Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add corveil/crow --skill crow-review-prgit clone --depth 1 https://github.com/corveil/crowWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/corveil/crow/crow-review-pr)<a href="https://agentmods.dev/skills/corveil/crow/crow-review-pr"><img src="https://agentmods.dev/badge/skills/corveil/crow/crow-review-pr.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00046 | $0.02982 |
| Opus 5 | $0.00023 | $0.01491 |
| Sonnet 5 | $0.00009 | $0.00596 |
| Haiku 4.5 | $0.00005 | $0.00298 |
Grade B, and why
crow-review-pr scanned grade B with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directorieslowAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
Checkout restores the PR head into the working tree, including attacker-controlled harness config that Crow stripped at launch (CROW-960: `.cursor/`, `.grok/`, `.agents/`, `.gemini/`, `.muse/`, `.codex/`, repo-root `.mcp Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Reads MCP configurationlowAgent snooping
mcp.json carries server URLs and auth tokens; reading it lets a mod discover and abuse other integrations.
Checkout restores the PR head into the working tree, including attacker-controlled harness config that Crow stripped at launch (CROW-960: `.cursor/`, `.grok/`, `.agents/`, `.gemini/`, `.muse/`, `.codex/`, repo-root `.mcp Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Recursive force deletemediumDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
rm -rf -- .cursor .grok .agents .gemini .muse .codex .mcp.json .claude/settings.json .claude/settings.local.json Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
How it starts
The opening of the file, as written. The whole thing — 243 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Crow Review PR
Perform a comprehensive code and security review on a GitHub pull request, then post the findings as a PR review.
Important: Sandbox Bypass
All gh and git commands require dangerouslyDisableSandbox: true because they need network/TLS access.
Arguments
$ARGUMENTS is the raw argument string. Parse it — never paste it whole into a command. A Crow review session passes just the PR reference, but a manual /crow-review-pr invocation may append flags (/crow-review-pr 2437 --no-post), and pasting the whole string makes step 1 gh pr checkout 2437 --no-post fail on an unknown flag.
- PR reference (required) — the first URL or number token in
$ARGUMENTS(e.g.2437orhttps://github.com/org/repo/pull/2437). Every command below writes it as$PR; setPRto it in Step 0 and pass"$PR"togh/git, never the raw$ARGUMENTS. --no-post/--dry-run(optional) — render the review to stdout and skip Step 5 (do not post). Use it when you are the PR author (GitHub rejects a self-review), when iterating on this skill, or when you want to read the findings before deciding to post. SetsPOST=false; otherwisePOST=true.
Activation
This skill activates when:
- User invokes
/crow-review-prcommand - User asks to "review a PR" or "review this pull request"
- This is a review session (the session was created via the Crow Reviews board)
Instructions
You are performing a code and security review on PR $ARGUMENTS. Follow these steps:
Step 0: Parse the arguments
Split $ARGUMENTS (see Arguments above) before running anything:
PR— the PR URL or number. Use"$PR"in everygh/gitcommand below; a stray--no-postreachinggh pr checkoutfails at the first command.POST—falseif$ARGUMENTScontains--no-postor--dry-run, otherwisetrue. Gates Step 5.
Step 1: Checkout the PR
gh pr checkout "$PR"
Checkout restores the PR head into the working tree, including attacker-controlled harness config that Crow stripped at launch (CROW-960: .cursor/, .grok/, .agents/, .gemini/, .muse/, .codex/, repo-root .mcp.json, .claude/settings.json, .claude/settings.local.json). Immediately after checkout — a separate Bash call, before any other tool use — re-strip those layers from the working tree. Do not chain the rm onto gh pr checkout with && (a compound misses the allowlist prefix). Do not git rm or git add them: the index entry must survive, same as SessionService.strip*ConfigFromReviewClone. Do not delete .claude/ wholesale — Crow's copied review skill lives under .claude/skills/.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 243 lines · 46 tokens per session scan B 8eee2dde3f0c
crow-review-pr is a skill published in the GitHub repository corveil/crow (18 stars, last pushed today), licensed Apache-2.0. It adds 46 tokens to every session and 2,982 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it B with 3 findings (reads agent configuration directories, reads mcp configuration, recursive force delete). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
remarc
Manage Remarc session comments and contextual feedback. Use when the user mentions Remarc sessions, comments, handoff, triage, review, addressing, resolving, status updates, or summaries.
adversarial-review
A multi-role code-review process that searches for problems, tries to disprove the proposed changes, and reproduces issues in a sandbox. Different agents or backends can take part in the review.
code-review
Multi-agent deep review for code PRs in any repo. Use when asked to "deep review this PR," "multi-agent review," "review.
security-review
Perform a focused security review of pending git changes to identify high-confidence security vulnerabilities with real exploitation potential. Use this skill when the user asks for a security review, security audit, vulnerability scan, or wants to check pending changes on a branch for security issues before merging.…
huggingface-llm-trainer
Train or fine-tune language models with TRL or Unsloth on Hugging Face Jobs, including SFT, DPO, GRPO, reward models, and GGUF conversion. Use for cloud LLM training; use huggingface-vision-trainer for vision tasks.
feature-dev
Guide a feature implementation through a structured seven-phase workflow with deep codebase understanding, clarifying questions, parallel architecture design, and quality review. Use this skill when the user asks to build a new feature, add functionality, or wants a methodical approach to implementation rather than…