ai-engineering: Skill for Claude Code

.agents/skills/ai-review/SKILL.md

ai-review is a skill for Claude Code from arcasilesgroup/ai-engineering. It costs 179 tokens per session (1,162 once invoked), scanned A, original, Apache-2.0.

A code-review skill that examines a change like an experienced senior engineer, checking its purpose, correctness, safety, boundaries, tests, and size.

In plain words
What is it for?
Use it to review a diff and produce specific findings tied to file and line, with the smallest suggested fix for each issue.
Why use it?
It helps catch problems that automated checks may miss, especially when a change does not match the agreed requirements or fails in unusual cases.

Skill for Claude Code

Written for Claude Code: disable-model-invocation in frontmatter. Also seen: installed under .agents/ (shared by several agents).

This is arcasilesgroup/ai-engineering's own configuration. It tells Claude Code how to work on ai-engineering itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything ai-engineering configures →

Reuse

Borrowing it

Nothing to install: this file belongs to arcasilesgroup/ai-engineering. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/arcasilesgroup/ai-engineering/main/.agents/skills/ai-review/SKILL.md
Clone the repo
git clone --depth 1 https://github.com/arcasilesgroup/ai-engineering

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for ai-review

README.md
[![agentmods](https://agentmods.dev/badge/skills/arcasilesgroup/ai-engineering/ai-review/github.svg)](https://agentmods.dev/skills/arcasilesgroup/ai-engineering/ai-review)
Your own site
<a href="https://agentmods.dev/skills/arcasilesgroup/ai-engineering/ai-review"><img src="https://agentmods.dev/badge/skills/arcasilesgroup/ai-engineering/ai-review/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for ai-review

Your own site · 80×15
<a href="https://agentmods.dev/skills/arcasilesgroup/ai-engineering/ai-review"><img src="https://agentmods.dev/badge/skills/arcasilesgroup/ai-engineering/ai-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 179 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,162 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits
  • NVIDIA SkillSpector pass 7 Sept 2026
How audits are shown
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00179 $0.01162
Opus 5 $0.00089 $0.00581
Sonnet 5 $0.00036 $0.00232
Haiku 4.5 $0.00018 $0.00116

Measured 10d ago against content hash 3096a16922be, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-09, from the pricing page.

Security

Grade A, and why

ai-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.agents/skills/ai-review/SKILL.md · 86 lines

How it starts

The opening of the file, as written. The whole thing — 86 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Judge the diff

The tier to ask for

Review is hard reasoning about a stranger's change; ask the top tier, the model the repository's [models] section configures for it — never a model name coded here, and never a provider the repository did not choose. model_router maps review (and plan and audit) to the top tier; if the pin leaves it unconfigured, fall back to default_tier. Say which tier you ran on so the command event's tier_model can be read against reality.

What it produces

Findings, each one at file:line, each with the smallest change that would resolve it.

Steps

  1. Read the spec and the plan first. Half of all real findings are "this is not what was agreed", and you cannot see those from the diff alone.
  2. Read the diff whole before commenting on any part of it. A finding about a line that the next hunk deletes wastes the author's afternoon. If it does not fit in one pass, say so in the first line of the report, review it in named parts, and list the parts you have not read. A truncated pass reads exactly like a complete one, which is the failure this framework exists to cure, arriving as a confident report about the half that fit.
  3. Work the checklists in references/, one lens at a time, and every lens in that directory is one of them: correctness, security, performance, testing, compatibility, architecture, simplification, docs, frontend and motion. Each is a separate pass; mixing them is how the security one gets skipped. Skip a lens the diff cannot touch and name the one you skipped — a lens nothing routes to is a checklist nobody works. Within each, follow the data flow: where the value enters, what may change it, where it is read. Then read the business rule the change encodes, not only the code — a lens applied to lines finds what is wrong, and only the rule says what is wrong here.
  4. Never report what a tool already reports. Formatting, lint, secrets, dependency vulnerabilities — those ran in CI, and repeating them buries the findings only a person could have made. If the gate did not run, say that instead of standing in for it.
  5. For each finding: what breaks, the inputs that break it, and the smallest fix. A finding without a failing scenario is an opinion, and it should be labelled as one.
  6. Before you call anything blocking, try to kill it, and default to dismissing: re-read the file around the line, not the hunk, and look for the guard, caller, framework behaviour or config that makes the scenario impossible. Dismiss it too when the bug is real and the fix you would propose is wrong, or worse than the code. A real bug you are unsure of still blocks; a theoretical one you are certain of does not. Say what you tried to kill and what lived.
  7. Say what is good, once, briefly, and only where it is load-bearing. Then rank findings by what you would actually block on.

Read the full file on GitHub · 86 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 10d ago First seen · 86 lines · 179 tokens per session scan A 3096a16922be

Subscribe to this mod's changes

ai-review is a skill published in the GitHub repository arcasilesgroup/ai-engineering (54 stars, last pushed yesterday), licensed Apache-2.0. It adds 179 tokens to every session and 1,162 once invoked, about $0.0009 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

rework-rate

Measure and interpret PR rework rate — the emerging 5th DORA metric.

bradygaster/squad · 20 tokens

audit

Audits recent work against its Definition of Done and project patterns. Runs the test suite, compares code against the spec, and reports PASS / PARTIAL / FAIL. Also runs the Critical Gate — a safety scan of the diff for destructive or dangerous operations. Generates an incremental prompt pack for any gaps found. With…

pe-menezes/vibeflow · 93 tokens

codex-review

Use this skill when users ask for code review, review pending changes, or inspect the latest commit with Codex-based review workflows. It prepares context, runs project linting, and reviews the result.

BenedictKing/benedictking-skills · 44 tokens

phoenix-review

Review completed work against the Intent Contract's acceptance criteria using objective evidence, not opinion — re-run every check, confirm no regressions, inspect the tamper-evident trace, and surface only real issues (bugs, unmet criteria, regressions). Use before shipping, after a feature is built, or when the user…

All-The-Vibes/ATV-Phoenix · 78 tokens

pr-classify

A pull-request review process that classifies findings as Critical, Important, or Optional. A pull request is a proposed code change submitted for review before it is merged into the project.

yuri-semenenko/ai-engineering-workspace · 94 tokens

pr-recheck

Second-pass re-review of a PR that already has review comments. Re-reads the diff and new commits against the existing open threads, marks each as addressed / partial / not addressed, resolves the addressed ones, and then either approves (only when everything is clean) or drafts new inline comments. Use when the user…

yuri-semenenko/ai-engineering-workspace · 109 tokens