Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add corveil/crow --skill crow-review-prgit clone --depth 1 https://github.com/corveil/crowWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/corveil/crow/crow-review-pr)<a href="https://agentmods.dev/skills/corveil/crow/crow-review-pr"><img src="https://agentmods.dev/badge/skills/corveil/crow/crow-review-pr/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/corveil/crow/crow-review-pr"><img src="https://agentmods.dev/badge/skills/corveil/crow/crow-review-pr.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00046 | $0.03891 |
| Opus 5.5 | $0.00018 | $0.01556 |
| Sonnet 5.5 | $0.00009 | $0.00778 |
| Haiku 4.5 | $0.00005 | $0.00389 |
Grade B, and why
crow-review-pr scanned grade B with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 13d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directorieslowAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
Checkout restores the PR head into the working tree, including attacker-controlled harness config that Crow stripped at launch (CROW-960: `.cursor/`, `.grok/`, `.agents/`, `.gemini/`, `.muse/`, `.codex/`, repo-root `.mcp Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Reads MCP configurationlowAgent snooping
mcp.json carries server URLs and auth tokens; reading it lets a mod discover and abuse other integrations.
Checkout restores the PR head into the working tree, including attacker-controlled harness config that Crow stripped at launch (CROW-960: `.cursor/`, `.grok/`, `.agents/`, `.gemini/`, `.muse/`, `.codex/`, repo-root `.mcp Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Recursive force deletemediumDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
rm -rf -- .cursor .grok .agents .gemini .muse .codex .mcp.json .claude/settings.json .claude/settings.local.json Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
How it starts
The opening of the file, as written. The whole thing — 290 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Crow Review PR
Perform a comprehensive code and security review on a GitHub pull request, then post the findings as a PR review.
Important: Sandbox Bypass
All gh and git commands require dangerouslyDisableSandbox: true because they need network/TLS access.
Arguments
$ARGUMENTS is the raw argument string. Parse it — never paste it whole into a command. A Crow review session passes just the PR reference, but a manual /crow-review-pr invocation may append flags (/crow-review-pr 2437 --no-post), and pasting the whole string makes step 1 gh pr checkout 2437 --no-post fail on an unknown flag.
- PR reference (required) — the first URL or number token in
$ARGUMENTS(e.g.2437orhttps://github.com/org/repo/pull/2437). Every command below writes it as$PR; setPRto it in Step 0 and pass"$PR"togh/git, never the raw$ARGUMENTS. --no-post/--dry-run(optional) — render the review to stdout and skip Step 5 (do not post). Use it when you are the PR author (GitHub rejects a self-review), when iterating on this skill, or when you want to read the findings before deciding to post. SetsPOST=false; otherwisePOST=true.
Activation
This skill activates when:
- User invokes
/crow-review-prcommand - User asks to "review a PR" or "review this pull request"
- This is a review session (the session was created via the Crow Reviews board)
Instructions
You are performing a code and security review on PR $ARGUMENTS. Follow these steps:
Step 0: Parse the arguments
Split $ARGUMENTS (see Arguments above) before running anything:
PR— the PR URL or number. Use"$PR"in everygh/gitcommand below; a stray--no-postreachinggh pr checkoutfails at the first command.POST—falseif$ARGUMENTScontains--no-postor--dry-run, otherwisetrue. Gates Step 5.
Step 1: Checkout the PR
gh pr checkout "$PR"
Checkout restores the PR head into the working tree, including attacker-controlled harness config that Crow stripped at launch (CROW-960: .cursor/, .grok/, .agents/, .gemini/, .muse/, .codex/, repo-root .mcp.json, .claude/settings.json, .claude/settings.local.json). Immediately after checkout — a separate Bash call, before any other tool use — re-strip those layers from the working tree. Do not chain the rm onto gh pr checkout with && (a compound misses the allowlist prefix). Do not git rm or git add them: the index entry must survive, same as SessionService.strip*ConfigFromReviewClone. Do not delete .claude/ wholesale — Crow's copied review skill lives under .claude/skills/.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 13d ago Changed · +1 lines 4a8269ffd8bb
- 20d ago Changed · +14 lines 8acb0c859740
- 1mo ago Changed · +32 lines 70cc0d7ba72b
- 2mo ago First seen · 243 lines · 46 tokens per session scan B 8eee2dde3f0c
crow-review-pr is a skill published in the GitHub repository corveil/crow (20 stars, last pushed yesterday), licensed Apache-2.0. It adds 46 tokens to every session and 3,891 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it B with 3 findings (reads agent configuration directories, reads mcp configuration, recursive force delete). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
pr-comments
Fetch and display GitHub PR review comments for the current branch.
webrev
Review any text that is not a diff - a plan, a markdown or text document, or a draft such as a PR body, an issue comment or a commit message - as a rendered page in a chromeless agterm HTML overlay, with notes on blocks, code lines and the whole file handed back as annotation records. Use when the user says "webrev"…
simplify
Clean up changed code while preserving intended behavior. Use when the user asks to simplify or improve code quality through reuse, simplification, efficiency, and abstraction reviews. Correctness bug hunting is outside scope.
cmd-review
Review the current diff or selected files (usage: /review [instructions | --last-diff | --target | --file | files...] [--style ]).
assess-patch-risk
Assess an immutable patch artifact's program impact, regression risk, and auto-merge eligibility. Use for generated patch files, provider pull-request diffs, or commit ranges when reviewers need evidence about affected runtime paths, contracts, tests, and recoverability. This skill is read-only and does not generate…
critty
Review code changes or a document with Critty's terminal UI and address the reviewer's inline comments round by round. Use when the user or an approval workflow selects Critty; a generic review request does not count.