A structured review of code changes that looks for correctness, security, missing requirements, and edge cases. It can review everything changed in the current branch or a selected part of the codebase.

Use it for routine code reviews, large changes, sensitive changes, and deeper reviews that read the whole codebase and test claims about libraries or runtime behavior.

It helps find problems before release, especially in changes that affect data structures, authentication, security boundaries, or actions that cannot easily be undone.

omd-review — Skill for Claude Code and Codex by AbyssCN/oh-my-dag

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add AbyssCN/oh-my-dag --skill omd-review

Clone the repo

git clone --depth 1 https://github.com/AbyssCN/oh-my-dag

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/abysscn/oh-my-dag/omd-review/github.svg)](https://agentmods.dev/skills/abysscn/oh-my-dag/omd-review)

Your own site

<a href="https://agentmods.dev/skills/abysscn/oh-my-dag/omd-review"><img src="https://agentmods.dev/badge/skills/abysscn/oh-my-dag/omd-review/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/abysscn/oh-my-dag/omd-review"><img src="https://agentmods.dev/badge/skills/abysscn/oh-my-dag/omd-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 101 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 1,634 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits

NVIDIA SkillSpector pass 7 Sept 2026

How audits are shown

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00101	$0.01634
Opus 5.5	$0.00040	$0.00654
Sonnet 5.5	$0.00020	$0.00327
Haiku 4.5	$0.00010	$0.00163

Measured 19d ago against content hash dc80c6816235, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

omd-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 19d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

client-skills/omd-review/SKILL.md · 60 lines

How it starts

The opening of the file, as written. The whole thing — 60 lines — stays where its author put it; the contents beside it link to each section on GitHub.

/omd-review — 对抗式改动审查

经 omd MCP dag_review(可能带 mcp__omd__ 前缀;未加载先 ToolSearch "dag_review")对一批改动做对抗审查:默认多维并行 find(召回)+ 确定性跨模型 verify(证伪);deep 档单 agent 读全仓 + 实测(实测最优,见档位选择)。

用法(异步三段式)

gate:按 blast radius 选,不按行数(真源 harness/docs/GATES.md,与引擎 scripts/dag-review.ts 逐档一致)。不给 = G2。

gate	什么改动	实际跑什么
`G0`	文档 / 机械(注释、配置、纯改名、格式)	⚠ 免审短路——不取 diff、不发模型、直接 exit 0。它不是"便宜的浅扫",是"不审";要便宜的召回选 G1
`G1`	骨架(新模块脚手架、签名、接线)	`contract` + `boundary` 两维
`G2`	常规逻辑(普通业务码、带行为测试的重构)	`correctness` + `security` + `boundary` 三维
`G3`	敏感:schema · 认证 · 安全边界 · 不可逆	G2 三维 + `contract` + `spec` 轴强制(对照 SDD,`--no-spec` 在 G3 直接报错)+ owner 终审

轮数硬上限:G1/G2 各 1 轮,G3 = 1 轮 + 至多 1 个修复 cycle。

scope:收窄审查范围(路径/模块);不给 = 当前 branch diff 全量。
deep:深审档(true)。一个 pi agent 读全仓 + 实测(库/runtime API 主张必跑 bun -e 复现,治外部 API 幻觉)→ 确定性跨模型 verify。比默认贵,但精度更高、自然去重。
sdd:Spec 轴对照这份 SDD/任务书(隐含 spec 轴;文件不存在直接报错,不回落 docs/plan 最新一份)。审 omdl run 一律带:dag_review(gate: "G2", sdd: <meta.repo>/<meta.spec>, scope: <run 改动路径>);CLI 同款 bun run scripts/dag-review.ts --gate G2 --sdd <任务书> --base <base>(在 run 的 worktree 里跑)。

dag_review(gate?, scope?, deep?, sdd?) → runId;
dag_status(runId) 轮询(跑几分钟,别重复发起);
dag_result(runId) → 报告落盘路径,自己 Read 再转述(按严重度先讲 top 项)。

档位选择:默认 vs 深审(deep)

默认(多维并行 find + 确定性 verify):廉价召回档,diff-可见的 bug 够抓,适合日常/大 diff。
深审 deep:true(单 agent):实测最干净(3 方召回测:满召回 + 0 假阳性 + 推理最好 + 自然去重)。用于敏感接缝(会计/authz/迁移/状态机)、需读 diff 外真身、或默认档出噪音时。贵在一个 agent 全仓读+跑,别对大批量机械 diff 滥用。
模型(review 自成体系,不碰引擎 verifier 角色):find = review 角色(OMD_REVIEW_MODEL);verify = OMD_REVIEW_VERIFY_MODEL 覆盖,否则回落 find 模型(跨模型 verify 靠显式配 OMD_REVIEW_VERIFY_MODEL)。无需任何配置也能跑,fallback 优雅降级、不假设 key。

误报裁决程序(承终裁手册:finding ≠ ground truth)

车队产出是候选,你终裁。每条 finding:

定位代码事实——必须看 diff 视野外(审查器只看 diff,这是误报主源)。
oracle 证伪:typecheck / 测试 / 活库实测 / 既有测试钉。
证伪成立 → 驳,记驳的依据;证伪不了 → 修;拿不准 → ? 升级 owner。

Read the full file on GitHub · 60 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

19d ago Changed · +2 lines dc80c6816235
2mo ago First seen · 58 lines · 101 tokens per session scan A f51ba98022f9

Subscribe to this mod's changes

omd-review is a skill published in the GitHub repository AbyssCN/oh-my-dag (44 stars, last pushed 19d ago), licensed MIT. It adds 101 tokens to every session and 1,634 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Code review LLM agentic-ai ai-agent bun coding-agent mcp

review-this-branch

Run the nohuman review gate (fresh-session adversarial reviewer + tamper guard) over the current branch or a GitHub pull request, with no server, no database, and no onboarding, and relay the pass/fail checklist.

no-human-ai/no_human · 53 tokens

hypotheses

Turns a research direction into testable hypotheses with predictions, competing explanations and the experiments that discriminate between them, including the design (controls, randomization, blocking), sample size or seed count, the pre-specified analysis, and the result that would falsify each hypothesis. Use when a…

synthetic-sciences/openscience · 99 tokens

control-center-review

Review one captured Control Center build before runtime activation.

openonion/connectonion · 14 tokens

review-pr

Review GitHub pull requests. Use when user says "review PR", "review pull request", or "/review-pr".

openonion/connectonion · 27 tokens

spawn-reviewers

Spawn and collect the reviewer fleet at stage20spawnreviewers. Consumes spawn.json.spec (the authoritative spawn spec from derive-spawn-spec / derive-static-spec), resolves CODEINTELALLOWED and CODEINTELREQUIREROOTARG, builds per-agent prompts from the per-agent template + role suffixes (Bug Hunter A/B, Unified…

closedloop-ai/claude-plugins · 191 tokens

workflow-code-review

Run a worker-backed code review using its bundled review lenses: approach correctness, architecture ownership, correctness, guardrails, validation, compatibility, and security. Use when asked to review a PR, branch, diff, or uncommitted changes with workflow-level rigor.

closedloop-ai/claude-plugins · 56 tokens