Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/t1mmen/srtd/requesting-code-reviewnpx skills add t1mmen/srtd --skill requesting-code-reviewgit clone --depth 1 https://github.com/t1mmen/srtdWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/t1mmen/srtd/requesting-code-review)<a href="https://agentmods.dev/skills/t1mmen/srtd/requesting-code-review"><img src="https://agentmods.dev/badge/skills/t1mmen/srtd/requesting-code-review.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00038 | $0.00710 |
| Opus 5 | $0.00019 | $0.00355 |
| Sonnet 5 | $0.00008 | $0.00142 |
| Haiku 4.5 | $0.00004 | $0.00071 |
Grade A, and why
requesting-code-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 109 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Requesting Code Review
Review early, review often. Catch issues before they compound across multiple changes.
When to Request Review
Mandatory
- After completing a feature or bug fix
- Before merging to main
- After significant refactoring
- When security-sensitive code is modified
Optional (But Recommended)
- When stuck on a design decision
- After complex debugging sessions
- Before deleting or deprecating code
How to Request Review
Step 1: Identify the Change Range
# Get the commits to review
git log --oneline main..HEAD
# Or specific commit range
BASE_SHA=$(git merge-base main HEAD)
HEAD_SHA=$(git rev-parse HEAD)
Step 2: Dispatch the Code Reviewer
Use the code-reviewer reference to conduct the review:
Review the changes from ${BASE_SHA} to ${HEAD_SHA}.
What was implemented: [brief description]
Requirements: [link to issue or spec]
See: .claude/skills/requesting-code-review/code-reviewer.md
Step 3: Address Feedback by Severity
| Severity | Action Required |
|---|---|
| Critical | STOP. Fix immediately before any other work. |
| Important | Fix before merging or proceeding to next task. |
| Minor | Note for later. Can merge with these outstanding. |
Responding to Feedback
When You Agree
Fix the issue, then request re-review of the fix.
When You Disagree
You may push back IF you have:
- Technical justification (not just preference)
- Evidence (code, tests, benchmarks)
- Clear explanation of trade-offs
Example: "I kept the nested structure because flattening would require N+1 queries. See benchmark in test/perf/nested-vs-flat.ts showing 3x slowdown."
SRTD-Specific Review Focus
When reviewing SRTD code, pay extra attention to:
Service Boundaries
- Is state mutation only in StateService?
- Is file I/O only in FileSystemService?
- Is database access only in DatabaseService?
State Machine Integrity
- Are template states transitioning correctly? (UNSEEN → CHANGED → APPLIED/BUILT → SYNCED)
- Is hash comparison working correctly?
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 109 lines · 38 tokens per session scan A b87c0a7f8a4a
requesting-code-review is a skill published in the GitHub repository t1mmen/srtd (105 stars, last pushed 7mo ago), licensed MIT. It adds 38 tokens to every session and 710 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
supabase
Use when doing ANY task involving Supabase: Database, Auth, Edge Functions, Realtime, Storage, Vectors, Cron, Queues, supabase-js, @supabase/ssr, RLS, schema migrations, CLI, MCP server. Includes security checklist.
d1-and-supabase-migrations
Use when applying Cloudflare D1 migrations, fighting Supabase migration history vs SQL execution, choosing direct psql over CLI, designing idempotent migrations, debugging schema drift between local and remote, or recovering after a half-applied migration. Triggers: supabase migration repair instructions appearing…
safe-sql-execution
Use whenever code will build, return, fetch, or execute SQL that runs against a user's real Postgres database — even when the request reads like an ordinary feature or bug fix and never says "security," "injection," or "SafeSqlFragment." This covers: writing or editing any pg-meta function, query builder, or endpoint…
studio-e2e-tests
Write and run Playwright E2E tests for Supabase Studio (e2e/studio). Use when asked to run e2e tests, write new E2E tests, or debug flaky or failing Playwright tests. Covers running commands, avoiding race conditions, waiting strategies, selectors, helper functions, and CI vs local differences.
studio-queries
React Query conventions for data fetching in Supabase Studio. Use when writing or reviewing query hooks, mutation hooks, or query keys in apps/studio/data/ — including adding the first fetch or mutation for a new API endpoint or resource. Covers queryOptions pattern, keys.ts structure, mutation hook template, and…
write-the-docs
Draft new or updated Supabase docs content for a feature or launch, grounded in product intent (Linear when available), a read of the actual code, and the docs style guide once one exists. Use when asked to write docs for a new feature, a product launch, or a Linear ticket that needs net-new content rather than a bug…