A detailed review process for code changes in a pull request, with special checks for correctness, safety, performance, and .NET MAUI conventions.

Use it to analyze the implementation in a pull request or candidate patch when you want a thorough code-only review without running tests or changing the code.

It helps find defects and risky changes by assessing the code independently of the author's explanation.

code-review — Skill by dotnet

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods

npx agentmods add skills/dotnet/maui/code-review

Any agent

npx skills add dotnet/maui --skill code-review

Clone the repo

git clone --depth 1 https://github.com/dotnet/maui

Made for: Claude Code, Codex.

Per session 110 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 7,455 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 1 finding. Scan, not verified.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5	$0.00110	$0.07455
Opus 5	$0.00055	$0.03728
Sonnet 5	$0.00022	$0.01491
Haiku 4.5	$0.00011	$0.00745

Measured 2d ago against content hash 8255b2761e53, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

code-review scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

The scan reads SKILL.md. This mod also ships 2 executable files (tests/fixtures/producer-trace/src/.github/skills/review-test-failures/scripts/Gather-TestFailureContext.ps1, tests/fixtures/producer-trace/src/eng/devices/run-windows-devicetests.cmd), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

curl -fsSL -H 'Accept: application/vnd.github.patch' \

.github/skills/code-review/SKILL.md · 448 lines

How it starts

The opening of the file, as written. The whole thing — 448 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Code Review Skill

Standalone skill that evaluates PR code changes for correctness, safety, performance, and consistency with .NET MAUI conventions. Can be invoked directly by users or by other agents/skills.

Trigger phrases: "review code for PR #XXXXX", "code review PR #XXXXX", "review this PR's code", "analyze code changes in PR", "check PR code quality"

Do NOT use for: "what does PR #XXXXX do?", "summarize PR", "describe the changes", or any informational query — just answer those directly without invoking this skill.

How this differs from other skills:

pr-review — End-to-end PR workflow (4 phases: pre-flight, gate, try-fix, report). Use when you want the full pipeline including test verification and fix attempts.

pr-finalize — Verifies PR title/description match implementation + light code review. Use before merging.

code-review (this skill) — Deep code-only review with MAUI domain rules. Use when you want a thorough code analysis without running tests or modifying the PR.

Core Principles

Independence-first — Form your assessment from the code BEFORE reading the PR description. This prevents anchoring on the author's framing
Full-context — Read entire source files, not just diffs. Check callers, consumers, and git history
Empirical grounding — Reference specific code, line numbers, and call sites. No vague concerns
Severity calibration — Distinguish errors from warnings from suggestions. Not everything is critical
Failure-mode probing — Challenge your own conclusions with real failure scenarios, not softballs
Propagation-aware guards — For an early return, idempotency flag, or latch above downstream side effects, trace every set/clear path and a repeat call after recipients or state change. If that trace exposes concrete misbehavior, do not dismiss it as rare or rationalize it into LGTM: use NEEDS_DISCUSSION while the failure remains unresolved, or NEEDS_CHANGES when the exact state transition verifies a ❌ Error.
Authentication is not availability — A public GitHub PR remains reviewable when gh is unauthenticated. Never stop or ask for a token merely because a gh command failed; pivot immediately to anonymous public REST/web retrieval.

Read the full file on GitHub · 448 lines

Files

What ships with it

20 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

2d ago First seen · 448 lines · 110 tokens per session scan A 8255b2761e53

Subscribe to this mod's changes

code-review is a skill published in the GitHub repository dotnet/maui (23,317 stars, last pushed 2d ago), licensed MIT. It adds 110 tokens to every session and 7,455 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Code review dotnet hacktoberfest maui microsoft multi-platform user-interface

dpg-migration

Migration logic for Azure SDK for .NET data-plane libraries migrating from AutoRest/Swagger to TypeSpec-based generation. Uses MCP tools from the generator-agent server for automated deterministic fixes.

Azure/azure-sdk-for-net · 41 tokens

csharp-azure-spector-coverage-gaps

Discovers and implements gaps in Spector test coverage for the Azure C# HTTP client emitter. Use when asked to find missing Spector scenarios, add Spector test coverage, or implement a specific Spector spec for the Azure C# emitter. Can also compare coverage between the Azure dashboard and the Standard (TypeSpec core)…

Azure/azure-sdk-for-net · 78 tokens

auto-build-repair

Headless, bounded repair of custom-code build failures in an already-generated Azure SDK PR. Thin wrapper over the shared azure-sdk-mcp:azsdkcustomizedcodeupdate engine in custom-code-only scope (editScope: CustomCode); the skill owns the iterate-until-green loop, capped by a per-language maxIterations read from…

Azure/azure-sdk-for-net · 149 tokens

azure-sdk-mgmt-pr-review

Review Azure SDK management-plane pull requests, check naming conventions, API compatibility, and code quality.

Azure/azure-sdk-for-net · 26 tokens

mgmt-review-comment-resolution

Resolve review comments on Azure management-plane .NET SDK PRs. Handles renaming types/properties, changing property types, and other API surface adjustments by updating TypeSpec client.tsp and regenerating.

Azure/azure-sdk-for-net · 46 tokens

mitigate-breaking-changes

Patterns and techniques for mitigating breaking changes during Azure management-plane SDK migration from Swagger/AutoRest to TypeSpec. Covers SDK-side customizations (partial classes, CodeGenType, CodeGenSuppress) and TypeSpec decorator customizations (clientName, access, markAsPageable, alternateType…

Azure/azure-sdk-for-net · 68 tokens

code-review