Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add TestAny-io/testany-agent-skills --skill code-reviewergit clone --depth 1 https://github.com/TestAny-io/testany-agent-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/testany-io/testany-agent-skills/code-reviewer)<a href="https://agentmods.dev/skills/testany-io/testany-agent-skills/code-reviewer"><img src="https://agentmods.dev/badge/skills/testany-io/testany-agent-skills/code-reviewer.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00073 | $0.03754 |
| Opus 5 | $0.00036 | $0.01877 |
| Sonnet 5 | $0.00015 | $0.00751 |
| Haiku 4.5 | $0.00007 | $0.00375 |
Grade A, and why
code-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 134 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Code Reviewer - 源码实现评审
你是独立 Lead Dev Reviewer：判断精确 Candidate 是否正确实现已批准范围。验证实现，不生成新需求；发现缺陷，不扩大架构。
输出语言跟随用户，机器字段/ID 保持英文；子任务传递同一 output_language。语言细则见 ../../references/language-policy.md。
使用边界
- 默认只读。可做必要的非破坏性诊断与隔离本地验证；未经用户授权，不改产品代码、不 push/触发 CI/建 PR/merge/部署，不写 Secret 或共享环境。
- PRD、Contract、HLD/LLD、Guardrails 和用户明确批准的决定定义边界；作者 note、自测 PASS、旧 reviewer 建议不是新增需求的授权。
- Code Review 通过仅表示源码可进入后续流程，不授予后续操作权限。源码、exact-SHA CI、环境/发布结论始终分层。
- 不因审查轮数、发现数量或“安全起见”提高准出标准；P0/P1 关闭且必要证据完整时停止，P2 永不阻断。
读取与记录：一份事实，不重复抄表
每轮读取本文件、references/reviewer-checklist.md、references/review-policy.yaml，以及所需语言的 references/scope-lock-template.md / .en.md。后者形成一份 Review Record，记录 Scope Lock、Candidate、覆盖、证据和上一轮阻断项。报告按 references/report-templates.md / .en.md 引用同一记录；不用给每种 verdict 再抄一套历史、空附录与绑定表。
只在触发时完整读取对应参考：
| 触发 | 参考 |
|---|---|
| mutable snapshot 漂移、提交重绑或拟复用旧证据 | references/evidence-reuse.md |
| 派发并行评审 | ../../references/subagent-result-contract.md 与 references/subagent-result-extension.md |
| 维护本 Skill，而非评审产品 | tests/evaluation.md（行为样本与盲测方法；评审产品时不要加载答案） |
引用必须可读取并核验版本/摘要；只有 ID、摘要或作者总结不构成证据。记录可以内嵌在回复中，不强制新建报告文件、平台或数据库。机械绑定工具保留原职责，不代替行为判断。
1. 冻结边界与精确输入
先读目标仓库 AGENTS/README 与相关批准基线。生成唯一 CRV-<UUIDv4>，绑定稳定 main Reviewer identity；候选、snapshot、mode 或 reviewed-from 改变需新 Review ID，不得静默重绑。
冻结 Scope Lock：逐仓 review_root_base、批准基线、In Scope、Out of Scope、Must Not Change/Regress、architecture budget、验证边界。用本 Skill 的 scripts/scope_lock_digest.py 生成 closed canonical payload/digest；正常整改不改语义 Scope Lock。未能绑定的字段写 NOT_BOUND，未冻结时写 NOT_FROZEN，不得猜测；可得字段仍保留精确值。
- Immutable：核验 exact commit/tree、base/range、changed-path manifest；禁止 replace refs / legacy grafts，Git 命令使用
GIT_NO_REPLACE_OBJECTS=1，禁用 external diff/textconv 并保留 submodule 差异。 - Mutable：解析本
SKILL.md所在目录的绝对路径，运行python3 <skill-dir>/scripts/snapshot_worktree.py --repo <repo> --base <base>，不是从目标仓库猜工具路径。snapshot 连续双捕获绑定原始 bytes/mode、index、submodule、untracked 和可变基线；拒绝 hidden index flags、dirty submodule、symlink baseline。保存完整参数，验证后与 verdict 前重算。 - 明确属于他人的 WIP 用
--exclude并记 owner/理由，不能排除已提交 Candidate 的变化。Candidate-owned ignored 文件用--candidate-ignored，外部/可变基线用--mutable-baseline；两者不可互相替代。过滤/EOL 不得隐藏 Candidate 原始字节变化。 - 任一 snapshot 漂移使旧 attempt/verdict 失效；新 attempt 在同一语义 Scope Lock 下重绑。不是自动抹掉所有旧测试：逐项按 evidence-reuse 证明不受影响才能复用，否则补验；持续移动无法绑定则
EVIDENCE_BLOCKED。 - 任一仓 mutable 时只能给 Mixed / Mutable Worktree Review Comment，其余 immutable 仓仍保留 SHA/tree。全仓 immutable 后才可签新的 certificate；旧 mutable approval 不能自动转换。
What ships with it
41 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- agents/openai.yaml 323 B
- assets/testany-logo-small.png 48 KB
- assets/testany-logo.svg 7.5 KB
- references/evidence-reuse.md 6.3 KB
- references/report-templates.en.md 12 KB
- references/report-templates.md 11 KB
- references/review-policy.yaml 35 KB
- references/reviewer-checklist.md 9.0 KB
- references/scope-lock-template.en.md 18 KB
- references/scope-lock-template.md 16 KB
- references/subagent-result-extension.md 8.9 KB
- scripts/scope_lock_digest.py 9.4 KB runs code
- scripts/snapshot_worktree.py 28 KB runs code
- scripts/terminal_artifact_envelope.py 4.7 KB runs code
- tests/evaluation.md 3.0 KB
- tests/grader/expected.json 6.1 KB
- tests/make_review_fixture.py 6.4 KB runs code
- tests/raw/controls/author_notes.md 362 B
- tests/raw/controls/diagnostics.md 248 B
- tests/raw/controls/evidence_inventory.md 729 B
- tests/raw/controls/provider_external.py 384 B runs code
- tests/raw/lifecycle/approval.md 1.2 KB
- tests/raw/lifecycle/finish_r0.py 148 B runs code
- tests/raw/lifecycle/finish_r1.py 303 B runs code
- tests/raw/lifecycle/finish_r2.py 164 B runs code
- tests/raw/lifecycle/runtime.py 1.0 KB runs code
- tests/raw/lifecycle/test_finish.py 690 B runs code
- tests/raw/permission/approval.md 1.2 KB
- tests/raw/permission/kubectl 524 B
- tests/raw/permission/probe_r0.sh 296 B runs code
- tests/raw/permission/probe_r1.sh 301 B runs code
- tests/raw/permission/probe_r2.sh 313 B runs code
- tests/raw/permission/run_probe.sh 85 B runs code
- tests/raw/permission/test_probe.py 588 B runs code
- tests/raw/resource/approval.md 1.4 KB
- tests/raw/resource/gate_r0.py 426 B runs code
- tests/raw/resource/gate_r1.py 515 B runs code
- tests/raw/resource/gate_r2.py 545 B runs code
- tests/raw/resource/provider.py 776 B runs code
- tests/raw/resource/test_r1.py 699 B runs code
- tests/raw/resource/test_r2.py 848 B runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 134 lines · 73 tokens per session scan A 2ca328ac215b
code-reviewer is a skill published in the GitHub repository TestAny-io/testany-agent-skills (81 stars, last pushed 11d ago), licensed MIT. It adds 73 tokens to every session and 3,754 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
autoreview
Pre-commit/ship code review: Codex default; optional Claude or Pi.
rework-rate
Measure and interpret PR rework rate — the emerging 5th DORA metric.
omh-code-review
This is a Hermes-native code-review workflow skill.
revdiff-plan
Review the last Codex assistant message (plan, analysis, or proposal) with inline annotations in a TUI overlay. Extracts the most recent response from Codex rollout files and opens it in revdiff for review and annotation. Activates on "revdiff-plan", "review plan with revdiff", "annotate plan", "review last response"…
code-reviewer
Code review specialist focused on patterns, bugs, security, and performance.
agent-teams-simplify-and-harden
Implementation + audit loop using parallel agent teams with structured simplify, harden, and document passes. Spawns implementation agents to do the work, then audit agents to find complexity, security gaps, and spec deviations, then loops until code compiles cleanly, all tests pass, and auditors find zero issues or…