A pull-request review skill for evaluating proposed code changes and posting a quality verdict. A pull request is a request to merge changes into a shared codebase.

Use it to review a pull request by number, task ID, or current branch, either with an external reviewer or in a clean self-review process.

It provides an independent review step that can find problems before a change is merged.

review-pr — Skill for Claude Code by cryndoc/polisade-orchestrator

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add cryndoc/polisade-orchestrator --skill review-pr

Clone the repo

git clone --depth 1 https://github.com/cryndoc/polisade-orchestrator

Made for: Claude Code.

Or install polisade, the plugin that ships this one along with the rest of its 25 skills, 2 commands.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/cryndoc/polisade-orchestrator/review-pr/github.svg)](https://agentmods.dev/skills/cryndoc/polisade-orchestrator/review-pr)

Your own site

<a href="https://agentmods.dev/skills/cryndoc/polisade-orchestrator/review-pr"><img src="https://agentmods.dev/badge/skills/cryndoc/polisade-orchestrator/review-pr/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/cryndoc/polisade-orchestrator/review-pr"><img src="https://agentmods.dev/badge/skills/cryndoc/polisade-orchestrator/review-pr.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 113 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 11,672 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 1 finding. A grade says what 26 rules found in the file — not that it is safe. Third-party audits

NVIDIA SkillSpector warn 7 Sept 2026

SkillSpector: 4 findings, up to high

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

high Prompt Injection · line 65
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Fix: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content.
high Prompt Injection · line 65
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Fix: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content.
medium analysis-evasion · line 1
Suspicious Unicode normalization or mixed-script content

Fix: Review the flagged content for security risks. Ensure no credentials, secrets, or sensitive data are exposed.
medium Agent Snooping · line 66
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Fix: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.

How audits are shown

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00113	$0.11672
Opus 5.5	$0.00045	$0.04669
Sonnet 5.5	$0.00023	$0.02334
Haiku 4.5	$0.00011	$0.01167

Measured 9d ago against content hash 99ede559645e, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

review-pr scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

> Bare `git push` запрещён (push обязан проверяться сравнением remote SHA — OPS-028); самодельные REST/curl-вызовы к Bitbucket/GitHub запрещены; helper не транскрибируется в `/tmp`.

skills/review-pr/SKILL.md · 687 lines

How it starts

The opening of the file, as written. The whole thing — 687 lines — stays where its author put it; the contents beside it link to each section on GitHub.

/polisade:review-pr [PR# or TASK-XXX] [self] — PR Quality Review (external CLI or self)

Независимый quality review Pull Request. По умолчанию — через внешний reviewer CLI (OpenAI Codex, gpt-5.3-codex). С флагом self — через CLI текущего агента в отдельном процессе (чистый контекст).

Флаг self — для случаев, когда доступна подписка только на один агент. Ревью проводится тем же CLI, но в изолированном процессе.

Цикл: implement → PR → review-pr → fix замечаний → merge

Использование

/polisade:review-pr 42             # Review PR #42 через reviewer CLI
/polisade:review-pr TASK-001       # Найти PR для TASK-001
/polisade:review-pr                # Review PR текущей ветки
/polisade:review-pr 42 self        # Review PR #42 через текущий агент
/polisade:review-pr TASK-001 self  # PR для TASK + self-review
/polisade:review-pr self           # Текущая ветка + self-review

Архитектура

/polisade:review-pr 42
         |
         v
+-----------------------------------------+
|  ОСНОВНОЙ АГЕНТ                          |
|  1. Определить PR# и TASK-ID            |
|  2. Запустить Review субагент            |
+-----------------+-----------------------+
                  v
+-----------------------------------------+
|  СУБАГЕНТ (general-purpose)              |
|  1. Pre-fetch: pr-diff + pr-view (vcs.py)|
|  2. Bash: codex exec --full-auto         |
|     (или CLI текущего агента при self)    |
|  Ревьюер получает:                       |
|   - diff и PR description в промпте      |
|   - Читает TASK, parent, гайдлайны       |
|   - Анализирует код/тесты                |
|  3. pr-comment: публикация ревью в PR    |
|  Возвращает ревью с score и findings     |
+-----------------+-----------------------+
                  v
+-----------------------------------------+
|  ОСНОВНОЙ АГЕНТ                          |
|  Score >= 8 → merge                      |
|  Score < 8 →                             |
|    Improvement субагент → fix            |
|    → Re-review (макс. 2 итерации)        |
|  → After 2 iterations: STOP + waiting_pm |
+-----------------------------------------+

Read the full file on GitHub · 687 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

9d ago Changed 99ede559645e
13d ago Changed · -333 lines 363b8094143b
14d ago Changed · +77 lines 39e8a01328a9
15d ago Changed · +52 lines ead6b5696d5c
17d ago Changed · +38 lines cba698badcd4
18d ago Changed · +51 lines 06686b650b54
1mo ago Changed · +30 lines d29b5e29bb09
1mo ago Changed · +10 lines c5a6d713cbea
1mo ago Changed · +2 lines a54c1e4c0471
1mo ago First seen · 760 lines · 113 tokens per session scan A f2cc6b252630

Subscribe to this mod's changes

review-pr is a skill published in the GitHub repository cryndoc/polisade-orchestrator (7 stars, last pushed 9d ago), licensed Apache-2.0. It adds 113 tokens to every session and 11,672 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Autonomous Agents Claude Code Code review LLM ai-agents claude-code-plugin developer-tools

arrow-maintenance

Navigation and audit overlay for linked-intent development. Use when working with docs/arrows/ — orienting via index.yaml, auditing spec-to-code coherence, detecting reverse orphans and drift, splitting/merging/renaming/re-parenting segments. Dual-mode: ambient guidance when the overlay is present…

jszmajda/lid · 85 tokens

review-depth

Experimental declared review depth for linked-intent development. Use when a LID project's instruction file declares a review depth in prose (e.g. "Review depth - I review through LLD; below that, consolidate to one review") or the user asks to batch phase reviews, consolidate stops, or let go below a phase depth.…

jszmajda/lid · 93 tokens

bidirectional-differential

Audit coherence across an arrow of intent by running two parallel fresh Claude sessions — one reconstructs code from a single EARS, the other reconstructs the EARS from stripped code — then classifies the drift between them. Use when the user invokes /differential-audit, asks to audit EARS-to-code drift for a feature…

jszmajda/lid · 172 tokens

vanellus

Skill "vanellus" from markmhendrickson/ateles, covering vanellus — pr steward, identity, principals, core job and automated pr review (swarm-panel invocation).

markmhendrickson/ateles · 0 tokens

check-work

Check your work with a verification subagent that reviews diffs, runs builds and tests, and evaluates correctness. Read this file for instructions. Use when asked to "check work", "verify changes", "self-verify", "/check-work", "/check", "/verify", or "/self-verify".

RoyZhao1991/LingShu · 64 tokens

defect-hunting

Use when reviewing code, auditing an app, writing a guard rule or test, or certifying any threshold/constant/formula. Finds the defects a diff review structurally cannot see — the second write path, the mis-calibrated constant, the rule that cannot fail. Triggers from code-reviewer, /app-audit, qa-engineer…

vmobifystudio/app-dev-team · 96 tokens

review-pr