Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add tobihagemann/turbo --skill review-codegit clone --depth 1 https://github.com/tobihagemann/turboWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/tobihagemann/turbo/review-code)<a href="https://agentmods.dev/skills/tobihagemann/turbo/review-code"><img src="https://agentmods.dev/badge/skills/tobihagemann/turbo/review-code/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/tobihagemann/turbo/review-code"><img src="https://agentmods.dev/badge/skills/tobihagemann/turbo/review-code.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00153 | $0.02910 |
| Opus 5.5 | $0.00061 | $0.01164 |
| Sonnet 5.5 | $0.00031 | $0.00582 |
| Haiku 4.5 | $0.00015 | $0.00291 |
Grade A, and why
review-code scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 93 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Review Code
Review code against type-specific criteria. Runs internal reviews and /peer-review in parallel by default. Returns combined structured findings.
Types: correctness, security, api-usage, consistency, simplicity, coverage
With a type argument, runs a single-concern internal review plus the peer review. With no type argument, runs all six internal reviews plus the peer review.
Step 1: Determine the Scope
Determine what to review:
- If a specific diff command was provided (e.g.,
git diff --cached,git diff origin/main...HEAD), use that. - If a file list or directory was provided, review those files directly (read the full files, not a diff).
- If neither was provided, default to diffing against the repository's default branch (detect via
gh repo view --json defaultBranchRef --jq '.defaultBranchRef.name'). If there are no changes against the default branch, stop and state that there is nothing to review.
State the resolved file list before continuing: add --name-only to a diff command, or list the files for a file or directory scope. When the scope is a staged diff, also state how many further files git diff HEAD --name-only reports, so a scope narrower than intended stays visible before fanning out.
Step 2: Run Reviews in Parallel
Each active type maps to a criteria reference file:
- Correctness — references/correctness-review.md
- Security — references/security-review.md
- API usage — references/api-usage-review.md
- Consistency — references/consistency-review.md
- Simplicity — references/simplicity-review.md
- Coverage — references/coverage-review.md
Full review activates all six types; a single-concern argument activates one. Skip peer review when instructed (e.g., "without peer review", "no peer", "internal only").
What ships with it
6 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday Changed f5af807c89ce
- 5d ago Changed b0fed9d81208
- 15d ago Changed f9248538db4e
- 17d ago Changed 3b4cd91a43ea
- 19d ago Changed 6ca9ddfbbd17
- 21d ago Changed · +2 lines 2c940b6c6703
- 26d ago Changed · +9 tokens per session 0d85342259b2
- 1mo ago Changed a235328fda94
- 1mo ago Changed c439fab04203
- 1mo ago First seen · 91 lines · 144 tokens per session scan A baef50980621
review-code is a skill published in the GitHub repository tobihagemann/turbo (417 stars, last pushed yesterday), licensed MIT. It adds 153 tokens to every session and 2,910 once invoked, about $0.0006 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
code-review-checklist
Genera un checklist de revisión de código personalizado para cualquier pull request basado en el lenguaje, tipo de cambio y nivel de riesgo. Úsalo cuando te pidan revisar código, verificar un PR, revisar un pull request o generar un checklist de revisión de código. Produce un checklist enfocado con verificaciones…
pr-description-writer
Redacta una descripción de pull request clara y estructurada a partir de un diff de git, resumen de rama o lista de commits. Úsalo cuando te pidan escribir una descripción de PR, redactar una solicitud de cambios o documentar cambios de código. Produce una descripción con resumen, motivación, cambios realizados, pasos…
best-practices
Apply modern web development best practices for security, compatibility, and code quality. Use when asked to "apply best practices", "security audit", "modernize code", "code quality review", or "check for vulnerabilities".
security-specialist
Runs security audits on codebases — full scans, diff reviews, threat models, vulnerability triage, remediation guidance, and finding tracking. Activate when the user says "security scan", "audit this repo", "review this PR for security", "threat model", "triage vulnerabilities", "fix this vuln", or "track findings".
agent-plugin-eval
Audit, score, and compare repositories containing portable Agent Plugins against the official Agent Plugins specification. Use when asked to review a plugin repo, check plugin.json or mcp.json conformance, assess bundled skills and MCP servers, produce an evidence-cited 0–100 plugin scorecard, identify release…
refactoring
Use when improving the structure of code without changing its behavior. Covers safe refactoring sequences, characterization tests, and knowing when to stop. Trigger on "clean this up without changing behavior", "refactor this before i add the feature", "this module is impossible to test", "extract this into a…