A pull-request review skill for evaluating proposed code changes and posting a quality verdict. A pull request is a request to merge changes into a shared codebase.

Use it to review a pull request by number, task ID, or current branch, either with an external reviewer or in a clean self-review process.

It provides an independent review step that can find problems before a change is merged.

review-pr — Skill for Claude Code and Codex by cryndoc

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add cryndoc/polisade-orchestrator --skill review-pr

Clone the repo

git clone --depth 1 https://github.com/cryndoc/polisade-orchestrator

Made for: Claude Code, Codex.

Or install polisade, the plugin that ships this one along with the rest of its 25 skills, 2 commands.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/cryndoc/polisade-orchestrator/review-pr/github.svg)](https://agentmods.dev/skills/cryndoc/polisade-orchestrator/review-pr)

Your own site

<a href="https://agentmods.dev/skills/cryndoc/polisade-orchestrator/review-pr"><img src="https://agentmods.dev/badge/skills/cryndoc/polisade-orchestrator/review-pr/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/cryndoc/polisade-orchestrator/review-pr"><img src="https://agentmods.dev/badge/skills/cryndoc/polisade-orchestrator/review-pr.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 113 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 11,917 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 1 finding. A grade says what 26 rules found in the file — not that it is safe. Third-party audits

NVIDIA SkillSpector warn 7 Sept 2026

SkillSpector: 4 findings, up to high

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

high Prompt Injection · line 65
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Fix: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content.
high Prompt Injection · line 65
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Fix: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content.
medium analysis-evasion · line 1
Suspicious Unicode normalization or mixed-script content

Fix: Review the flagged content for security risks. Ensure no credentials, secrets, or sensitive data are exposed.
medium Agent Snooping · line 66
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Fix: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.

How audits are shown

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00113	$0.11917
Opus 5	$0.00056	$0.05958
Sonnet 5	$0.00023	$0.02383
Haiku 4.5	$0.00011	$0.01192

Measured 2d ago against content hash f2cc6b252630, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-09, from the pricing page.

Security

Grade A, and why

review-pr scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

> Bare `git push` запрещён (инвариант #10 / OPS-028); самодельные REST/curl-вызовы к Bitbucket/GitHub запрещены; helper не транскрибируется в `/tmp`.

skills/review-pr/SKILL.md · 760 lines

How it starts

The opening of the file, as written. The whole thing — 760 lines — stays where its author put it; the contents beside it link to each section on GitHub.

/polisade:review-pr [PR# or TASK-XXX] [self] — PR Quality Review (external CLI or self)

Независимый quality review Pull Request. По умолчанию — через внешний reviewer CLI (OpenAI Codex, gpt-5.3-codex). С флагом self — через CLI текущего агента в отдельном процессе (чистый контекст).

Флаг self — для случаев, когда доступна подписка только на один агент. Ревью проводится тем же CLI, но в изолированном процессе.

Цикл: implement → PR → review-pr → fix замечаний → merge

Использование

/polisade:review-pr 42             # Review PR #42 через reviewer CLI
/polisade:review-pr TASK-001       # Найти PR для TASK-001
/polisade:review-pr                # Review PR текущей ветки
/polisade:review-pr 42 self        # Review PR #42 через текущий агент
/polisade:review-pr TASK-001 self  # PR для TASK + self-review
/polisade:review-pr self           # Текущая ветка + self-review

Архитектура

/polisade:review-pr 42
         |
         v
+-----------------------------------------+
|  ОСНОВНОЙ АГЕНТ                          |
|  1. Определить PR# и TASK-ID            |
|  2. Запустить Review субагент            |
+-----------------+-----------------------+
                  v
+-----------------------------------------+
|  СУБАГЕНТ (general-purpose)              |
|  1. Pre-fetch: pr-diff + pr-view (vcs.py)|
|  2. Bash: codex exec --full-auto         |
|     (или CLI текущего агента при self)    |
|  Ревьюер получает:                       |
|   - diff и PR description в промпте      |
|   - Читает TASK, parent, гайдлайны       |
|   - Анализирует код/тесты                |
|  3. pr-comment: публикация ревью в PR    |
|  Возвращает ревью с score и findings     |
+-----------------+-----------------------+
                  v
+-----------------------------------------+
|  ОСНОВНОЙ АГЕНТ                          |
|  Score >= 8 → merge                      |
|  Score < 8 →                             |
|    Improvement субагент → fix            |
|    → Re-review (макс. 2 итерации)        |
|  → After 2 iterations: STOP + waiting_pm |
+-----------------------------------------+

Read the full file on GitHub · 760 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

2d ago Changed · +197 lines f2cc6b252630
10d ago First seen · 563 lines · 113 tokens per session scan A 20ef3e86762a

Subscribe to this mod's changes

review-pr is a skill published in the GitHub repository cryndoc/polisade-orchestrator (7 stars, last pushed today), licensed Apache-2.0. It adds 113 tokens to every session and 11,917 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Autonomous Agents Claude Code Code review LLM ai-agents claude-code-plugin developer-tools

audit

This skill should be used when the user asks to "audit spec coverage", "find uncovered modules", "scan for missing specs", "check wyx coverage", "get spec TODO list", "wyx audit", "wyx", or wants a prioritized list of wyx skill commands for uncovered modules. Scans for coverage gaps, pipeline/sync candidates, and…

jlifyio/wyx · 81 tokens

link-check

Verify @file references in AIWG skills and agents against the linking contract — per-file or corpus-wide, with optional auto-fix.

jmagly/aiwg · 29 tokens

spawn-reviewers

Spawn and collect the reviewer fleet at stage20spawnreviewers. Consumes spawn.json.spec (the authoritative spawn spec from derive-spawn-spec / derive-static-spec), resolves GRAPHPROJECT, builds per-agent prompts from the per-agent template + role suffixes (Bug Hunter A/B, Unified Auditor, Domain Critics, Impact…

closedloop-ai/claude-plugins · 182 tokens

pr-reviewer

Reviews a diff or security scope read-only using evidence-tiered findings, structural and context-error rubrics, and repository review policy. Use when asked to "review my changes", "structural review", "review for AI patterns", or "security audit". For applying fixes use tidy; for UI defects use ui-design.

mblode/agent-skills · 68 tokens

verify-findings

Dispatch and collect the finding-verifier fleet at stage23verifyfindings (PLN-722). Reads verifymanifest.json (written by stage22bverifyprepare), spawns one falsify-oriented verifier Task per toverify[] entry with mode-specific Task scheduling (GitHub mode dispatches verifiers synchronously; local mode uses parallel…

closedloop-ai/claude-plugins · 171 tokens

codex-review

Run Codex to review a plan file and return structured feedback with a verdict. Triggers on: debate loop Codex review rounds. Returns VERDICT:APPROVED or VERDICT:NEEDSCHANGES plus CODEXSESSION token.

closedloop-ai/claude-plugins · 51 tokens

review-pr