What is workflow-code-review?

A structured code-review workflow for pull requests, branches, diffs, and uncommitted changes. It checks areas such as correctness, design, compatibility, validation, safeguards, and security.

Use it to review proposed or local code changes for defects, design problems, missing checks, compatibility risks, and security issues.

It gives a review broader coverage than checking only whether the code appears to work, without changing the code or managing the pull request.

workflow-code-review — Skill by closedloop-ai/claude-plugins

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add closedloop-ai/claude-plugins --skill workflow-code-review

Clone the repo

git clone --depth 1 https://github.com/closedloop-ai/claude-plugins

Made for: Claude Code, Codex.

Or install closedloop-core, the plugin that ships this one along with the rest of its 8 skills.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/closedloop-ai/claude-plugins/workflow-code-review/github.svg)](https://agentmods.dev/skills/closedloop-ai/claude-plugins/workflow-code-review)

Your own site

<a href="https://agentmods.dev/skills/closedloop-ai/claude-plugins/workflow-code-review"><img src="https://agentmods.dev/badge/skills/closedloop-ai/claude-plugins/workflow-code-review/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/closedloop-ai/claude-plugins/workflow-code-review"><img src="https://agentmods.dev/badge/skills/closedloop-ai/claude-plugins/workflow-code-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 60 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 12,969 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00060	$0.12969
Opus 5.5	$0.00024	$0.05188
Sonnet 5.5	$0.00012	$0.02594
Haiku 4.5	$0.00006	$0.01297

Measured today against content hash 0d2ec7da3a68, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

workflow-code-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

plugins/closedloop-core/skills/workflow-code-review/SKILL.md · 772 lines

How it starts

The opening of the file, as written. The whole thing — 772 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Workflow Code Review

Use this skill when the user wants a rigorous code review that borrows the best review fundamentals from the workflow prompt pack without running the goal workflow itself.

This skill reviews code, not plans. It must not create implementation plans, approval gates, manual loops, worktrees, PR lifecycle polling, commits, pushes, PR comments, or merges unless the user separately asks for that work.

Harness notes

Codex: invoke as $workflow-code-review. Launch each reviewer worker by spawning a subagent whose instructions are that lane's section below plus the target, requirement, and graph packets.
Claude Code: invoke as /closedloop-core:workflow-code-review. Launch each reviewer worker with the Agent (Task) tool, using a general-purpose subagent briefed the same way.
Paths like references/... are relative to this skill's folder, not the repository under review. The bundled prompt pack resolves from this skill's folder in both harnesses; it never depends on CODEX_HOME, ~/.codex, or ~/.claude.
MCP tool names can differ by harness (for example get_document or get-document). Use whichever name the session exposes for the tool this skill names.

Role Boundary

The coordinating agent is an orchestrator only. It must stay lean:

gather the target PR, branch, diff, plan URL, decision table, and repo guardrails needed to brief reviewers
launch independent reviewer workers
collect and deduplicate findings
present the consolidated review

The orchestrator must not perform the substantive review itself. If worker/subagent delegation is unavailable or not permitted in the current environment, stop and say that this skill requires worker-backed review instead of silently doing an inline review.

Prompt Pack Discovery

Before reading references or launching workers, read WORKFLOW_PROMPT_PACK_ROOT from the environment. If it is set, verify the path contains orchestrator.md and use it as the prompt pack root. If it is unset, or set to a path without orchestrator.md, use the prompt pack bundled with this skill: references/prompt-pack/, resolved from this skill's installed location. Verify the bundled root contains a sections/ directory; it carries only the lens files the lens map names, so it has no orchestrator.md. When an invalid WORKFLOW_PROMPT_PACK_ROOT was ignored, note that in the review coverage output. If neither path is available, continue without prompt pack lenses and note the gap in the review coverage output.

Read the full file on GitHub · 772 lines

Files

What ships with it

14 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

today Changed · +2 lines 0d2ec7da3a68
yesterday Changed 0f73eadc6dca
4d ago First seen · 770 lines · 60 tokens per session scan A 9afd8cd69430

Subscribe to this mod's changes

workflow-code-review is a skill published in the GitHub repository closedloop-ai/claude-plugins (122 stars, last pushed today), licensed Apache-2.0. It adds 60 tokens to every session and 12,969 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-06.

Claude Code Code review LLM Security agentic-ai ai-agents anthropic developer-tools

review-this-branch

Run the nohuman review gate (fresh-session adversarial reviewer + tamper guard) over the current branch or a GitHub pull request, with no server, no database, and no onboarding, and relay the pass/fail checklist.

no-human-ai/no_human · 53 tokens

tidy

Reviews a local diff, branch diff, or PR with file:line findings in confirmed and plausible tiers, gates any test the diff adds or changes, and in apply mode lands the fixes and diff-scoped simplifications. Use when asked to "review my changes", "code review", "tidy this", "simplify my diff", "deslop this"…

mblode/agent-skills · 144 tokens

pr-babysitter

Monitors or repairs an open GitHub PR: CI failures, conflicts, review threads, and merge readiness, reporting state changes. Use when asked to "watch this PR", "fix CI", "resolve conflicts", or "address review comments".

mblode/agent-skills · 55 tokens

pr-creator

Creates or updates GitHub PRs with house-style titles and bodies, issue linking, repository templates, and draft state. Use when asked to "create a PR", "open a PR", "rewrite the PR description", or "polish this PR".

mblode/agent-skills · 55 tokens

dx-audit

Audits libraries, CLIs, and SDKs using 38 rules for public contracts, package exports, piped output, errors, and configuration. Use when asked to "audit my CLI", "review my SDK", or diagnose package type resolution.

mblode/agent-skills · 54 tokens

id-impact

Two advisory pre-merge reads of an infra-delivery change. (v2) The POLICY-RISK read — surface foundryplanmodel.parsepolicyfindings output {rule, resource, severity, gating} and distinguish hard-FAIL-shaped (gating==deny) vs ackable-shaped (gating==warn ∧ severity==high ⇒ freeze a policy:high-blast-ack {rule…

lukasrepublic/agentic-foundry · 199 tokens