caozhiyuan/copilot-api is a local AI gateway that exposes OpenAI Chat Completions, OpenAI Responses, and Anthropic Messages interfaces for multiple providers. It lets clients such as Claude Code, OpenCode, and Codex connect through one endpoint to GitHub Copilot, the built-in Codex provider, and other configured services.
Borrowing it
Nothing to install: this file belongs to caozhiyuan/copilot-api. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/caozhiyuan/copilot-api/dev/.agents/skills/copilot-api-code-review/SKILL.mdgit clone --depth 1 https://github.com/caozhiyuan/copilot-apiWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/caozhiyuan/copilot-api/copilot-api-code-review)<a href="https://agentmods.dev/skills/caozhiyuan/copilot-api/copilot-api-code-review"><img src="https://agentmods.dev/badge/skills/caozhiyuan/copilot-api/copilot-api-code-review.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00093 | $0.02890 |
| Opus 5 | $0.00046 | $0.01445 |
| Sonnet 5 | $0.00019 | $0.00578 |
| Haiku 4.5 | $0.00009 | $0.00289 |
Grade A, and why
copilot-api-code-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 187 lines — stays where its author put it; the contents beside it link to each section on GitHub.
copilot-api Code Review Guidelines
This skill is the project-specific code review standard for the copilot-api repository (a Bun/TypeScript API gateway providing OpenAI Chat Completions, OpenAI Responses, and Anthropic Messages compatibility over GitHub Copilot and third-party providers).
MUST NOT review using only git diff. Always combine the diff with surrounding code, related tests, configs, and project context.
Goal
Ship changes that are correct, safe, maintainable, and releasable with minimal overhead.
Scope
This document defines the review workflow, review standard, verification commands, and output format for this repository.
Anti-Hallucination Standard
Treat review findings as evidence-backed claims, not guesses.
- A finding must be based on inspected repository evidence: changed code, nearby implementation, callers/callees, tests, configs, schema, docs, or explicitly checked dependency behavior.
- Do not claim a file, symbol, test, config, command result, or dependency behavior was checked unless it was actually inspected or run.
- Do not turn missing context into a finding. Record missing context in
Context Checked,Test Notes, orRelease Riskas a limitation. - Verified findings must include all four parts: evidence, impact path, affected scenario, and concrete fix.
- If evidence is plausible but incomplete, report it as an unverified risk or open question outside the counted findings.
- It is acceptable to return zero findings. Never create a finding just to have something to report.
Required Context
Before judging a change, gather the minimum relevant context:
- Current change set:
git status,git --no-pager diff,git --no-pager diff --cached, and recent commits when needed. - Local code context: changed files plus nearby callers, callees, tests, config, schema, and related modules.
- Project docs:
AGENTS.md,README.md,CLAUDE.md,docs/, andpackage.jsonscripts. - Protocol contract types under
src/lib/types/(OpenAI Chat Completions, OpenAI Responses, Anthropic Messages) whenever a change touches request/response translation; verify every claimed field against these types instead of assuming it exists.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 187 lines · 93 tokens per session scan A 16590db9eeda
copilot-api-code-review is a skill published in the GitHub repository caozhiyuan/copilot-api (1,011 stars, last pushed yesterday), licensed MIT. It adds 93 tokens to every session and 2,890 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-05.
Other skills, from other repositories
plannotator
Reference for using the Plannotator CLI: plan review, code review, annotating files, URLs, folders, and running local apps, annotating the last assistant message, browsing archived plan decisions, and exporting or sharing Guided Reviews. Invoke when asked to use Plannotator for anything not covered by a more specific…
rework-rate
Measure and interpret PR rework rate — the emerging 5th DORA metric.
spec-kitty-mission-review
Review a fully merged Spec Kitty mission post-merge (all WPs done/approved) to verify spec→code fidelity, FR coverage, drift, risks, and security. Triggers: "review the merged mission", "post-merge mission review", "verify the completed mission", "audit the mission implementation", "mission-level acceptance review"…
spec-kitty-runtime-review
Review runtime-owned outputs using the Spec Kitty review workflow surface, then direct approval or rejection with structured feedback. Triggers: "review this work package", "check runtime output", "approve this step", "review WP", "is this WP ready to approve", "check this implementation". Does NOT handle: setup-only…
code-review-csharp
Perform structured code reviews of C# source code covering naming conventions, performance, security, readability, and .NET best practices. Trigger phrases include "review this C# code", "check my C# for best practices", "analyze this C# class", "find issues in my C# code".
remove-ai-slops
Removes AI-generated code smells from branch changes or an explicit file list behind regression tests. Use when the user asks to clean up, deslop, or remove AI-slop patterns from recent changes.