A pull-request review workflow that checks a change set for unnecessary complexity, correctness problems, performance issues, and security risks. A pull request is a proposed code change submitted for review.

Use it with a pull-request number, URL, or the current branch to inspect its diff and report tagged findings.

It gives a quick review of the changed code across four common sources of problems before the change is merged.

deadeye-pr — Skill for Claude Code by deepaksinghcs14

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add deepaksinghcs14/deadeye-cc --skill deadeye-pr

Clone the repo

git clone --depth 1 https://github.com/deepaksinghcs14/deadeye-cc

Made for: Claude Code.

Or install deadeye, the plugin that ships this one along with the rest of its 10 skills, 3 commands, 7 hooks.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/deepaksinghcs14/deadeye-cc/deadeye-pr/github.svg)](https://agentmods.dev/skills/deepaksinghcs14/deadeye-cc/deadeye-pr)

Your own site

<a href="https://agentmods.dev/skills/deepaksinghcs14/deadeye-cc/deadeye-pr"><img src="https://agentmods.dev/badge/skills/deepaksinghcs14/deadeye-cc/deadeye-pr/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/deepaksinghcs14/deadeye-cc/deadeye-pr"><img src="https://agentmods.dev/badge/skills/deepaksinghcs14/deadeye-cc/deadeye-pr.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 28 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 5,322 The whole file, excluding the scripts and references it only reads on demand.

Security scan C 3 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00028	$0.05322
Opus 5	$0.00014	$0.02661
Sonnet 5	$0.00006	$0.01064
Haiku 4.5	$0.00003	$0.00532

Measured yesterday against content hash 66547d50e237, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-10, from the pricing page.

Security

Grade C, and why

deadeye-pr scanned grade C with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Downloads and executes remote codemediumSupply chain

curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.

Docker base, or `curl | sh`. No auditor installed → say so, don't

Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.

Cloud metadata endpointmediumServer-side request forgery

One request to 169.254.169.254 can return temporary IAM credentials.

`target=http://169.254.169.254/` walks to your cloud metadata" lands;

Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

Docker base, or `curl | sh`. No auditor installed → say so, don't

skills/deadeye-pr/SKILL.md · 357 lines

How it starts

The opening of the file, as written. The whole thing — 357 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Deadeye PR Review

One shot over a whole pull request: four lenses, one pass, tagged findings. /deadeye-review runs this exact four-lens rubric locally against your working diff or the whole repo — this adds what a PR needs on top: resolving a real PR via gh, checking what other reviewers already said, huge-PR fan-out, and an opt-in post back to GitHub. /deadeye-guard stays the dedicated deep-security pass this lens is drawn from.

Scope

Resolve the target PR, then review only its diff:

An argument (a PR number like 123 or a full PR URL, after stripping --post) → that PR.
No argument → the PR for the current branch.
Fetch the diff and metadata with the GitHub CLI:
- gh pr diff <N> (or gh pr diff for the current branch) for the unified diff.
- gh pr view <N> --json title,body,additions,deletions,files,baseRefName,headRefName for the header.
Read the changed hunks plus enough surrounding context to judge a trust boundary or a caller contract — "is this input validated" and "does this break a caller" both need the code around the hunk, not just the + lines.

Preconditions and graceful degradation:

gh not installed or not authenticated → say so plainly and stop, or, if the user has a local branch, offer to review git diff <base>...HEAD instead. Do not invent PR contents.
Not a GitHub repo / no PR for the branch → say so; don't substitute a different scope.
Huge PR (~40+ changed files or a few thousand lines) → review it ALL: fan out one subagent per ~2,500-line package cluster, in parallel, each returning findings in the standard format. Cheapest tier that fits, floor tier 1 (sonnet) for real logic — tier 0 only for purely mechanical clusters (generated code, lockfiles, vendored deps, renames), top tier for a risky cluster (auth, crypto, concurrency, raw SQL/shell, money). Verify every finding yourself; never truncate or report partial coverage as complete. One integration pass over the combined findings after — an export removed in one cluster, its only caller in another (break:/contract:).

Read the full file on GitHub · 357 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

yesterday Changed · +10 lines 66547d50e237
2d ago Changed · +1 lines aa188a44ed00
5d ago Changed · +163 lines scan A → C a8ba0c12a362
11d ago First seen · 183 lines · 28 tokens per session scan A 93c14ad62e01

Subscribe to this mod's changes

deadeye-pr is a skill published in the GitHub repository deepaksinghcs14/deadeye-cc (5 stars, last pushed yesterday), licensed MIT. It adds 28 tokens to every session and 5,322 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it C with 3 findings (downloads and executes remote code, cloud metadata endpoint, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Claude Code Code review Security claude claude-code-plugin claude-skills

gemini

Cross-model second opinion from Google Gemini — a different AI reviewing the same changes, with deep Google ecosystem knowledge. Three modes: review (pass/fail gate for Google Ads campaigns, SEO metadata, or code), challenge (adversarial stress-test that tries to break your changes), and consult (open Q&A with Gemini…

nowork-studio/notfair-plugin · 184 tokens

critical-code-reviewer

Rigorously review code or pull requests for correctness, security, accessibility, maintainability, tests, and edge cases. Use when users request a critical code review, want a guided walkthrough of findings, need implementer-facing feedback, or want to prepare, create, or submit a GitHub pull request review.

posit-dev/skills · 67 tokens

deadeye-pr