Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/devstride/claude-plugin/reviewnpx skills add devstride/claude-plugin --skill reviewgit clone --depth 1 https://github.com/devstride/claude-pluginWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00040 | $0.08342 |
| Opus 5 | $0.00020 | $0.04171 |
| Sonnet 5 | $0.00008 | $0.01668 |
| Haiku 4.5 | $0.00004 | $0.00834 |
Grade A, and why
review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 460 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Human output. Read ${CLAUDE_PLUGIN_ROOT}/skills/build-item/references/plain-language-output.md once per top-level run; composed skills reuse it. Apply it to every message.
Take an open pull request through the full review-and-settle loop: run every review engine,
address each verified finding, reply-to and RESOLVE each addressed cloud thread, then release CI
and settle it green. The reusable engine pr composes; also runnable standalone as
/devstride:review <PR#>.
${CLAUDE_PLUGIN_ROOT}/skills/review/references/github-review-api.md holds the exact queries
and the evidence behind every API rule below. Read it when you execute a step that touches those
APIs — the rules here are the short form, and each exists because the alternative fails
silently.
Argument — a PR number, or empty for the current branch's open PR: $ARGUMENTS
Config. .claude/ds-config.json review.* is authoritative over any literal here, and so
is lessonsDoc — the per-repo lessons store this skill writes (fallback:
.claude/ds-lessons.md).
The two contracts
Spend full adversarial review at a merge boundary, and size it to the risk. A fast story
accumulating on an epic branch gets a bounded local risk screen; the epic release PR is its full
Claude + configured local + cloud pass. A direct PR, hotfix, epic release and production release
are merge boundaries. Scope/breadth come from delivery-profiles.md; model/effort come through
review-fanout.md from its engineering-economy route. Never repeat already-covered scope.
Before cycle 1 read ${CLAUDE_PLUGIN_ROOT}/skills/ultracode-build/references/review-fanout.md;
it is the canonical finder/verifier procedure.
Resolve the delivery profile BEFORE the roster; announce it with its source. Read
${CLAUDE_PLUGIN_ROOT}/skills/plan/references/delivery-profiles.md. This skill honours localCliEngine, maxLocalReviewRounds,
fixFloor, reviewer timeouts and releaseCiOrdering. Accept a caller's resolved name; else use
(argument → full-view root marker → config → standard). Apply overrideable profileOverrides;
reject a cycle-target override. Two cycles is fixed; P1/serious-P2 safety cycles have no numeric/local cap. Announce
("profile: standard — from
.claude/ds-config.json").
An explicit config key wins over the profile where a knob has its own key
(review.pollTimeoutMinutes): a PRESENT key is the operator's decision — honour it, report the
contradiction. Two review.* keys are NOT overrides of that kind: review.localCommand
NAMES the engine, it does not schedule it, and the three CI-ordering booleans describe what
the workflows SUPPORT. No profile bypasses a supported hold (the reasoning:
roster-and-modes.md).
Roster resolution — at the start of EVERY run, announced. From config plus probes, never assumption:
- Claude adversarial — intrinsic; always on a PR-boundary roster. A fast story's risk screen is not a substitute for the epic release pass.
- Local CLI engine — call it by
review.localReviewerName. On the roster iffreview.localCommandis non-null AND its first token resolves (command -vbefore launching);nullis a legal, documented value. A presentlocalCommandputs the engine on the roster for EVERY PR-boundary review under EVERY profile — release PR, one-off, hotfix. Routine fast stories defer it with the rest of the full roster. - Cloud reviewers — exactly the
review.automatedReviewersentries;[]is legal ("no cloud wave" — absent reviews are correct, not pending). - Draft-hold mechanics — per
review.openPullRequestsAsDraft/readyForReviewReleasesCi/ciHeldUntilReviewSettled. All true = review and pre-ship work finish before one CI release. Mixed values → use the strictest safe behavior and report the repair. All false with PR workflows = ungated and not optimized: CI may already be running; report/devstride:setup ci. No PR workflows = N/A.
Announce the resolved roster by name ("engines this run: Claude + Codex + Copilot" / "Claude
only — localCommand null, no cloud reviewers"). Configured-but-failing is NOT
not-configured: a probe failure or unresponsive configured reviewer is a degradation THIS RUN,
reported; an unconfigured engine is silent-by-design. A missing engine narrows the roster —
never a hard stop — with ONE floor: fast story merges require a completed local risk screen
(build-item step 4). With no config file present, the fallback roster is CLAUDE-ONLY —
nothing was configured to fail; proceed and say so. Substitute <effort> in a local command
from the canonical task/risk route. For a legacy Codex template with a literal
model_reasoning_effort, replace that value for this invocation; do not let stale config pin
every task to xhigh, and do not choose its model for the operator.
Read ${CLAUDE_PLUGIN_ROOT}/skills/review/references/roster-and-modes.md when a roster
resolves to fewer engines than the config declares, or before changing a mode definition — it
holds the fully-configured roster table and which paths never ran a Claude pass.
What ships with it
11 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- references/ci-settle.md 3.4 KB
- references/delivery-loop-invariants.md 45 KB
- references/delta-re-review.md 5.0 KB
- references/github-review-api.md 13 KB
- references/lessons-format.md 8.6 KB
- references/review-ledger.md 4.8 KB
- references/reviewer-latency.md 8.6 KB
- references/roster-and-modes.md 4.1 KB
- references/slow-suite-gating.md 4.8 KB
- scripts/rereview-scope.sh 5.6 KB runs code
- scripts/wait-for-reviewers.sh 19 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 460 lines · 40 tokens per session scan A 26e9818a2c1b
review is a skill published in the GitHub repository devstride/claude-plugin (2 stars, last pushed 3d ago), licensed MIT. It adds 40 tokens to every session and 8,342 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
systematic-debugging
Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.
next-cache-components-adoption
Turn on Cache Components in a Next.js app and resolve the blocking routes it surfaces. Use when the user wants to enable, adopt, or migrate to Cache Components, flip the cacheComponents flag, work through a flood of blocking-prerender / instant validation errors, run the cache-components-instant-false codemod, or…
babysit-pr
Babysit a GitHub pull request after creation by continuously polling review comments, CI checks/workflow runs, and mergeability state until the PR is merged/closed or user help is required. Diagnose failures, retry likely flaky failures up to 3 times, auto-fix/push branch-related issues when appropriate, and keep…
imagegen
Generate or edit raster images when the task benefits from AI-created bitmap visuals such as photos, illustrations, textures, sprites, mockups, or transparent-background cutouts. Use when Codex should create a brand-new image, transform an existing image, or derive visual variants from references, and the output…
cpu-profile-analysis
Analyze V8/Chrome CPU profiles (.cpuprofile) and DevTools trace files (Trace-.json). Use when: profiling performance, investigating slow functions, comparing code paths, finding bottlenecks, analyzing timeToRequest, understanding call trees from sampling profiler data, analyzing layout/paint/rendering, investigating…
next-cache-components-optimizer
Drive a Next.js route to instant navigation by setting up an agentic loop, under Cache Components / PPR, on initial load (hard navigation) and client-side navigation (soft navigation). Encode the goal as a failing @next/playwright instant() e2e and work it to green, one verified route at a time; the shipped test then…