
⛔ STEP 2.5 — 取得變更範圍(Git Diff)
讀取任務檔的 | 並行組 | 欄位:
若並行任務(並行組 = A/B/C...):
- 先同步最新 sprint:
若有衝突 → 停止,通知 L2 解決衝突後重新提交git checkout task/s{N}-$0-{slug} git merge sprint-{N} - 取得 diff:
輸出:git diff sprint-{N}...task/s{N}-$0-{slug}📂 本次變更範圍(並行任務) 異動檔案:[列出] 新增行數:N | 刪除行數:N
若循序任務(並行組 = —):
git show HEAD
輸出:
📂 本次變更範圍(循序任務,最新 commit)
Commit:{hash} {message}
異動檔案:[列出]
以此 diff / show 結果作為 STEP 3 Review 的主要審查依據。
✋ 確認已取得變更範圍後再繼續。
⛔ STEP 3 — 執行 Code Review
執行 /review(讀取 .claude/commands/review.md 並依步驟執行)
Review 必須逐項對照:
- 驗收標準 — 每個
- [x]是否確實完成 - 規範條目 — 程式碼是否符合已載入的規範
- postmortem 地雷 — 是否有重蹈覆轍
✋ Review 報告完成後再繼續。
⛔ STEP 4 — 審核決策
通過 — 所有驗收標準與規範均符合:
→ 執行 /task-approve $0 {備註}(讀取 .claude/commands/task-approve.md)
退回 — 有不符合項目:
→ 執行 /task-status $0 rejected {具體說明哪些項目不通過、需要修改什麼}
→ 通知 L2 重新執行 /sop-execute $0
✋ 決策必須明確,不得含糊帶過。
STEP 5 — 輸出審核結果
[✅ 通過 / ❌ 退回] $0 審核完成
審核結果:[通過 / 退回]
驗收標準對照:[全部通過 / {列出未通過項目}]
規範對照:[符合 / {列出違規項目}]
備註:{說明}
[若通過] 下一步:PM 執行 /pm-review
[若退回] 下一步:L2 修正後重新執行 /sop-execute $0
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 138 lines · 29 tokens per session scan A f36b8c8dcf27
sop-review is a skill published in the GitHub repository Stanshy/AgentHub (201 stars, last pushed 5mo ago), licensed MIT. It adds 29 tokens to every session and 1,185 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
pr-triage
4-phase PR backlog management with audit, deep code review, validated comments, and optional worktree setup. Use when triaging pull requests, catching up on pending code reviews, or managing a backlog of open PRs. Args: 'all' to review all, PR numbers to focus (e.g. '42 57'), 'en'/'fr' for language, no arg = audit…
audit-agents-skills
Audit Claude Code agents, skills, and commands for quality and production readiness. Use when evaluating skill quality, checking production readiness scores, or comparing agents against best-practice templates.
review-pr
Perform a comprehensive code review of a pull request.
validate-changes
Evaluate staged changes using LLM-as-a-Judge before committing.
solo-review
Use when "review code", "quality check", "is it ready to ship", "final review", or after /build or /deploy completes. Do NOT use for planning (/plan) or building (/build).
open-code-review
Use Alibaba Open Code Review (ocr) to review git diffs, staged changes, branches, or scan a workspace, then summarize findings and optionally fix high-confidence issues.