Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add doodledood/manifest-dev --skill review-prgit clone --depth 1 https://github.com/doodledood/manifest-devWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/doodledood/manifest-dev/review-pr)<a href="https://agentmods.dev/skills/doodledood/manifest-dev/review-pr"><img src="https://agentmods.dev/badge/skills/doodledood/manifest-dev/review-pr.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 3 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Prompt Injection · line 12 Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.Fix: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content.
- medium Excessive Agency · line 56 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
- medium Excessive Agency · line 70 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00075 | $0.03602 |
| Opus 5 | $0.00037 | $0.01801 |
| Sonnet 5 | $0.00015 | $0.00720 |
| Haiku 4.5 | $0.00007 | $0.00360 |
Grade A, and why
review-pr scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 86 lines — stays where its author put it; the contents beside it link to each section on GitHub.
High-signal autonomous PR review posted under your account. A review you'd put your name on — precision over coverage.
Inputs. pr-url from the arg or the current branch's upstream PR. --manifest <path> switches the skill into manifest mode: it skips the generic reviewer fleet and independently verifies only the manifest's contract — it does not merely ground the fleet against author intent. Only in that mode, load references/MANIFEST_MODE.md for the verification mechanics; without --manifest, that reference is never read and review runs the generic review-code fleet. The skill does not auto-discover a manifest from any folder convention. --bundle <urls> plus PR-description linked-PR parsing (Depends on #N, Stack:, Co-changes:, GitHub PR URLs) provides cross-PR context for coupled changes. Resolve the PR, current head SHA, our prior GitHub reviews/comments/replies, open review threads, author commits, PR description, and linked-PR context before deciding what to do.
Self-marking. Posting under your own account means a human reviewer uses the same account, so authorship alone can't tell our automated comments from theirs. Stamp every body this skill posts — new finding comments, thread replies, the summary header, the approval body, and manifest-mode PASS/FAIL — with a trailing hidden marker <!-- manifest-dev:review-pr --> — a fixed literal string, byte-identical wherever review-pr runs (don't namespace-rewrite it per distribution, or comments posted by one host stop matching another's); GitHub strips it from the rendered comment but returns it through the API. This marker, not account authorship, is what makes a comment an automated review-pr comment: everywhere this skill says threads/comments we authored or replied to (or our prior reviews/comments) it means the ones carrying this marker, so an unmarked comment on our account reads as human and is left untouched. Manifest mode extends the marker with the criterion id (references/MANIFEST_MODE.md). Judgment-pass findings extend it with a judgment token — <!-- manifest-dev:review-pr judgment --> — so a prior judgment finding is distinguishable from an ordinary review-pr comment in both modes (the once-per-PR gate keys on this token).
One-Shot Pass
Every invocation, including non---loop, performs one complete PR-state advance:
- Advance our existing threads. For every unresolved thread we authored or replied to, run the per-thread verification below. Post needed thread replies, resolve terminal threads, and leave genuinely pending threads open.
- Verify the change. Manifest mode (
--manifest): loadreferences/MANIFEST_MODE.mdand follow it to verify the manifest contract against the PR head — the generic reviewer fleet is skipped entirely. No-manifest mode: run the generic reviewer fleet over the review range — determine that range from durable GitHub state: if we have a prior review on this PR and the head has moved since, use that review's commit/head SHA as the lower bound and reviewlast-reviewed-by-us..current-head; otherwise review the full PR diff. Later--loopwakes use that invocation's checkpoint instead, perreferences/LOOP.md. In both modes, the judgment pass (below) runs in parallel with the fleet/contract verification, gated to once per PR. - Post outcomes. Submit new surviving findings as a single GitHub review with decision
comment. Thread replies are posted on their existing threads, not as new review comments. End with the cycle summary below.
Each invocation starts from GitHub state and the current checkout. A --loop invocation then checkpoints completed verification for its later wakes, per references/LOOP.md; a fresh invocation always verifies again.
An invocation always verifies the change. Choosing to run review-pr again is the operator's call — often a risky change worth a second read, under a different model — so a fresh invocation reviews the head even when we already reviewed it and nothing has moved since. There is nothing to pass for this. The review range is then the full PR diff, and the prune below is what keeps the pass to whatever it has new to add: a second read that simply concurs posts nothing.
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago Changed · -11 lines 45cb8dde2346
- 3d ago Changed · -17 lines 8a7daaad2f20
- 8d ago First seen · 114 lines · 75 tokens per session scan A 7c1321268ad6
review-pr is a skill published in the GitHub repository doodledood/manifest-dev (73 stars, last pushed 3d ago), licensed MIT. It adds 75 tokens to every session and 3,602 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
triage-aging-prs
Drive an aging pull-request backlog to zero. Inventories every open PR, finds the STRUCTURAL blockers first (a required check that can never run, a reviewer that never fires, chronically red CI), triages every unresolved review thread in parallel and VERIFIES each finding against the code before fixing it, then merges…
review-comments
Systematically pull, categorize, and address all PR review comments — code change requests, questions, and suggestions. This skill fetches comments via gh api, groups them by file, implements fixes, handles disagreements diplomatically, and pushes a single commit. You should not try to handle PR review feedback…
merge-pr
Safely merge PR with verification and Linear integration. ALWAYS use when the user says 'merge the PR', 'merge this', 'ship it', or wants to merge an approved pull request. Runs tests, checks CI, verifies approvals, squash merges, cleans up branches, and moves Linear ticket to Done.
create-pr
Create pull request with automatic Linear integration. ALWAYS use when the user says 'create a PR', 'open a pull request', 'ship this', 'ready for review', or wants to push changes and create a GitHub PR. Handles commit, rebase, push, PR creation, description generation, and Linear ticket update.
describe-pr
Generate or update PR description with incremental changes. ALWAYS use when the user says 'describe the PR', 'update PR description', 'generate PR description', or after pushing new commits to an existing PR. Supports incremental updates that preserve manual edits.
release
Cut a brooks-lint release: set the version in package.json, propagate it across all four plugin manifests and every version-bearing text file (README badges, docs site metadata), write the CHANGELOG entry, validate, then commit, push, tag, and publish the GitHub release. Triggers when the maintainer asks to "release"…