A guide to the CodeRabbit command-line tool, which reviews code changes on your computer, and its repository configuration file.

Use it to review uncommitted or committed changes, configure CodeRabbit with .coderabbit.yaml, check usage limits, and repeat a fix-and-review cycle. Reviews send the code diff and related context to CodeRabbit's service.

It helps find problems before changes are pushed or included in a pull request, reducing repeated review cycles. It also helps reduce noisy or duplicate findings.

coderabbit — Skill by dmythro

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods

npx agentmods add skills/dmythro/agent-skills/coderabbit

Any agent

npx skills add dmythro/agent-skills --skill coderabbit

Clone the repo

git clone --depth 1 https://github.com/dmythro/agent-skills

Made for: Claude Code, Codex.

Per session 125 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 3,749 The whole file, excluding the scripts and references it only reads on demand.

Security scan C 2 findings. Scan, not verified.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5	$0.00125	$0.03749
Opus 5	$0.00063	$0.01875
Sonnet 5	$0.00025	$0.00750
Haiku 4.5	$0.00013	$0.00375

Measured 2d ago against content hash 212fa3022686, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade C, and why

coderabbit scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Downloads and executes remote codehighSupply chain

curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.

curl -fsSL https://cli.coderabbit.ai/install.sh | sh # or: brew install coderabbit

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

curl -fsSL https://cli.coderabbit.ai/install.sh | sh # or: brew install coderabbit

skills/coderabbit/SKILL.md · 142 lines

How it starts

The opening of the file, as written. The whole thing — 142 lines — stays where its author put it; the contents beside it link to each section on GitHub.

CodeRabbit CLI and Configuration

Local-first AI code review: catch issues before they reach the PR. The CodeRabbit CLI (coderabbit, alias cr) reviews working-tree or branch changes locally, so the PR-side review becomes confirmation instead of iteration -- this saves billable PR review rounds (both CodeRabbit's own quota and any Copilot credits). Covers the CLI surface and .coderabbit.yaml tuning. PR-side mechanics (threads, re-requests, the bot loop) live in the git-pr skill.

When to Use

Reviewing local changes -- "review my changes", "run coderabbit", pre-commit/pre-push/pre-PR checks
Driving a review-fix loop -- run review, fix valid findings, re-run to verify
Configuring CodeRabbit -- create or tune .coderabbit.yaml, reduce review noise, disable redundant linters
Checking limits -- rate limits per plan, review budgeting
Setting up the CLI -- install, auth, headless/CI usage

Critical Rules

Reviews upload code to CodeRabbit's service. A review sends the diff (and context) to CodeRabbit. On a repo with sensitive/unpublished code, confirm the user is OK with that before the first run.
Reviews consume a per-hour quota (Free: 3/hour CLI reviews). Scope deliberately (--committed/--uncommitted, --base) and use coderabbit review findings to replay the last result without spending a review.
Use --agent output when driving fixes programmatically; the default plain-text mode is for humans.
Validate findings before fixing -- same rule as PR reviews: judge each finding on its merits; never blind-fix to silence the tool.
CodeRabbit is optional -- check the Code Review Policy first (repo AGENTS.md/CLAUDE.md, falling back to the user's global agent instructions; see git-pr skill) for the preferred reviewer and checkpoints. Never install, authenticate, or run it on a project whose policy or user hasn't opted in.

Setup

curl -fsSL https://cli.coderabbit.ai/install.sh | sh   # or: brew install coderabbit
coderabbit auth login        # browser OAuth; --agent emits JSON for agent-driven login
coderabbit auth status       # verify
coderabbit doctor            # diagnose runtime/auth/connectivity issues

Read the full file on GitHub · 142 lines

Files

What ships with it

2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

2d ago First seen · 142 lines · 125 tokens per session scan C 212fa3022686

Subscribe to this mod's changes

coderabbit is a skill published in the GitHub repository dmythro/agent-skills (5 stars, last pushed 4d ago), licensed MIT. It adds 125 tokens to every session and 3,749 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it C with 2 findings (downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Code review ai ai-agent ai-coding ai-skill ai-skills

playwright-best-practices

Use when writing Playwright tests, fixing flaky tests, debugging failures, implementing Page Object Model, configuring CI/CD, optimizing performance, mocking APIs, handling authentication or OAuth, testing accessibility (axe-core), file uploads/downloads, date/time mocking, WebSockets, geolocation, permissions…

currents-dev/playwright-best-practices-skill · 214 tokens

mission-driver

Create roadmaps and mission configs, then drive the mission-driver AI dev-loop engine. mission-driver lives at tools/mission-driver/ — it reads missions/ .json and loops CHECK → REVIEWPLANS → EXECPLANS → DRAFTPLANS → DEEPAUDIT until the roadmap is done or the audit budget is exhausted. Use this skill when the user…

entropy-cloud/attractor-guided-engineering-template · 199 tokens

ultimate-seo-geo

Audits and optimizes websites for search engine visibility (SEO) and AI search citation (GEO), covering technical health, E-E-A-T content scoring, domain authority, structured data, rich results, and entity signals. Use when running SEO audits, diagnosing traffic drops or ranking losses, generating Schema.org JSON-LD…

mykpono/ultimate-seo-geo · 144 tokens

create-supervisor

Create, update, list, and safely maintain evidence-bounded graduate-advisor Skills from comments, meeting notes, chat logs, documents, and user corrections. Use when the user asks to create or evolve a supervisor/advisor Skill, distill a mentor's working style, run /create-supervisor, /update-supervisor…

UniversePeak/Supervisor.skill · 81 tokens

se-dev-server-code

Allows reading the decompiled C# code of the Space Engineers Dedicated Server.

CometWorks/skills · 19 tokens

se-dev-game-code

Allows reading the decompiled C# code of Space Engineers version 1.