Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add XnLemon/Neneko-skill --skill handle-reviewgit clone --depth 1 https://github.com/XnLemon/Neneko-skillWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/xnlemon/neneko-skill/handle-review)<a href="https://agentmods.dev/skills/xnlemon/neneko-skill/handle-review"><img src="https://agentmods.dev/badge/skills/xnlemon/neneko-skill/handle-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/xnlemon/neneko-skill/handle-review"><img src="https://agentmods.dev/badge/skills/xnlemon/neneko-skill/handle-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00074 | $0.02726 |
| Opus 5.5 | $0.00030 | $0.01090 |
| Sonnet 5.5 | $0.00015 | $0.00545 |
| Haiku 4.5 | $0.00007 | $0.00273 |
Grade A, and why
handle-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 216 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Handle Review
Handle review comments as claims to verify, not instructions to apply blindly. Define scope by the pull request's behavioral contract and the invariants changed by its diff, not only by title packages or touched files.
Respect Authority
Match actions to the user's request before touching code or GitHub state.
- For analysis, explanation, or review, remain read-only.
- For a requested fix, edit and validate, but commit, push, reply, resolve, dismiss, or start a follow-up only when authorized.
- Preserve unrelated worktree changes and never rewrite the branch merely to simplify review handling.
- State any unavailable evidence or validation instead of guessing.
Build The Evidence Set
Read enough context to reconstruct the intended outcome before classifying any thread:
- Read the PR title, body, linked issue, base and head branches, commits, changed files, and current CI state.
- Read the complete thread, including later replies, resolution and outdated state, and related comments from the same reviewer.
- Inspect the latest HEAD implementation and tests around the cited line. Never judge only from the reviewed commit or stale diff position.
- Search for sibling switches, clone paths, serializers, adapters, protocol converters, persistence paths, and tests that consume the changed type or behavior.
- Read repository instructions and package contracts before proposing a public API, protocol, persistence, or lifecycle change.
Treat resolved and outdated as thread metadata, not proof that a claim is fixed. Treat severity as impact, not proof that the work belongs in the current PR.
Translate Each Comment Into A Claim
Record these facts before deciding:
- The concrete input or state that triggers the issue.
- The observed failure: rejection, silent loss, aliasing, corruption, race, compatibility break, or missing representation.
- The contract or invariant allegedly violated.
- Whether the failure exists on current HEAD.
- The reviewer's proposed implementation and test, considered separately from the finding itself.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2mo ago First seen · 216 lines · 74 tokens per session scan A 908cd1338c30
handle-review is a skill published in the GitHub repository XnLemon/Neneko-skill (2 stars, last pushed 2mo ago), licensed MIT. It adds 74 tokens to every session and 2,726 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
code-refiner
Deep code simplification and refactoring preserving behavior across Python, Go, TypeScript, Rust. Targets complexity, anti-patterns, readability debt. Triggers on: "simplify this code", "refactor for clarity", "reduce complexity", "make this more readable", "tech debt cleanup", "too much nesting". NOT for deepening…
package-optimizer
Evaluate one existing package or bounded package family from recorded evaluator evidence and a capability profile, then propose retain, simplify, strengthen, retire, or inconclusive without editing. Use when optimizing a skill, agent, hook, rule, command, utility, or preset; evaluating whether package detail is…
concord-relay
Keep this Grok session reachable by other Concord agents while idle.
review-skill
Review a proposed Agent Skill for structural validity and content quality before publishing. Runs the skill-validator CLI to check for structural issues, scores the skill with an LLM judge, and interprets results to advise authors on what to address. Use when a user wants to review, validate, or quality-check an Agent…
plan-review
Pre-implementation plan audit stress-testing scope, assumptions, risks, and failure modes before code is written. Triggers on: "review this plan", "is this plan solid", "what am I missing", "challenge my assumptions", "stress-test this", "/plan-review".
pre-landing-review
Gate-oriented safety audit for code changes before landing, using a checklist with two-pass severity triage. Triggers on: "is this safe to land", "pre-landing review", "safety check before merge", "gate check", "/pre-landing-review". NOT for diff review, use pr-review.