Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add This-HW/claude-code-kit --skill reviewgit clone --depth 1 https://github.com/This-HW/claude-code-kitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/this-hw/claude-code-kit/review)<a href="https://agentmods.dev/skills/this-hw/claude-code-kit/review"><img src="https://agentmods.dev/badge/skills/this-hw/claude-code-kit/review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/this-hw/claude-code-kit/review"><img src="https://agentmods.dev/badge/skills/this-hw/claude-code-kit/review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00029 | $0.02493 |
| Opus 5.5 | $0.00012 | $0.00997 |
| Sonnet 5.5 | $0.00006 | $0.00499 |
| Haiku 4.5 | $0.00003 | $0.00249 |
Grade A, and why
review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 291 lines — stays where its author put it; the contents beside it link to each section on GitHub.
코드 리뷰 실행
즉시 실행하세요. 설명하지 말고 바로 실행합니다.
파이프라인 구조
┌──────────────┐ ┌──────────────┐ ┌───────────────┐
│ 리뷰 대상 │ → │ review-code │ → │ security-scan │
│ 파악 (Main) │ │ (opus) │ │ (sonnet) │
└──────────────┘ └──────────────┘ └───────────────┘
0단계: 정적 분석 (Python 파일 포함 시)
리뷰 대상에 .py 파일이 포함되어 있으면 ruff check를 먼저 실행합니다.
# 특정 파일 지정 시
ruff check [대상 파일 또는 디렉토리]
# git diff 대상 시 (변경된 .py 파일 추출 후)
git diff HEAD --name-only | grep '\.py$' | xargs ruff check 2>/dev/null
결과 처리:
- ruff check 출력이 있으면: 리뷰 컨텍스트에 포함하여 review-code 에이전트에 전달
- ruff check 통과 시: "정적 분석: 통과" 메시지만 출력
- ruff가 설치되지 않은 경우: "스킵됨 (ruff 미설치)" 메시지 출력
형식:
## 0단계: 정적 분석 (ruff)
- 대상: [파일 목록 또는 "없음 (Python 파일 없음)"]
- 결과: [통과 | N건 발견]
- 발견된 이슈: [있을 때만 출력]
0.5단계: 복잡도 flag — 하이브리드 (advisory 전용, Python 파일 포함 시)
결정론 flag → LLM 판단 2단 하이브리드입니다. 복잡도 수치는 리젝 사유가 아니라 리뷰 초점 신호입니다.
# mccabe 복잡도 flag (ruff 내장, 기본 임계 10)
ruff check --select C901 [0단계와 동일한 대상 파일]
결과 처리:
- flag된 함수가 있으면: 목록을 review-code 에이전트 컨텍스트에 다음 지시와 함께 전달 —
아래 함수들은 복잡도 임계를 넘었다(결정론 flag). 줄수·복잡도 수치 자체를 리젝 사유로 삼지 말고, 다음 관점으로만 분리 타당성을 판단하라: ① 모듈/함수 경계가 단일 책임인가 ② IN/OUT 계약(인자·반환·부수효과)이 명확히 분리 가능한가 ③ 분리 시 계약이 단순해지는가(아니면 그대로가 응집적인가). 응집적이면 flag를 기각하고 그 근거를 명시하라.
- flag 없으면: "복잡도: 통과" 한 줄만.
- 절대 blocking 아님: 이 단계는 어떤 경우에도 리뷰를 실패시키지 않는다 (전역 lint(E,F)·stop-validator와 무관 — advisory 전용).
- ruff 미설치: "스킵됨 (ruff 미설치)" — fail-open.
형식:
## 0.5단계: 복잡도 flag (advisory)
- flag: [없음 | 함수 N건 (파일:라인, 복잡도)]
- 처리: [review-code 판단 위임 | 통과]
1단계: 리뷰 대상 파악
$ARGUMENTS가 있으면:
- 해당 파일/디렉토리를 읽어서 리뷰
$ARGUMENTS가 없으면:
git diff HEAD로 변경사항 확인- 변경사항이 없으면
git diff HEAD~1로 마지막 커밋 확인
1.5단계: 자동 범위 판단 (Auto-Scope)
변경 파일을 분석하여 리뷰 범위를 자동으로 결정합니다.
수동 오버라이드 확인
$ARGUMENTS에 --quick이 포함되어 있으면:
- scope = 'quick' (사용자 명시 오버라이드)
- security_scan_needed = false
- "수동으로 quick 모드가 지정되었습니다" 메시지 출력
- 1.5단계 나머지 스킵하고 2단계로 진행
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 291 lines · 29 tokens per session scan A 065894269843
review is a skill published in the GitHub repository This-HW/claude-code-kit (4 stars, last pushed 1mo ago), licensed MIT. It adds 29 tokens to every session and 2,493 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
code-standards
Prabhdeep (Sonu) Singh's personal coding standards — the house rules and quality bar for how code gets written. INVOKE before writing, generating, refactoring, or reviewing ANY code in ANY language — schemas, endpoints, queries, logging, validation, error handling — even when nobody says "standards" or "style".…
self-review
Surface the riskiest parts of the current diff so a reviewer knows where to look hardest — one inline pass on small diffs, one cold read on a cheaper model tier with in-session synthesis on substantial ones. INVOKE PROACTIVELY whenever a change is finished and about to be handed off, reviewed, or shipped. It points…
bug-finder
Hunt for one real, previously unreported defect and file it as a well-evidenced ticket — proactive discovery, not reactive diagnosis. INVOKE when asked to sweep code for bugs or hunt risky areas, and when /sonu:factory runs a bug-hunt pass. A known symptom is [[debugging]]; a pending diff is [[self-review]]. It files…
java-jpa
Reviews Spring Data JPA for N+1 queries, fetch strategies, projections, and Specifications. Use when user asks to "review JPA", "check for N+1", "JPA performance", "review my entities", "check fetch strategy", or "review my repositories".
java-health
Runs a holistic code health check scoring Security, Tests, Performance and Quality with A-F grades. Use when user asks to "check health", "score this project", "health check", "how good is this code", "overall assessment", or "code quality score".
java-cache
Use when the user asks to add caching, configure Redis or Caffeine cache, use @Cacheable/@CacheEvict/@CachePut, optimize repeated database or API calls, or review existing Spring Boot cache configuration.