Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add WhatIfWeDigDeeper/agent-skills --skill peer-reviewgit clone --depth 1 https://github.com/WhatIfWeDigDeeper/agent-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/whatifwedigdeeper/agent-skills/peer-review)<a href="https://agentmods.dev/skills/whatifwedigdeeper/agent-skills/peer-review"><img src="https://agentmods.dev/badge/skills/whatifwedigdeeper/agent-skills/peer-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/whatifwedigdeeper/agent-skills/peer-review"><img src="https://agentmods.dev/badge/skills/whatifwedigdeeper/agent-skills/peer-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00128 | $0.08712 |
| Opus 5.5 | $0.00051 | $0.03485 |
| Sonnet 5.5 | $0.00026 | $0.01742 |
| Haiku 4.5 | $0.00013 | $0.00871 |
Grade D, and why
peer-review scanned grade D with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
- **Stdin transport for codex** — for codex the *untrusted* prompt content (the diff, PR body, and file contents) is sent via stdin, never on argv, so it is not exposed via `ps` / `/proc/<pid>/cmdline` to other local use Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
**Cleanup of `$PROMPT_FILE` and `$WORKDIR` is explicit, not via `trap`.** A `trap 'rm -f "$PROMPT_FILE"' EXIT` fires when the bash subshell exits. Within the single-Bash-call execution required above, the subshell wraps How it starts
The opening of the file, as written. The whole thing — 377 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Peer Review
Get a fresh-context review of in-progress work — staged changes, a branch diff, a PR, or a set of files — without accumulated session assumptions. Returns severity-grouped findings the author can apply or skip.
Arguments
The text following the skill invocation is available as $ARGUMENTS (in Claude Code: /peer-review [target] [options]).
If $ARGUMENTS is help, --help, -h, or ?, print usage and exit:
Usage: /peer-review [target] [--model MODEL] [--focus TOPIC]
Targets (pick one):
(none) Auto-detect: staged, unstaged, or prompt [staged/unstaged/all] if both exist
--staged Staged changes only — skip auto-detection (git diff --staged)
--pr N PR #N diff + description
--branch NAME Branch diff vs default branch
path/to/file-or-dir Specific files or directory
Options:
--model MODEL Reviewer model (default: self — use the current assistant)
`self` means the assistant spawns a fresh instance of itself as reviewer
Explicit Claude models: any claude-* value (internal path — assistant selects model natively)
External CLIs: copilot[:submodel], codex[:submodel]
copilot — npm install -g @github/copilot-cli (or VS Code extension)
codex — npm install -g @openai/codex
--focus TOPIC Narrow emphasis (e.g. security, consistency, evals)
Does NOT suppress critical findings outside the focus area
Parse $ARGUMENTS left-to-right:
- Strip
--staged→ set target type to staged (explicit-staged flag = true; staged-only, no auto-detection) - Strip
--pr N→ set target type to PR, store N as$PR - Strip
--branch NAME→ set target type to branch, store NAME as$BRANCH - Strip
--model MODEL→ store model override - Strip
--focus TOPIC→ store TOPIC as$FOCUS - Remaining token (if any) → treat as a file/dir path target
Conflict: if more than one target selector is present after parsing (e.g. both --pr N and --branch NAME, or --pr N and a path, or --staged and a path, or two leftover path tokens), error: "specify one target at a time — targets are mutually exclusive."
What ships with it
4 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · -5 lines · -35 tokens per session 50d53720c8db
- 2mo ago First seen · 382 lines · 163 tokens per session scan D feae96ec39bf
peer-review is a skill published in the GitHub repository WhatIfWeDigDeeper/agent-skills (2 stars, last pushed 19d ago), licensed MIT. It adds 128 tokens to every session and 8,712 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it D with 2 findings (asks for root, recursive force delete). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
critical-code-reviewer
Rigorously review code or pull requests for correctness, security, accessibility, maintainability, tests, and edge cases. Use when users request a critical code review, want a guided walkthrough of findings, need implementer-facing feedback, or want to prepare, create, or submit a GitHub pull request review.
review-work
Post-implementation gate review: run manual QA on the real surface yourself, then launch ONE gate reviewer (never a panel) to audit goal, constraints, code quality, security, missed context, and QA evidence. Use before a PR handoff or when the user explicitly asks to review completed work.
react-patterns
React 19 performance patterns and composition architecture for Vite + Cloudflare projects. 50+ rules ranked by impact — eliminating waterfalls, bundle optimisation, re-render prevention, composition over boolean props, server/client boundaries, and React 19 APIs. Use when writing, reviewing, or refactoring React…
one-way-door
Flags irreversible decisions before commit. Use for data models, infra, auth boundaries, API contracts, event schemas, CI/CD.
pr-summary
Refresh the current pull request description from its net changes, following the repository's PR template, when asked to update or write the PR summary. Works in any Scenario repository, whatever its default branch.
pr-description-writer
Redacta una descripción de pull request clara y estructurada a partir de un diff de git, resumen de rama o lista de commits. Úsalo cuando te pidan escribir una descripción de PR, redactar una solicitud de cambios o documentar cambios de código. Produce una descripción con resumen, motivación, cambios realizados, pasos…