Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/bablsoft/accessflow/review-gh-prnpx skills add bablsoft/accessflow --skill review-gh-prgit clone --depth 1 https://github.com/bablsoft/accessflowWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/bablsoft/accessflow/review-gh-pr)<a href="https://agentmods.dev/skills/bablsoft/accessflow/review-gh-pr"><img src="https://agentmods.dev/badge/skills/bablsoft/accessflow/review-gh-pr.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00092 | $0.03641 |
| Opus 5 | $0.00046 | $0.01820 |
| Sonnet 5 | $0.00018 | $0.00728 |
| Haiku 4.5 | $0.00009 | $0.00364 |
Grade A, and why
review-gh-pr scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 262 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Review a GitHub pull request
CLAUDE.md is the authoritative rulebook and the agents under
.claude/agents/ do the actual reviewing. This skill only adds the
workflow that gets a PR onto disk, fans them out, and turns their reports into something you can
choose from.
Three properties define it:
- It explains the PR before it critiques it. The first thing you get is what the change actually does — read from the diff, not from the description — so the findings that follow have somewhere to land.
- Your working tree is never touched. The PR head goes into a throwaway git worktree. You can review a PR in the middle of your own work, on a dirty tree, without stashing.
- It never writes to GitHub. Not a comment, not a review, not an API call. The selected findings come back as markdown you paste yourself.
Inputs
A PR number (735), a #-prefixed number (#735), or a GitHub pull-request URL. Optional flag:
| Flag | Effect |
|---|---|
--verify |
Also dispatch af-verifier to run the real build gates locally. Slow — a backend PR pays a full mvn verify -Pcoverage. Without it, report gh pr checks instead, since CI already ran them. |
If the user omits the number, ask for it once and stop. Do not guess from gh pr list — the
wrong PR reviewed silently is worse than a question.
Workflow
1. Resolve the PR
gh pr view <n> --json number,title,body,url,state,author,headRefName,headRefOid,baseRefName,isCrossRepository,additions,deletions,files
gh pr checks <n>
gh api repos/<owner>/<repo>/pulls/<n> --jq .base.sha # the PR's base commit — see below
gh pr checks exits non-zero when checks are failing or pending — that is data, not an error;
capture the output and carry on.
base.sha is load-bearing — do not substitute origin/<baseRefName> for it. For a merged
PR the head is already an ancestor of the base branch, so git merge-base HEAD origin/main returns
HEAD itself and the diff comes back empty — every agent would then report "no files touched,
VERDICT: approve", which is the worst possible failure: a silent false pass. base.sha is the
commit the PR was actually opened against, and it gives the right diff for open and merged PRs
alike. Sanity-check it: git diff --shortstat <base.sha>...<headRefOid> must match the
additions/deletions from gh pr view. If it does not, stop and say so rather than reviewing a
diff you cannot account for.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 262 lines · 92 tokens per session scan A df4afc91c933
review-gh-pr is a skill published in the GitHub repository bablsoft/accessflow (4 stars, last pushed yesterday), licensed Apache-2.0. It adds 92 tokens to every session and 3,641 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
data-retention-policies
Automate the lifecycle of order and customer data — archive old records, anonymize personal data on request, and purge expired data on schedule.
connect_polaris_catalog
Guides the agent to ask the user for their preferred authentication mode and credentials when they request to connect to the Polaris catalog, rather than using default credentials.
setup-helper
Configure the build environment.
implementing-rbac-hardening-for-kubernetes
Harden Kubernetes Role-Based Access Control by implementing least-privilege policies, auditing role bindings, eliminating cluster-admin sprawl, and integrating external identity providers.
upgrading-golang
Upgrades Go version across the entire Chainloop codebase including source files, Docker images, CI/CD workflows, and documentation. Use when the user mentions upgrading Go, golang version, or updating Go compiler version.
custom-builtin-functions
Create a custom builtin function to be used in the Rego policy engine.