dshcode: Skill for Claude Code

.agents/skills/dsh-code-review/SKILL.md

dsh-code-review is a skill for Claude Code, Codex from whitelonng/dshcode. It costs 54 tokens per session (1,849 once invoked), scanned A, a copy of dsh-code-review, MIT.

Review guidance for pull requests in the DeepSeek-Harness repository, covering its project rules, defensive coding patterns, documentation standards, and required quality checks.

In plain words
What is it for?
Use it when reviewing a DeepSeek-Harness pull request to verify its exact base and head, inspect the right files, and prioritize broken behavior, security, and correctness.
Why use it?
It helps reviewers assess repository-specific risks that may not be visible from the diff alone, such as lifecycle, subprocess, asynchronous-state, and testing problems.

Skill for Claude CodeCodex

Written for no agent in particular: nothing here depends on one. Also seen: installed under .agents/ (shared by several agents); mentions AGENTS.md.

This is whitelonng/dshcode's own configuration. It tells Claude Code and Codex how to work on dshcode itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything dshcode configures →

Reuse

Borrowing it

Nothing to install: this file belongs to whitelonng/dshcode. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/whitelonng/dshcode/master/.agents/skills/dsh-code-review/SKILL.md
Clone the repo
git clone --depth 1 https://github.com/whitelonng/dshcode

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for dsh-code-review

README.md
[![agentmods](https://agentmods.dev/badge/skills/whitelonng/dshcode/dsh-code-review/github.svg)](https://agentmods.dev/skills/whitelonng/dshcode/dsh-code-review)
Your own site
<a href="https://agentmods.dev/skills/whitelonng/dshcode/dsh-code-review"><img src="https://agentmods.dev/badge/skills/whitelonng/dshcode/dsh-code-review/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for dsh-code-review

Your own site · 80×15
<a href="https://agentmods.dev/skills/whitelonng/dshcode/dsh-code-review"><img src="https://agentmods.dev/badge/skills/whitelonng/dshcode/dsh-code-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 54 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,849 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin 86% copy Near-identical to another mod in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00054 $0.01849
Opus 5.5 $0.00022 $0.00740
Sonnet 5.5 $0.00011 $0.00370
Haiku 4.5 $0.00005 $0.00185

Measured 1mo ago against content hash 6c862b17bca7, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

dsh-code-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

Origin

This is a copy

86% identical to dsh-code-review — 32 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.

.agents/skills/dsh-code-review/SKILL.md · 53 lines

How it starts

The opening of the file, as written. The whole thing — 53 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Reviewing a DeepSeek-Harness PR

This skill is guidance, not a complete checklist. Verify and fetch the PR's live base and exact head, then run pnpm --silent run change-scope --base <verified-base-ref> --head <verified-head-ref> before reading the diff and enough surrounding code to understand the design. The report identifies paths and dirty layers but does not replace semantic review. Re-establish the base and rerun it after a retarget or merge. Prioritize correctness, lifecycle, security, and broken required behavior over style; a short review with one substantiated blocker is better than a list of nits.

Sources of truth

Blocking requirements

  1. New prose receives semantic review. Use dsh-prose-standard to critically review every added or changed Markdown passage, JSDoc, comment, prompt, description, diagnostic, and visible string. Verify required coverage, accuracy, placement, and editorial quality against the owning code or behavior; automated checks do not establish those properties.
  2. Docs match the code. Config, defaults, errors, wire fields, events, and public behavior update the package README and JSDoc in the same diff. Comments state non-obvious contracts; flag implementation narration, test walkthroughs, review history, and duplicated rationale for deletion or a link to their one home.
  3. Core type docs match. Changes to spine or seam vocabulary update the appropriate subsystems page and any type-equiv entry. Internal types need no catalog entry.
  4. Registrations clean up. Verify each new registry contribution passes the disposal tests required by packages/AGENTS.md.
  5. Invariant companions are semantic. For every touched ./invariant, require an owner event-stream or mutable-data relationship with independent observations at the point where that package can observe it; service or method presence, plugin metadata or effects, fixed pure examples, and probes that call the same operation they claim to verify belong in load, behavior, or unit tests. When no plausible relationship exists, require the package to omit the companion and publication wiring and record its package-specific reason in the README. Reject empty installers and invented checks (repository rule; package invariant rules).
  6. Required evidence exists. Verify the author ran the relevant local checks for the diff and that CI covers the exhaustive matrix; review the semantic gaps neither can detect.
  7. Client UI copy is locale-owned. Reject product text embedded in JSX, templates, helper returns, accessibility attributes, or primitive defaults. Require typed dictionary keys, the standard t seat or explicit localized props, verify-client-ui-i18n, and behavior evidence in each affected locale; preserve user/model/wire data and code tokens verbatim.

Read the full file on GitHub · 53 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 1mo ago Changed · +3 lines 6c862b17bca7
  2. 1mo ago First seen · 50 lines · 54 tokens per session scan A 59df05ce442f

Subscribe to this mod's changes

dsh-code-review is a skill published in the GitHub repository whitelonng/dshcode (704 stars, last pushed 1mo ago), licensed MIT. It adds 54 tokens to every session and 1,849 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. It is 86% identical to dsh-code-review, differing in 32 lines, and is treated as a copy.

Related

Other skills, from other repositories

visionary-cli

Analyze images with DeepSeek's vision model via the visionary-server CLI. Use this whenever the user provides an image, photo, screenshot, or document with images - run vision to look at it rather than guessing.

xlight/deepseek-visionary · 46 tokens

open-code-review

Performs AI-powered code review on Git changes using the ocr CLI from alibaba/open-code-review. Use when the user asks to review code, review a pull request, review staged/unstaged changes, review a commit, or compare branches for code quality issues. Produces line-level review comments and can automatically apply…

alibaba/open-code-review · 98 tokens

open-code-review-delegate

Delegation mode for open-code-review (OCR). Instead of OCR calling an LLM endpoint, this skill instructs the host agent to perform the code review itself, using OCR only for deterministic engineering: file selection and rule resolution. Use when the host agent should drive the review with its own LLM capabilities.

alibaba/open-code-review · 68 tokens

review

Comprehensive security and correctness audit. Use for review, deep review, thermo nuclear, or thermonuclear requests and branch or PR diff audits.

vercel/eve · 31 tokens

review

Review a small code change for correctness and missing tests.

zhnt/loushang · 13 tokens

code-review

Paranoid architect review of code changes for bugs, security, missing tests, and undocumented assumptions. Works on local git diffs OR a GitHub pull request (e.g. owner/repo N). For PRs, can post findings as line-level review comments.

suyoumo/ClawProBench · 57 tokens