Borrowing it
Nothing to install: this file belongs to fitlab-ai/agent-infra. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/fitlab-ai/agent-infra/main/.agents/skills/review-pr/SKILL.mdgit clone --depth 1 https://github.com/fitlab-ai/agent-infraWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/fitlab-ai/agent-infra/review-pr)<a href="https://agentmods.dev/skills/fitlab-ai/agent-infra/review-pr"><img src="https://agentmods.dev/badge/skills/fitlab-ai/agent-infra/review-pr/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/fitlab-ai/agent-infra/review-pr"><img src="https://agentmods.dev/badge/skills/fitlab-ai/agent-infra/review-pr.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00058 | $0.03531 |
| Opus 5.5 | $0.00023 | $0.01412 |
| Sonnet 5.5 | $0.00012 | $0.00706 |
| Haiku 4.5 | $0.00006 | $0.00353 |
Grade A, and why
review-pr scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 194 lines — stays where its author put it; the contents beside it link to each section on GitHub.
审查 PR
根据目标 PR 的生命周期证据完整度与变更风险，选择 verify（轻量复核）、audit（证据审计）或 reconstruct（重建式审查），并把可执行的检视结论作为正式 PR Review 发布到目标 PR，同时保留可追溯的审查过程证据（pr-review.md / pr-review-r{N}.md）。
行为边界 / 关键规则
持久化报告证据
生成 PR 审查报告时，先读取 .agents/rules/evidence-reporting.md。正常审查记录命令、范围、结构化结果、实际结论和未覆盖部分；正式 Review、finding、阻塞或争议的身份字段和决定性证据必须精确保留。
- 严格遵循方案中固化的证据分级主决策流：宿主解析 → 证据分类 → 新鲜度/对齐 → 风险分级 → 模式选择
pr-review*是独立 artifact family：不接入 analysis/plan/code 阶段依赖链，不修改current_step- PR 上只发布正式 PR Review（head SHA、结论、finding、receipt、Issue artifact 链接），不发第二份完整过程原文到 PR 普通评论
- 完整过程原文与
task.md的可逆镜像只在关联 Issue 上同步；restore-task保持 Issue-only 契约 - 生成会同步到 Issue 的 artifact Markdown 前，先读取
.agents/rules/sync-content-generation.md并遵循其中的生成端约束；Issue 同步保持透明，不解析或改写正文 - 不得为外部 PR 倒填或伪造已发生的
analysis/plan/code生命周期历史 - head SHA 唯一记录于
pr-review*与正式 PR Review；head 漂移必须进入新轮次，不得沿用旧结论 - 审查深度由证据完整度和变更风险决定，不由提交者身份决定
- 执行本技能后，你必须立即更新 task.md（经
task-activitytyped intent） - 绝不自动执行
git add或git commit - 一次性检视路径（无任务/Issue）走
<task-workspace>/reviews/{pr-number}/，标记recoverable: false，不承担可恢复承诺
常见违规借口与反驳
| 借口 | 反驳 |
|---|---|
| 「代码 diff 直接看就行了，不需要重建上下文」 | 仅看 diff 会遗漏需求边界、架构选择与迁移策略；reconstruct 必须先产出最低充分重建记录。 |
| 「PR 没有关联任务，直接写个报告发出去」 | 默认阻塞并要求先关联 Issue/task；只有显式「仅一次性检视」才走不可恢复降级路径。 |
| 「把完整重建过程也发到 PR 普通评论，方便贡献者看」 | 过程原文只同步到 Issue artifact 评论；PR 只保留正式 Review，避免重复远端副本与恢复源混淆。 |
| 「审查完了顺手提交一下」 | 本技能绝不执行 git add/git commit；提交是用户显式发起的独立步骤。 |
第 0 步：状态核对（执行前硬约束）
在加载本技能与相关规则后、做任何任务状态判断或用户可见结论之前，必须先执行状态核对：
agent-infra-internal task-snapshot {task-id} --format text
任务锚定路径在开始前记录当前任务目录与既有 pr-review* 轮次；一次性路径（无任务）记录 PR 编号与目标目录。将命令、PR/head、审查范围、关键结果和未覆盖部分写入本轮产物 pr-review-rN.md 的 ## 状态核对 段；正常成功不粘贴完整目录清单或 task.md 尾部，身份不一致、失败、阻塞或争议时保留决定性原文行。
执行步骤
1. 解析入参与宿主解析
解析目标 PR 编号 {pr-number}（--pr <number>，或 PR URL，或省略时按当前分支反查）。执行：
agent-infra-internal platform-pr-review inspect --pr {pr-number} [--cwd <path>]
agent-infra-internal pr-review-grade resolve-host --pr {pr-number} [--cwd <path>]
What ships with it
4 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago Changed 41979fc5065e
- 24d ago Changed f6d6a307b673
- 28d ago Changed 46ff7089dc43
- 1mo ago Changed · +2 lines da3104a9a200
- 1mo ago Changed · +4 lines d44cfb7d3944
- 1mo ago Changed · +1 lines 3a475db63996
- 1mo ago First seen · 187 lines · 58 tokens per session scan A 863a07eb6ca2
review-pr is a skill published in the GitHub repository fitlab-ai/agent-infra (86 stars, last pushed yesterday), licensed MIT. It adds 58 tokens to every session and 3,531 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
autofix-pr
Watch a pull request and fix it from a worktree of its own - CI failures, review feedback from trusted authors and merge conflicts are fixed, pushed to the PR branch and answered on the PR under the user's git and gh identity. Usage - /autofix-pr [ | ] [--once] [--every ] [--no-reply] [--yes] [instructions]…
gh-find-prs
Survey open Codewhale PRs and triage each for mergeability and disposition against the real landing branch.
hunk-release
Prepares, publishes, verifies, and curates Hunk releases. Use for release metadata, benchmarks, tags, publishing, release videos, backports, or recovery.
git
Git and code hosting platform management — GitHub, GitLab, Codeberg, Forgejo. Zero barrier — install x-cmd and manage repos from the terminal. Use for "git", "github", "gitlab", "repo", "pull request", "code hosting".
vhs-e2e-gif
Record a test run, a TUI session, or any terminal command as a GIF with VHS and attach it to a GitHub PR as a release-hosted asset, never a repo commit. Use when asked to record an e2e run, demo a fix on a PR, attach a GIF or screen recording to a pull request, show a test passing visually, or produce a terminal…
agent-debug-ci
Investigate failed scheduled or nightly GitHub Actions runs on the default branch, determine whether the failure is reproducible and repository-owned, implement the smallest evidence-backed fix, validate it, and open a pull request. Use when a failed nightly CI event starts an agent, or when the standard CI or…