Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add dmythro/agent-skills --skill coderabbitgit clone --depth 1 https://github.com/dmythro/agent-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dmythro/agent-skills/coderabbit)<a href="https://agentmods.dev/skills/dmythro/agent-skills/coderabbit"><img src="https://agentmods.dev/badge/skills/dmythro/agent-skills/coderabbit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/dmythro/agent-skills/coderabbit"><img src="https://agentmods.dev/badge/skills/dmythro/agent-skills/coderabbit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00148 | $0.09304 |
| Opus 5.5 | $0.00059 | $0.03722 |
| Sonnet 5.5 | $0.00030 | $0.01861 |
| Haiku 4.5 | $0.00015 | $0.00930 |
Grade C, and why
coderabbit scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
curl -fsSL https://cli.coderabbit.ai/install.sh | sh # also links `cr`; or: brew install coderabbit (no `cr`) Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -fsSL https://cli.coderabbit.ai/install.sh | sh # also links `cr`; or: brew install coderabbit (no `cr`) How it starts
The opening of the file, as written. The whole thing — 233 lines — stays where its author put it; the contents beside it link to each section on GitHub.
CodeRabbit CLI and Configuration
Local-first AI code review: catch issues before they reach the PR. The CodeRabbit CLI (coderabbit, alias cr) reviews working-tree or branch changes locally, so the PR-side review becomes confirmation instead of iteration -- this saves billable PR review rounds (both CodeRabbit's own quota and any Copilot credits). Covers the CLI surface -- local reviews, plus the beta cloud Coding Agent commands -- and .coderabbit.yaml tuning. PR-side mechanics (threads, re-requests, the bot loop) live in the git-pr skill.
Verified against CodeRabbit CLI v0.9.0 (2026-10-10): every subcommand's --help on the official build, diffed against v0.8.2, plus the CLI changelog and the agent-mode and cloud-task pages it links. Flags are tagged with the version that introduced them. The billed and pushing coderabbit code commands were not exercised; their handling comes from those docs. If coderabbit --version reports something newer, diff --help of each subcommand against this list and read the changelog entries since v0.9.0 before relying on flag details here.
When to Use
- Reviewing local changes -- "review my changes", "run coderabbit", pre-commit/pre-push/pre-PR checks
- Driving a review-fix loop -- run review, fix valid findings, re-run to verify
- Configuring CodeRabbit -- create or tune
.coderabbit.yaml, reduce review noise, disable redundant linters - Checking limits -- rate limits per plan, review budgeting
- Setting up the CLI -- install, auth, updates, headless/CI usage
- Running cloud Coding Agent tasks --
coderabbit code new/resume/push, handing a local session off to the cloud (beta, v0.9.0)
Critical Rules
- Reviews upload code to CodeRabbit's service. A review sends the diff (and context) to CodeRabbit. On a repo with sensitive/unpublished code, confirm the user is OK with that before the first run.
- Reviews consume a per-hour quota (Free: 3/hour CLI reviews). Scope deliberately (
--committed/--uncommitted,--base) and usecoderabbit review findingsto replay the last result without spending a review. - Use
--agentoutput when driving fixes programmatically; the default plain-text mode is for humans. There is no--plainflag: v0.7 removed it, and it fails witherror: unknown optionplus the usage text (v0.9 adds aRemove --plainhint). v0.8+ exits1on it; v0.7 exited0, so on an older binary a piped or tailed run looks clean while nothing was reviewed. Do not guess flags:coderabbit review --helpon the installed binary is the supported surface, and the hidden legacy aliases it omits still parse ----type <all|committed|uncommitted>and--lightboth start a real review. - Validate findings before fixing -- same rule as PR reviews: judge each finding on its merits; never blind-fix to silence the tool.
- CodeRabbit is optional -- check the Code Review Policy first (repo AGENTS.md/CLAUDE.md, falling back to the user's global agent instructions; see
git-prskill) for the preferred reviewer and checkpoints. Never install, authenticate, or run it on a project whose policy or user hasn't opted in. coderabbit codespends money and pushes code.new,ask, and messages sent throughresumestart billed agent work;pushand Autopilot write to the repository. Run them only on the user's explicit request, and never rerun one that already reported its commit point -- the rerun duplicates the billed work (references/cloud-tasks.md).
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago Changed · +57 lines · +23 tokens per session d6836750f964
- 19d ago Changed · +16 lines 0c5378e07bd2
- 27d ago Changed · +9 lines c2eeeaa58518
- 1mo ago Changed 3da777288e7b
- 1mo ago Changed · +9 lines 6911f1fff297
- 1mo ago First seen · 142 lines · 125 tokens per session scan C 212fa3022686
coderabbit is a skill published in the GitHub repository dmythro/agent-skills (7 stars, last pushed 10d ago), licensed MIT. It adds 148 tokens to every session and 9,304 once invoked, about $0.0006 per session on Opus 5.5. A static security scan graded it C with 2 findings (downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
compliance-privacy-reviewer
Reviews how a feature or system handles PII, data retention, and consent against common privacy-framework principles (GDPR-style). Use when a feature collects, stores, or processes personal data - not a substitute for legal advice.
adr-writer
Writes an Architecture Decision Record (ADR) documenting a decision, its context, the options considered, and its consequences. Use to record a decision that's already been made so future readers understand why.
architecture-reviewer
Reviews application architecture for scalability, coupling, separation-of-concerns, and maintainability issues. Use for system-level review, not individual file/function-level code review.
migration-planner
Plans a safe, incremental migration (framework, database, service, or platform) with rollback points and a dual-running strategy. Use when replacing something that's already in production and can't just be swapped in one step.
project-planner
Converts an idea into a structured development plan with milestones, tasks, dependencies, and implementation phases. Use when an idea or feature needs to be broken into a plan before work starts.
tech-debt-assessor
Inventories technical debt across a codebase and prioritizes it by cost-of-delay versus effort, producing a ranked paydown list. Use when debt is accumulating but it's unclear what to fix first.