Borrowing it
Nothing to install: this file belongs to adamayoung/TMDb. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/adamayoung/TMDb/main/.claude/skills/review-changes/SKILL.mdgit clone --depth 1 https://github.com/adamayoung/TMDbWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/adamayoung/tmdb/review-changes)<a href="https://agentmods.dev/skills/adamayoung/tmdb/review-changes"><img src="https://agentmods.dev/badge/skills/adamayoung/tmdb/review-changes/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/adamayoung/tmdb/review-changes"><img src="https://agentmods.dev/badge/skills/adamayoung/tmdb/review-changes.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.04013 |
| Opus 5 | $0.00000 | $0.02006 |
| Sonnet 5 | $0.00000 | $0.00803 |
| Haiku 4.5 | $0.00000 | $0.00401 |
Grade A, and why
review-changes scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 303 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Review Changes
Produce the pre-PR review of the current branch's changes against main,
following the canonical .github/CODE_REVIEW.md. This skill scales the review
to the size of the change — a single agent when the diff is small, a parallel
fan-out with adversarial verification when it's large — and returns a
severity-graded report. It does not edit code; the caller (e.g. /deliver's
code-review phase, or you) applies the fixes.
Principles
- One source of truth. Every reviewer — single or fanned-out — follows
.github/CODE_REVIEW.md: the severity rubric, scope, and the mandatory adversarial re-evaluation. Don't invent criteria. - Scale to the change. Don't pay for a fan-out Workflow on a 60-line diff; don't review a 12-file multi-model change through one over-stretched context.
- Findings only. Return the report; the caller fixes (test-first) and may re-invoke to converge.
- Adversarial verification cuts noise. On the large path, every Critical/High finding is independently refuted before it's reported — the strongest lever against false positives.
0. Gate — skip if there is no reviewable code
Code review exists to review code — Swift source, plus the committed
scripts under .claude/workflows/ (decision infrastructure) and Scripts/
(enforcement infrastructure: check-defaulted-witnesses.py runs from make lint and as its own CI Lint step, so a bug there silently weakens a
gate — it shipped as a false green once already, passing on an empty scan).
If the diff touches none of them, there is nothing to review — return
immediately, don't spawn any reviewer.
git diff --name-only origin/main...HEAD \
| grep -qE '\.swift$|^\.claude/workflows/|^Scripts/' \
|| echo "no-reviewable-code"
If that prints no-reviewable-code (e.g. a docs-only, config-only, or
skills-prose change), stop here and report "No reviewable code — code
review skipped." Do not run §1–§3. (JSON fixtures under
Tests/**/Resources/ accompany Swift changes; a fixture-only change with no
.swift is rare — note it and let the caller decide.)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 303 lines · 0 tokens per session scan A 407109a42b31
review-changes is a skill published in the GitHub repository adamayoung/TMDb (176 stars, last pushed 8d ago), licensed Apache-2.0. It costs nothing until one of its globs matches a file; then it loads 4,013 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
remarc
Manage Remarc session comments and contextual feedback. Use when the user mentions Remarc sessions, comments, handoff, triage, review, addressing, resolving, status updates, or summaries.
capstone-radar
Unified A-F grading and ship/no-ship decisions for the 6-skill radar family (5 companions + capstone). Aggregates handoffs from data-model, ui-path, roundtrip, time-bomb, and ui-enhancer; owns 5 grep-reliable domains; tracks velocity; celebrates improvements. Triggers: "capstone radar", "can I ship", "grade codebase"…
time-bomb-radar
Finds deferred operations that crash on aged data -- code that passes every test but breaks weeks or months after release. Covers cascade deletes, cache expiry, trial paths, background accumulation, date-threshold transitions, and scheduled side effects. Triggers: "time bomb", "time-bomb", "/time-bomb-radar", "aged…
radar-suite-axis-classification
Shared axis classification framework for all radar-suite skills. Every finding must be classified as axis1 (bug), axis2 (scatter), or axis3 (dead/smelly) before emission, with mandatory coaching fields and file:line citations to existing patterns in the audited codebase. Triggers: invoked by every radar before…
radar-suite
Unified entry point for the 6-skill radar family (5 companions + capstone). Routes to individual skills, runs targeted (Tier 2) or full (Tier 3) audit sequences, owns the unified ledger, and provides cross-skill operations (status, verify, ledger, link, deferred, fresh/no-fresh). Triggers: "radar suite", "full audit"…
swift-focusengine-pro
Reviews, writes, and fixes focus management code for all Apple platforms (tvOS, iOS/iPadOS, watchOS, visionOS, macOS), covering SwiftUI, UIKit, AppKit, and RealityKit. Use when reading, writing, or reviewing apps that handle focus, hover, key view loops, or Digital Crown navigation.