Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/morpho-org/sdks/pr-review-ghgit clone --depth 1 https://github.com/morpho-org/sdksWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/morpho-org/sdks/pr-review-gh)<a href="https://agentmods.dev/commands/morpho-org/sdks/pr-review-gh"><img src="https://agentmods.dev/badge/commands/morpho-org/sdks/pr-review-gh.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.03519 |
| Opus 5 | $0.00000 | $0.01759 |
| Sonnet 5 | $0.00000 | $0.00704 |
| Haiku 4.5 | $0.00000 | $0.00352 |
Grade A, and why
pr-review-gh scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 234 lines — stays where its author put it; the contents beside it link to each section on GitHub.
pr-review-gh
Local PR review. Posts an inline GitHub review as a COMMENT (never auto-approves or requests changes — leave that decision to humans). Optionally schedules a 2-minute watcher cron via --watch.
Usage
/pr-review-gh <PR_NUMBER>
/pr-review-gh <PR_NUMBER> --watch
Pre-conditions:
- A
<PR_NUMBER>is required. - Must run locally (NOT in CI). If
CI=trueorGITHUB_ACTIONS=true, abort and tell the user to use/pr-review-ciinstead. --localis not supported (use/pr-review-localfor that).
If --watch is passed, the skill is not complete until Step 9's CronCreate succeeds and you report the job ID.
Step 1: Validate environment + arguments
if [ "$CI" = "true" ] || [ "$GITHUB_ACTIONS" = "true" ]; then
echo "pr-review-gh is for local PR review. Use /pr-review-ci in CI." >&2
exit 1
fi
if [ -z "${1:-}" ]; then
echo "pr-review-gh requires a PR number." >&2
exit 1
fi
Parse <OWNER> and <REPO> from git remote get-url origin. If --watch was passed, also capture <BOT_LOGIN>=$(gh api user --jq '.login') for use in Step 9.
Step 2: Fetch PR details
Same as /pr-review-ci Step 2: gh pr view <PR_NUMBER>, capture and validate <BASE_BRANCH>, <HEAD_BRANCH>, <HEAD_SHA>, ensure state == OPEN. Use whitespace-only validation. Then git fetch origin.
Steps 3–6: Shared review base
Read .agents/pr-review-engine/SKILL.md and follow Steps 3–6 there, with these inputs:
<DIFF_SOURCE>=pr<HEAD_REF>=origin/<HEAD_BRANCH><INTENT_CONTEXT>= the PR title + body (fromgh pr viewin Step 2) followed by the changed-commit messages, so agents can tell a deliberate, documented change from a regression.
Steps 3–6 produce: <FINDINGS> (each carrying snapped_line), <DROPPED_FINDINGS>, <FAILED_AGENTS>, <COUNTS>, <DROPPED_COUNTS>, <TOTAL_AGENTS_LAUNCHED>.
Step 6b: Findings ledger (PR-keyed, stateful)
So re-reviews of an evolving PR don't re-surface findings already seen or deferred, merge this run's <FINDINGS> into a persisted ledger keyed by PR number (distinct from /pr-review-local's branch-<name> key). The ledger lives outside the repo:
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 234 lines · 0 tokens per session scan A 86a1e5ce95c4
pr-review-gh is a command published in the GitHub repository morpho-org/sdks (40 stars, last pushed yesterday), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 3,519 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-01.
Other commands, from other repositories
triage
Triage a GitHub issue and present findings on validity, code locations, and optionally create a failing test or resolution plan.
find-duplicate-prs
Find open PRs that may duplicate a given PR.
upgrade-nodejs
This guide explains how to upgrade the Node.js version that Bun reports for compatibility with Node.js packages and native addons.
upgrade-webkit
Upgrade Bun's WebKit fork to the latest upstream version of WebKit.
dedupe
Find duplicate GitHub issues.
dev
Runs Vendure in development mode. By default it starts three processes: the GraphQL server (ts-node ./src/index.ts), the worker (ts-node ./src/index-worker.ts), and the dashboard (a Vite dev server).