Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add TheWinci/mimirs --skill reviewgit clone --depth 1 https://github.com/TheWinci/mimirsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/thewinci/mimirs/review)<a href="https://agentmods.dev/skills/thewinci/mimirs/review"><img src="https://agentmods.dev/badge/skills/thewinci/mimirs/review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/thewinci/mimirs/review"><img src="https://agentmods.dev/badge/skills/thewinci/mimirs/review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00060 | $0.00369 |
| Opus 5.5 | $0.00024 | $0.00148 |
| Sonnet 5.5 | $0.00012 | $0.00074 |
| Haiku 4.5 | $0.00006 | $0.00037 |
Grade A, and why
review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Review
Goal: know the full impact before and after changing code — no surprise breakage.
- What changed —
git_context(include_diff: true)for the modified files and the diff. - Blast radius — for each changed function or type:
impact <symbol>(transitive callers as a pruned tree + the tests to run). Widen withusages <symbol>(every call site) anddependents <file>(file-level importers). Passfiletoimpactto disambiguate a name defined in several places. - Tests to run —
affectedfor the changed set (CLI:git diff --name-only | mimirs affected --stdin). Run those before claiming the change is done. - Known caveats —
get_annotationson the touched files: fragile code, constraints, "don't refactor until X". - Why it's like this —
search_checkpoints "<area>"(prior decisions) andsearch_commits "<area>"(why it changed before), so you don't undo a deliberate choice. - After the change — re-run
impact/affected;annotateany new caveat you introduce;create_checkpointthe decision and what changed.
Finish: a risk summary — callers affected, tests to run, caveats, prior decisions — each with a file:line citation.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 18 lines · 60 tokens per session scan A c0902d2ddd2b
review is a skill published in the GitHub repository TheWinci/mimirs (30 stars, last pushed 6d ago), licensed Apache-2.0. It adds 60 tokens to every session and 369 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
webhook-dx-audit
Audit the developer experience of any platform that sends outbound webhooks or event destinations to its customers, and produce a structured YAML audit file with scored findings and prioritized recommendations. Use whenever the task is to review, assess, grade, or critique a company's webhook/event- delivery DX: their…
live-audit
Audit steam-games-mcp — build/test/lint gate, live MCP tool edge-case sweep (input validation, SteamID64/vanity/appid edge cases, key-gating), and source-level code review. Use when asked to test/audit the published or just-fixed steam-games-mcp package, hunt for bugs/edge cases, or repeat "the same kind of testing as…
paparats-search
Use when answering a question about code in the user's indexed repositories — where something is implemented, how a flow works, who calls a function, or what a change would affect. Explains when to use Paparats semantic search and when a text search is the better tool.
pr-reviewer
Review a requested pull request, branch diff or completed task against its actual scope, source and checks. Prepare evidence and comments; post or record a human verdict only when explicitly authorized.
tool-description-check
Self-check a new or edited MCP tool description/field .describe() text before committing — verify every behavioral claim against live testing or source, check for contradictions with sibling tools, and score against Glama's Tool Definition Quality Score (TDQS) rubric. Use whenever a tool description or schema field…
impact
Show what depends on a function, class or module and what could break if it changes, using Synapse's code graph. Use when the user asks what calls something, what depends on it, or whether it is safe to change. Needs Synapse Pro.