Borrowing it
Nothing to install: this file belongs to deephaven/deephaven-mcp. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/deephaven/deephaven-mcp/main/.agents/skills/review-changes/SKILL.mdgit clone --depth 1 https://github.com/deephaven/deephaven-mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/deephaven/deephaven-mcp/review-changes)<a href="https://agentmods.dev/skills/deephaven/deephaven-mcp/review-changes"><img src="https://agentmods.dev/badge/skills/deephaven/deephaven-mcp/review-changes/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/deephaven/deephaven-mcp/review-changes"><img src="https://agentmods.dev/badge/skills/deephaven/deephaven-mcp/review-changes.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00077 | $0.01645 |
| Opus 5.5 | $0.00031 | $0.00658 |
| Sonnet 5.5 | $0.00015 | $0.00329 |
| Haiku 4.5 | $0.00008 | $0.00164 |
Grade A, and why
review-changes scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 51 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Review like a senior engineer. Every finding must answer three questions in concrete terms: what is wrong, what is better, why the change is worth its cost. All topics are fair game — correctness, security, design, duplication, clarity, naming, structure, tests. Be conscious of suggestions that do not serve a purpose.
Review the changeset described in the prompt. Common forms:
| Prompt | Git command to get changed files |
|---|---|
| "uncommitted changes" (default) | git diff HEAD --name-only |
| "changes on this branch" / "vs main" | git diff main...HEAD --name-only |
| "staged changes" | git diff --cached --name-only |
| "the last commit" | git diff HEAD~1 HEAD --name-only |
| "changes vs <branch>" | git diff <branch>...HEAD --name-only |
If no changeset is specified, default to uncommitted changes.
Steps
-
Identify changed files: Run the appropriate git command above to get the full list of changed files. If the changeset touches an area you have not worked in, load
ref-project-referencefirst for the module map — what each package owns and which types cross package boundaries. -
Review each file based on its type:
File type Skill to apply .pyreview-python-fileCLI help-bearing files ( cli/_commands/*.py,cli/_help.py,cli/_manifest.py,cli/_errors.py)review-python-filepluscli-help-accuracy(the surfaced help, error-code registry, and output schema must match the code anddocs/CLI.md)MCP tool signatures ( mcp_systems_server/_tools/*.py) or tool-wrapping CLI commands (cli/_commands/*.pysettingwraps_tool/wraps_tools)review-python-fileplus runuv run --extra test pytest tests/cli/test_tool_wrapper_drift.py -qand applyref-cli-tool-wrapping— a changed tool signature must be reflected in its wrapper's flags /intentionally_unsupported, and vice versa.md,.rstdocs-accuracyPydantic config ( config/schema/*.py,config/tree.py),*.json5examples underconfig-samples/ai/config/,docs/CONFIGURATION.mdref-configuration-conventionsdocs/ENV.mdref-configuration-conventionsplusdocs-accuracy— the canonical environment-variable inventory; verify every entry still matches its reader in the code.agents/skills/**/SKILL.md,AGENTS.mdskill-reviewplus runuv run pytest tests/agents/test_skills_catalog.py— it pins the frontmatter contract, the README row, and every section citation and canonical-implementation pointer across the catalog, none of which markdownlint checks.json,.json5,.yaml,.toml(config files outside the schemas above)ref-markdown-documentation-standardsfor inline doc-block formatting; verify syntax + cross-reference with any matching Pydantic schema.sh,bin/*,.github/workflows/*.yml(shell scripts, CI)Verify shellcheck-clean, set -euo pipefailfor new scripts, idempotent, and that any failure mode produces a non-zero exitOther Review for correctness and appropriateness — name the specific property being checked (e.g., "Dockerfile uses pinned base image", "lockfile changes match pyproject.toml") rather than gesturing -
Cross-cutting review — assess the changeset as a whole:
- Unrequested surface: List every new environment variable, config field, CLI flag, error code, output field, MCP tool, noun or verb, exit code, public export, config file kind — or any other user-visible contract — in the changeset, and name the requirement each traces to. A surface entailed by an approved change (a requested command's own flags and error codes) traces to that request and is in scope. Flag any that trace to none (
AGENTS.mdScope discipline). A well-executed unrequested feature — typed, tested, documented, fully covered — passes every other check in this list, so this is the only one that catches it. - New environment variable: Scan the whole diff — any file, including tests and docs — for an
os.environread, a clickenvvar=, or a new variable name. Each one must be explicitly requested and must carry itsdocs/ENV.mdentry in the same changeset. A JSON field plus${env:VAR}templating is the default answer; a new variable is a product decision, not an implementation detail. Applyref-configuration-conventions, pluscli-command-add's anti-patterns for CLI code. - Design consistency: Names, abstractions, and patterns introduced in one file match what siblings already use. Flag any new pattern that supersedes an existing one without also retiring the old one.
- Code changes that stale a skill: A changeset that adds, renames, or moves a module, or changes a symbol a skill names as a canonical implementation, staled a skill even when no skill file is in the diff. Check
ref-project-reference(the module map) and grep the catalog for the old path or symbol —grep -rn '<old-name>' .agents/ AGENTS.md. This is the case the per-file routing table cannot catch, because the skill file itself is unchanged. - DRY across files: Identify any block of substantive logic that appears in two or more changed files; either extract to a shared helper in this changeset or flag for follow-up.
- Test coverage of new code paths: Every new branch, error path, and public function in the changeset has at least one test that exercises it. List by file any new code paths with zero test coverage.
- Public-surface contract: Every new or modified
__all__,__init__.pyexport, MCP tool registration, CLI command, error code, or config field has its corresponding test pinning the surface (pertests-improvestep 1 for__init__.py; permcp-tool-addstep 4 for tool registration; percli-command-addfor CLI; perconfig-field-addfor config). - Output-payload consistency across tools/CLI: When the changeset touches more than one producer of a shared field (e.g., a field appearing in both an MCP tool return and the matching CLI wrapper), the emitted string values must agree exactly. Apply
ref-output-serialization-conventions. - ...or anything else at the changeset level that looks off — backward compatibility, dependency/lockfile drift, performance regressions, security exposure, documentation that no longer matches the code. This list is illustrative, not exhaustive; trust your judgment.
- Unrequested surface: List every new environment variable, config field, CLI flag, error code, output field, MCP tool, noun or verb, exit code, public export, config file kind — or any other user-visible contract — in the changeset, and name the requirement each traces to. A surface entailed by an approved change (a requested command's own flags and error codes) traces to that request and is in scope. Flag any that trace to none (
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 51 lines · 77 tokens per session scan A 670cda38a794
review-changes is a skill published in the GitHub repository deephaven/deephaven-mcp (5 stars, last pushed 2d ago), licensed Apache-2.0. It adds 77 tokens to every session and 1,645 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
autoreview
Structured code review through the shared OpenClaw agent-skills installation.
revdiff-plan
Review the last Codex assistant message (plan, analysis, or proposal) with inline annotations in a TUI overlay. Extracts the most recent response from Codex rollout files and opens it in revdiff for review and annotation. Activates on "revdiff-plan", "review plan with revdiff", "annotate plan", "review last response"…
explore-unknowns
Guide the user through a quadrant walk that maps the unknowns of a task — open by listing the known knowns, then work through known unknowns, unknown knowns, and unknown unknowns one stage at a time, ending with a complete four-quadrant map in the user's hands. Use when a request is ambiguous or underspecified, the…
asplos-writing-style
Use when drafting or revising ASPLOS prose — engineering the first two pages that rapid review actually reads, stating the cross-layer insight as one quotable sentence, structuring per-layer mechanism sections, writing bounded claims, and fitting everything into 11 self-contained pages that include figures and…
re0-merge
Review and land an external contribution the way this suite does: gate it against the thesis, land it with the author's credit intact, complete a new skill rather than merging it raw, then approve, credit, and explain before closing. Use when reviewing a pull request, as any collaborator or maintainer, not only the…
ring:mapping-feature-relationships
Mapping how features relate and phasing the work: categorizing PRD features, grouping them into domains, charting cross-feature journeys, dependencies, and integration points, and defining the binding Phases that plan.md mirrors one-to-one at Gate 7. Gate 2 of ring:planning-large-features; runs after…