Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/varienos/agentic-workflownpx agentmods add commands/varienos/agentic-workflow/auto-review.skeletonWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/varienos/agentic-workflow/auto-review.skeleton)<a href="https://agentmods.dev/commands/varienos/agentic-workflow/auto-review.skeleton"><img src="https://agentmods.dev/badge/commands/varienos/agentic-workflow/auto-review.skeleton/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/commands/varienos/agentic-workflow/auto-review.skeleton"><img src="https://agentmods.dev/badge/commands/varienos/agentic-workflow/auto-review.skeleton.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.02533 |
| Opus 5.5 | $0.00000 | $0.01013 |
| Sonnet 5.5 | $0.00000 | $0.00507 |
| Haiku 4.5 | $0.00000 | $0.00253 |
Grade A, and why
auto-review.skeleton scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 25d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 297 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Auto Review - Loop-Compatible Diff Review
Tracks the last review hash, runs a shallow review when there is a new diff, fixes MINOR findings directly, and opens backlog tasks for MAJOR findings. Usage:
/auto-review,/auto-review <commit_hash>,/auto-review HEAD~3..HEAD
Step 1 - Diff and State Detection
1.1 - Argument Parsing
| Input | Behavior |
|---|---|
| Empty | Last commit: cd ../Codebase && git diff HEAD~1..HEAD |
| Commit hash | Specified commit: cd ../Codebase && git show <hash> |
| Range | Range: cd ../Codebase && git diff <range> |
1.2 - Extract Normalized Diff
Extract the diff to review in a deterministic way:
cd ../Codebase && git diff --no-ext-diff --minimal <range_or_default>
From this diff extract:
- Changed file list
- Added/deleted line counts
- Change type (fix, refactor, test, config)
RULE: If the diff is empty or only whitespace changed, say "No new changes to review" and STOP.
1.3 - Compute Hash
Compute the diff hash stably:
CURRENT_DIFF_HASH=$(cd ../Codebase && git diff --no-ext-diff --minimal <range_or_default> | shasum -a 256 | awk '{print $1}')
CURRENT_HEAD=$(cd ../Codebase && git rev-parse HEAD)
1.4 - Load State File
Use .claude/tracking/auto-review-state.json:
{
"last_reviewed_hash": null,
"last_review_target": null,
"last_reviewed_head": null,
"last_reviewed_at": null,
"last_fix_commit": null,
"last_report_path": null
}
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 25d ago Changed · +1 lines 0e5f17d9566c
- 1mo ago First seen · 296 lines · 0 tokens per session scan A 89af3759f30d
auto-review.skeleton is a command published in the GitHub repository varienos/agentic-workflow (59 stars, last pushed 25d ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 2,533 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other commands, from other repositories
revdiff
Review git diff with revdiff TUI, then fix all annotations.
al-pr-prepare
Prepare a clean, documented pull request draft for AL features or fixes with summary, testing notes, and checklist. ALDC workflow (Copilot prompt al-pr-prepare); invoke explicitly.
gh-review
Review a pull request with proper branch checkout and convention checks.
gh-pr
Create a pull request with full code review, quality gates, and reviewer suggestions.
guardian
Revisión de código IA como pre-commit hook — Guardian Angel.
resolve-review
Resolve reviewer feedback - from GitHub PRs, chat, or any reviewer.