A tool for drawing the architecture or data flow of a code change from its diff, the list of changes between two code versions. It creates a validated graph and renders it as an animated SVG for a GitHub pull request.

Use it to explain a pull request visually, show lanes, nodes, connections, and ordered flows, or correct a repository map in .github/pr-lens.yml.

It makes the shape and movement of a change easier to understand than reading the diff alone. Validation catches graph documents that do not follow the required format.

pr-lens — Skill for Claude Code and Codex by coldteadotai

About the project

PR Lens is a tool that turns a pull request into animated diagrams showing the software components it affects and the data flowing between them. Developers use it through GitHub, a command-line interface, or a coding agent to understand changes before reviewing code. The catalogue entries provide instructions and skills for using PR Lens with coding agents.

coldteadotai/pr-lens · 2,220 stars · on GitHub · prlens.dev

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add coldteadotai/pr-lens --skill agent-skill

Clone the repo

git clone --depth 1 https://github.com/coldteadotai/pr-lens

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/coldteadotai/pr-lens/agent-skill/github.svg)](https://agentmods.dev/skills/coldteadotai/pr-lens/agent-skill)

Your own site

<a href="https://agentmods.dev/skills/coldteadotai/pr-lens/agent-skill"><img src="https://agentmods.dev/badge/skills/coldteadotai/pr-lens/agent-skill/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/coldteadotai/pr-lens/agent-skill"><img src="https://agentmods.dev/badge/skills/coldteadotai/pr-lens/agent-skill.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 81 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 370 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits

NVIDIA SkillSpector warn 7 Sept 2026

SkillSpector: 7 findings, up to medium

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

medium MCP Rug Pull · line 23
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Fix: Pin the version: npx @scope/[email protected]
medium MCP Rug Pull · line 31
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Fix: Pin the version: npx @scope/[email protected]
medium MCP Rug Pull · line 39
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Fix: Pin the version: npx @scope/[email protected]
medium MCP Rug Pull · line 73
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Fix: Pin the version: npx @scope/[email protected]
medium MCP Rug Pull · line 81
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Fix: Pin the version: npx @scope/[email protected]
medium MCP Rug Pull · line 134
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Fix: Pin the version: npx @scope/[email protected]
medium Prompt Injection · line 144
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Fix: Remove the large whitespace padding (blank-line blocks or long space runs) and review any content hidden below or to the right of it. Keep skill files compact and reviewable so no instructions can be

How audits are shown

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00081	$0.00370
Opus 5.5	$0.00032	$0.00148
Sonnet 5.5	$0.00016	$0.00074
Haiku 4.5	$0.00008	$0.00037

Measured 19d ago against content hash d0260518613a, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

pr-lens scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 19d ago.

The scan reads SKILL.md. This mod also ships 5 executable files (scripts/mirror.ts, scripts/sync.ts, test/mirror.test.ts, …), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

Origin

Copies of this mod

1 near-identical copy found in the catalogue:

pr-lens — 100% identical, 0 lines differ

packages/agent-skill/SKILL.md · 30 lines

What it actually says

PR Lens

Animated architecture and data-flow diagrams for code changes and codebases. The agent writes one JSON document, and PR Lens draws it.

Run: npx @coldtea/pr-lens-cli@latest <command>. Nothing to install first.

Start here

This file is a discovery stub, not the usage guide. Before running any PR Lens command, load the actual workflow content from the CLI:

npx @coldtea/pr-lens-cli@latest skill              # start here: write, validate, render, share
npx @coldtea/pr-lens-cli@latest skill references   # the graph document field by field, the config format, a full example

The CLI serves skill content that always matches the installed version, so instructions never go stale. The content in this stub cannot change between releases, which is why it just points at skill.

Why PR Lens

Works with any coding agent (Claude Code, Codex, Gemini CLI, Cursor, OpenCode, Copilot)
Draws one self-contained animated SVG that GitHub shows in a comment, with no scripts
validate names the exact field that is wrong, so the agent can fix its own document
Opens as a live canvas you can step through and ask questions on
Needs no model key when the agent writes the document itself

Files

What ships with it

13 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

19d ago Changed · -380 lines d0260518613a
22d ago Changed · +27 lines ae34b6b5f373
26d ago Changed · +27 lines 000c8a141be6
28d ago Changed · +80 lines 0327fcd0563f
1mo ago Changed · +2 lines e393db38b74b
1mo ago Changed · +63 lines 7e3b8a7fa4c2
1mo ago Changed 20c6688d2c23
1mo ago Changed · +60 lines cbc642187e60
1mo ago Changed · +48 lines · -14 tokens per session 78299b80adbe
1mo ago First seen · 103 lines · 95 tokens per session scan A 9d96f4ef4c1b

Subscribe to this mod's changes

pr-lens is a skill published in the GitHub repository coldteadotai/pr-lens (2,220 stars, last pushed yesterday), licensed MIT. It adds 81 tokens to every session and 370 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Design and UX Git and workflow agent-skills architecture-as-code architecture-diagrams claude-skills code-visualisation codex

huashu-agent-swarm

Multi-agent swarm parallel collaboration using pure git self-organisation, ideal for large-scale project development. Use when the user mentions "swarm mode", "multi-agent", "parallel development", or "agent swarm".

Biraj2004/huashu-skills-english · 49 tokens

drawio-aws-reference

Produce AWS architecture diagrams as editable .drawio files using the AWS 2026 shape set (mxgraph.aws4 stencils), with verified stencil names and a validator. Use this whenever an AWS architecture diagram is requested, revised, or reviewed, including when the user only says "draw the architecture", "diagram this"…

patvillarroel/drawio-aws-reference · 119 tokens

archpresent

Turn a codebase into interactive architecture diagram as a single HTML file: four levels of drill-down, hover a port to see what the interface actually carries, hover an inventory row to see the real source snippet, and play back representative end-to-end scenarios. File/class/function inventories are extracted from…

lewes2/archpresent · 168 tokens

website-concept-architect

Walk the user through designing a website concept before any code — purpose, audience, content inventory, tone, visual archetype, structure — and output 2-3 distinct concept directions plus an ASCII homepage wireframe. Use when planning a new personal site, portfolio, or marketing page upstream of implementation.…

ralvarezdev/ralvaskills · 78 tokens

ui-ux-architect

UI/UX standards — WCAG 2.2 AA, Radix + Tailwind 4 + shadcn/ui, design-token theming, mandatory loading/error/empty/success states on every async surface, mobile-first responsive, keyboard parity, contrast checked in CI. Use when designing UI components, building a design system, or auditing accessibility.

ralvarezdev/ralvaskills · 77 tokens

archinsight

Create, edit, import, analyze, repair, validate, inspect, and render Archinsight Insight architecture-as-code models and custom views. Use when working with .ai models or .aiq queries, migrating architecture from another DSL or diagram, C4-style architecture models, system/container/component/code diagrams, deployment…

lonely-lockley/archinsight · 84 tokens