Borrowing it
Nothing to install: this file belongs to sunnykgupta/AI-Helpers. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/sunnykgupta/AI-Helpers/main/.opencode/skills/codereview/SKILL.mdgit clone --depth 1 https://github.com/sunnykgupta/AI-HelpersWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/sunnykgupta/ai-helpers/codereview)<a href="https://agentmods.dev/skills/sunnykgupta/ai-helpers/codereview"><img src="https://agentmods.dev/badge/skills/sunnykgupta/ai-helpers/codereview.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00059 | $0.00596 |
| Opus 5 | $0.00030 | $0.00298 |
| Sonnet 5 | $0.00012 | $0.00119 |
| Haiku 4.5 | $0.00006 | $0.00060 |
Grade A, and why
codereview scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 86 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Code Review Skill
Perform a comprehensive code review including static analysis and tests.
Workflow
- Identify the scope — Determine which files/changes to review
- Run linting — Execute the lint command and parse output
- Run typecheck — Execute type checking and parse output
- Run tests — Execute relevant tests and parse output
- Analyze code — Read the changed files for logic issues, security concerns, performance problems
- Summarize findings — Group issues by severity (critical/warning/suggestion)
Commands to Run
Always run these commands non-interactively:
# Lint (adjust command to match project)
npm run lint # or: ruff check . / golangci-lint run / etc.
# Type-check
npm run typecheck # or: mypy . / tsc --noEmit
# Tests (target the affected module)
npm test # or: pytest / go test ./...
If a project does not have one of these commands, skip that step.
Issue Categories
Critical
- Security vulnerabilities (SQL injection, XSS, exposed secrets)
- Authentication/authorization bugs
- Data corruption risks
- Unhandled error paths that could crash
Warnings
- Code smells (duplication, complex functions, unclear naming)
- Performance concerns (N+1 queries, unnecessary allocations)
- Missing error handling
- Type safety issues
Suggestions
- Code style deviations from project conventions
- Missing documentation on public APIs
- Opportunities for abstraction/DRY
- Test coverage gaps (only if the task explicitly requires testing)
Output Format
## Code Review Summary
### Critical Issues
- [file:line] Description of the issue and suggested fix
### Warnings
- [file:line] Description of the issue and suggested fix
### Suggestions
- [file:line] Description of the suggestion
### Test Results
- Lint: PASS/FAIL (summary of errors)
- Typecheck: PASS/FAIL (summary of errors)
- Tests: PASS/FAIL (summary of failures)
### Files Reviewed
- List of files that were analyzed
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 86 lines · 59 tokens per session scan A b0c3458dfe38
codereview is a skill published in the GitHub repository sunnykgupta/AI-Helpers (70 stars, last pushed 1mo ago), licensed MIT. It adds 59 tokens to every session and 596 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
test-conversion-reviewer
Reviewer for converting unit tests to browser tests for Project Bedrock. Invoke this when the user needs to review their work while removing complex Browser dependencies from tests.
full-stack-e2e-review
Run a rigorous end-to-end product or feature review across architecture, data, APIs, permissions, billing, tests, and real browser UX. Use for requests such as review this branch end to end, test everything, ensure no bugs, perform a full visual pass, or validate a multi-user workflow before merge or deploy.
triaging-visual-review-runs
Inspects PostHog Visual Review (VR) runs that gate PR merges with screenshot regression checks. Use when the user mentions "visual review", "VR", "snapshot diff", "screenshot test", "storybook regression", "playwright snapshot", asks why a PR is blocked or what changed visually, wants to triage the VR backlog, decide…
simulate-agents
Run Mock User and Auditor agents against a feature in fresh contexts before human review. Use after verify-work, before request-review, when user wants pre-review simulation.
review
Review Playwright tests for quality. Use when user says "review tests", "check test quality", "audit tests", "improve tests", "test code review", or "playwright best practices check".
e2e-reviewer
Use when reviewing Playwright or Cypress E2E specs, Page Objects (POM), PRs, pull requests, patches, diffs, or changed test files — asked to review tests, audit test quality, or find weak, flaky, or silently-passing tests; when tests pass CI but prove nothing or miss bugs; when auditing missing awaits, vacuous or…