Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/zeikar/hyperclaude/hyper-code-reviewnpx skills add zeikar/hyperclaude --skill hyper-code-reviewgit clone --depth 1 https://github.com/zeikar/hyperclaudeWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00125 | $0.01875 |
| Opus 5 | $0.00063 | $0.00937 |
| Sonnet 5 | $0.00025 | $0.00375 |
| Haiku 4.5 | $0.00013 | $0.00187 |
Grade A, and why
hyper-code-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 93 lines — stays where its author put it; the contents beside it link to each section on GitHub.
hyper-code-review
Code review gate. Calls Codex via codex exec --sandbox read-only - with a code-review prompt template (templates/codex/code-review.md) against a branch diff, uncommitted working-tree changes, or a specific commit; the prompt instructs Codex to run the target git commands itself (read-only sandbox) and review with broadened blast-radius context — not only the literal changed lines. Saves the output to .hyperclaude/code-reviews/<timestamp>-<slug>.md; you read the file and surface the findings.
When to use
- User typed
/hyperclaude:hyper-code-review(with or without an argument). - After a non-trivial change set is staged or committed locally and a Codex critique is wanted.
When to skip
- The change is a tiny one-line tweak where a full review adds no value.
- You want a plan critique, not a code critique — use
/hyperclaude:hyper-plan-reviewinstead.
How to invoke
Invocation argument: $ARGUMENTS
--resume is supported. Paths with spaces are unsupported.
Argv grammar (summary)
Pre-normalize: if the first token is uncommitted case-insensitively, lowercase it. Then apply:
/^(?:(uncommitted|[0-9a-f]{7,40}|vs\s+[A-Za-z0-9._/][A-Za-z0-9._/-]*))?(?:\s*(--resume)(?:\s+(?!-)(\S+))?)?\s*$/
Group 1 = target, Group 2 = --resume token, Group 3 = artifact path. Bare --resume → --resume auto. Empty Group 1 → bridge default (--base main).
For the full regex breakdown, valid/rejected invocation lists, resume identity rules, and per-pattern bridge examples, see references/argv-grammar.md.
Step 1 — Resolve the bridge argv
Parse $ARGUMENTS with the grammar above. Construct an argv array (NOT a single shell string) to pass to the bridge.
| Pattern | Bridge argv |
|---|---|
| Empty (no argument) | ['code-review', '--base', 'main'] |
Literal uncommitted (case-insensitive, pre-normalized to lowercase) |
['code-review', '--uncommitted'] |
7–40 hex chars matching ^[0-9a-f]{7,40}$ |
['code-review', '--commit', '<sha>'] |
Matches ^vs (.+)$ AND rest passes ^[A-Za-z0-9._/-]+$ |
['code-review', '--base', '<ref>'] |
--resume present (Group 2) |
Append ['--resume', <Group 3 or 'auto'>] to above |
| Anything else | Tell the user the contract above, ask them to clarify, STOP. Do NOT fall through to --base <argument> — this is shell-injection-prone and produces bad slug filenames. |
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 93 lines · 125 tokens per session scan A b7f42af76193
hyper-code-review is a skill published in the GitHub repository zeikar/hyperclaude (3 stars, last pushed 14d ago), licensed MIT. It adds 125 tokens to every session and 1,875 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
r3f-animation
React Three Fiber animation - useFrame, useAnimations, spring physics, keyframes. Use when animating objects, playing GLTF animations, creating procedural motion, or implementing physics-based movement.
workflow
Professional AI programming assistant with structured workflow (Research -> Ideate -> Plan -> Execute -> Optimize -> Review) for developers.
golden-rss
Use when testing the rss golden build.
r3f-best-practices
React Three Fiber (R3F) and Poimandres ecosystem best practices. Use when writing, reviewing, or optimizing R3F code. Triggers on tasks involving @react-three/fiber, @react-three/drei, zustand, @react-three/postprocessing, @react-three/rapier, or leva.
agile-product-owner
../../../product-team/agile-product-owner/skills/agile-product-owner/SKILL.md.
golden-chat-topics
Use when testing the goldenchattopics golden build.