A local code-review workflow for the Plumb Rust project. It reviews a GitHub pull request or a local change, checks project instructions, classifies affected crates, and drafts a structured review.

Use it to review a pull request or local diff, focus the review with extra instructions, identify blockers and warnings, and prepare a markdown review without posting it by default.

It gives local changes the same review process used by the project’s automated workflow, while highlighting security-sensitive Rust, browser-control, agent-tool, dependency, and configuration changes.

gh-review — Skill by aram-devdocs

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods

npx agentmods add skills/aram-devdocs/plumb/gh-review

Any agent

npx skills add aram-devdocs/plumb --skill gh-review

Clone the repo

git clone --depth 1 https://github.com/aram-devdocs/plumb

Made for: Claude Code, Codex.

Per session 63 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 918 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. Scan, not verified.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5	$0.00063	$0.00918
Opus 5	$0.00032	$0.00459
Sonnet 5	$0.00013	$0.00184
Haiku 4.5	$0.00006	$0.00092

Measured 2d ago against content hash f9e514a98bb2, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

gh-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

The scan reads SKILL.md. This mod also ships 2 executable files (scripts/gh_review.py, scripts/validate_skill.py), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.agents/skills/gh-review/SKILL.md · 79 lines

How it starts

The opening of the file, as written. The whole thing — 79 lines — stays where its author put it; the contents beside it link to each section on GitHub.

/gh-review — local PR review for Plumb

Run the same review shape used by the GitHub review workflow, but locally and in dry-run mode by default. Target repo: aram-devdocs/plumb.

Usage

/gh-review 42
/gh-review 42 --instructions "focus on new MCP tool schema"
/gh-review --local-diff main...HEAD
/gh-review --local-diff HEAD~3..HEAD --instructions "check docs tone"

Inputs

PR mode: review an existing GitHub PR by number.
Local diff mode: review an unpublished or pre-PR diff range.
Optional instructions: extra reviewer focus areas.

Workflow

Read AGENTS.md and every scoped crates/*/AGENTS.md for touched crates.
Mirror .github/workflows/claude-code-review.yml — same rules, same verdict format.

Gather review context:

python3 .agents/skills/gh-review/scripts/gh_review.py --pr <number>
python3 .agents/skills/gh-review/scripts/gh_review.py --local-diff main...HEAD

Inspect high-risk files manually:
- plumb-cdp changes need a security pass (unsafe + CDP surface).
- plumb-mcp changes need a security pass (agent-exposed tool surface).
- Dependency changes need a cargo-deny pass.
- Config/schema changes need a cargo xtask pre-release pass.
Draft the review body using .agents/skills/gh-review/assets/review-template.md.
Only post with --post after confirming the draft is accurate.

Review contract

File buckets: plumb-core, plumb-format, plumb-cdp, plumb-config, plumb-mcp, plumb-cli, xtask, docs, ci, deps.
Blockers and warnings follow references/workflow-contract.md.
Output ends with exactly one verdict:
- Verdict: APPROVE
- Verdict: REQUEST_CHANGES
- Verdict: BLOCK

Output

Default output is markdown to stdout. Optional flags:

python3 .agents/skills/gh-review/scripts/gh_review.py --pr <number> --output /tmp/review.md
python3 .agents/skills/gh-review/scripts/gh_review.py --pr <number> --post

Rules

Dry run is the default. Never post comments automatically.
Use the exact section order from the GitHub workflow template.
Blocker-class findings (Rust):
- New unsafe outside plumb-cdp.
- New unwrap/expect/panic! in a library crate.
- New println!/eprintln! outside plumb-cli.
- New SystemTime::now/Instant::now/std::env::temp_dir in plumb-core.
- New todo!/unimplemented!/dbg! anywhere.
- New HashMap/HashSet in observable output paths (prefer IndexMap).
- New dep with GPL/AGPL/LGPL license (cargo-deny will catch; surface in review).
- Rule added without a golden test + register_builtin entry + docs/src/rules/ page.
- MCP tool added without a protocol test in crates/plumb-cli/tests/mcp_stdio.rs.
- Config schema changed without cargo xtask schema update committed.
- Binary size regression ≥ 25 MiB (the CI size-guard job would fail).
If docs/src/** changed, run the humanizer skill before approving.
For plumb-cdp or plumb-mcp changes, add explicit security commentary even if verdict is clean.

Read the full file on GitHub · 79 lines

Files

What ships with it

4 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

2d ago First seen · 79 lines · 63 tokens per session scan A f9e514a98bb2

Subscribe to this mod's changes

gh-review is a skill published in the GitHub repository aram-devdocs/plumb (2 stars, last pushed 1mo ago), licensed Apache-2.0. It adds 63 tokens to every session and 918 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Code review chromium cli css design-system design-tokens developer-tools

extract-design

Extract the full design language from any website URL. Produces 8 output files including AI-optimized markdown, visual HTML preview, Tailwind config, React theme, shadcn/ui theme, Figma variables, W3C design tokens, and CSS variables. Also runs WCAG accessibility scoring. Use when user says 'extract design', 'get…

Manavarya09/design-extract · 98 tokens

designlang-tokens

Use when styling UI for cal.com — references the extracted design system tokens instead of inventing colors, spacing, or typography.

Manavarya09/design-extract · 30 tokens

uisandbox

Open a real, built web app in UISandbox — the interactive sandbox in the user's browser, 1:1, with the app's own knobs (brand, colours, fonts, radius, spacing…) — or test one change headlessly, verify it still renders 1:1, get a screenshot and the patch. Use when someone wants to look at their app in a sandbox and…

Ideelab/uisandbox · 155 tokens

design-md-extractor

Extract and document the visual style of public websites as reusable DESIGN.md files. Use when the user asks to analyze a website's design system, extract styles, create design tokens, produce DESIGN.md, generate an agent-readable style guide, or build from a website's visual language.

jpoindexter/design-md-extractor · 60 tokens

design-dna

Extract, define, and apply design DNA across three dimensions: design system (tokens), design style (qualitative feel), and visual effects (Canvas, WebGL, 3D, particles, shaders, scroll effects, etc.). Use this skill when: (1) a user wants to see the full 3-dimension design structure/schema, (2) a user provides…

zanwei/design-dna · 192 tokens

ss-motion

Apply a named StyleSeed motion to a component — either one of the 5 personality seeds (Spring/Silk/Snap/Float/Pulse × entrance/exit/hover/press/layout) or a distinctive keyword move from the motion library (toggle-flip, toggle-curtain, reveal-blur, pop-in, shimmer, …). Translates vibe words into framer-motion code…

bitjaru/styleseed · 85 tokens