Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add thixpin/pitway --skill code-quality-reviewgit clone --depth 1 https://github.com/thixpin/pitwayWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/thixpin/pitway/code-quality-review)<a href="https://agentmods.dev/skills/thixpin/pitway/code-quality-review"><img src="https://agentmods.dev/badge/skills/thixpin/pitway/code-quality-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/thixpin/pitway/code-quality-review"><img src="https://agentmods.dev/badge/skills/thixpin/pitway/code-quality-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00079 | $0.00673 |
| Opus 5.5 | $0.00032 | $0.00269 |
| Sonnet 5.5 | $0.00016 | $0.00135 |
| Haiku 4.5 | $0.00008 | $0.00067 |
Grade A, and why
code-quality-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 54 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Code Quality Review
Review for defects and maintainability, in that order. Every finding names the location, the concrete problem, and a suggested fix; every finding has a severity.
Scope
Reviews a change — a diff, branch, or set of files — at the function and file level.
Use for quality review of written code: readability, maintainability, correctness risks, backward compatibility.
Do not use for:
- System-wide structure, module boundaries, or layering — use
architecture-review. If a finding here is really "the whole codebase is shaped wrong," it belongs there. - Security review — use
security-audit. - Reviewing a GitHub pull request — use the built-in
/review.
Method
- Understand the change's intent before judging it — read the description, then the diff, then enough surrounding code to know how the pieces are used.
- Review the design first (is this the right shape?), then the details (is it written well?). A perfectly formatted wrong abstraction is still wrong.
- Report findings by severity: blocker (bugs, data loss, breaking changes), should-fix (maintainability problems that will hurt soon), nit (style and polish, clearly labeled as optional).
- Distinguish "this violates the project's conventions" from "this differs from my preference." Only the first is a finding.
Checklist
Correctness & safety
- Edge cases: empty inputs, nulls, boundaries, concurrency, partial failure.
- Error handling: failures surfaced, not swallowed; resources released on all paths.
Backward compatibility
- Public APIs, wire formats, database schemas, and config keys keep working for existing callers, or the break is explicit and justified.
- Behavior changes to shared code checked against all existing call sites.
Maintainability — scoped to the change; escalate system-wide findings to architecture-review
- DRY: real duplication (same knowledge in two places) flagged; incidental similarity left alone.
- Single responsibility: each unit has one reason to change; mixed concerns (I/O + logic + formatting in one function) flagged.
- Dependencies point the right way — no new coupling from low-level modules to high-level ones, no cycles.
- Naming says what things are; no comment needed to decode a name.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 54 lines · 79 tokens per session scan A 5ae5a7a03790
code-quality-review is a skill published in the GitHub repository thixpin/pitway (20 stars, last pushed 2d ago), licensed MIT. It adds 79 tokens to every session and 673 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
address-github-comments
Use when you need to address review or issue comments on an open GitHub Pull Request using the gh CLI.
pr
Draft a PR body from OMC's paper trail — the smallest visual that proves the change, evidence consumed from the verify protocol (never re-collected), reversibility from the ADR test on the diff, glossary language throughout.
github-pr-comments
Resolve inline code review comments on a GitHub PR. Use when asked to "resolve review comments", "address PR feedback", "fix PR comments", or "work through review comments". Fetches every inline comment with its surrounding code context, then applies each change systematically.
concord-relay
Keep this Grok session reachable by other Concord agents while idle.
pr-triage
4-phase PR backlog management with audit, deep code review, validated comments, and optional worktree setup. Use when triaging pull requests, catching up on pending code reviews, or managing a backlog of open PRs. Args: 'all' to review all, PR numbers to focus (e.g. '42 57'), 'en'/'fr' for language, no arg = audit…
review-pr
Perform a comprehensive code review of a pull request.