pre-landing-review

A pre-landing pull-request review that examines code changes before they are merged into the main codebase.

In plain words
What is it for?
Reviewing a branch diff against its base branch and reporting potential correctness, performance, security, or architecture issues.
Why use it?
It looks for structural problems that ordinary tests may miss, including unsafe SQL, trust-boundary issues, and side effects triggered under the wrong conditions.

Skill for Claude CodeCodex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/gcwing/bitfun/gstack-review
Any agent
npx skills add GCWing/BitFun --skill gstack-review
Clone the repo
git clone --depth 1 https://github.com/GCWing/BitFun

Made for: Claude Code, Codex.

Per session 74 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 10,454 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00074 $0.10454
Opus 5 $0.00037 $0.05227
Sonnet 5 $0.00015 $0.02091
Haiku 4.5 $0.00007 $0.01045

Measured 2d ago against content hash 5466a4879991, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

pre-landing-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

src/crates/assembly/core/builtin_skills/gstack-review/SKILL.md · 859 lines

How it starts

The opening of the file, as written. The whole thing — 859 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Pre-Landing PR Review

You are running the specialized pre-landing workflow. Analyze the current branch's diff against the base branch for structural issues that tests don't catch. Do not present this skill as the product /review command.

BitFun Team Mode Dispatch

When this skill is invoked by BitFun Team Mode, this skill supplies the pre-landing review lens. Use existing Task sub-agents for independent diff review tracks, then consolidate findings in the main Team session.

  • Do not assume a Staff Engineer sub-agent exists. Choose only from the Task tool's available agents.
  • Use at most one built-in CodeReview sub-agent for an independent pass, and put the exact correctness, performance, security, or architecture question in its prompt. Broader dynamic lens selection belongs to the unified /review path.
  • Prefer a matching custom review sub-agent when the user configured one. Use Explore only for broad read-only investigation when no review sub-agent fits.
  • Keep Task work read-only. Ask for tight findings with file paths, line references if possible, severity, confidence, and why tests might miss it.
  • The main Team orchestrator owns final severity ordering, AUTO-FIX vs ASK classification, and any code changes.

Step 1: Check branch

  1. Run git branch --show-current to get the current branch.
  2. If on the base branch, output: "Nothing to review — you're on the base branch or have no changes against it." and stop.
  3. Run git fetch origin <base> --quiet && git diff origin/<base> --stat to check if there's a diff. If no diff, output the same message and stop.

Step 1.5: Scope Drift Detection

Before reviewing code quality, check: did they build what was requested — nothing more, nothing less?

  1. Read TODOS.md (if it exists). Read PR description (gh pr view --json body --jq .body 2>/dev/null || true). Read commit messages (git log origin/<base>..HEAD --oneline). If no PR exists: rely on commit messages and TODOS.md for stated intent — this is the common case since /review runs before /ship creates the PR.
  2. Identify the stated intent — what was this branch supposed to accomplish?
  3. Run git diff origin/<base>...HEAD --stat and compare the files changed against the stated intent.

Read the full file on GitHub · 859 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 859 lines · 74 tokens per session scan A 5466a4879991

Subscribe to this mod's changes

pre-landing-review is a skill published in the GitHub repository GCWing/BitFun (1,871 stars, last pushed 2d ago), licensed MIT. It adds 74 tokens to every session and 10,454 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

git-delegation

将所有 git 操作委托给 Manager 执行。Worker 无法直接访问 git credentials,因此任何需要认证的 git 操作(clone、push、fetch 等)都需要通过此机制委托给 Manager。.

agentscope-ai/AgentTeams · 51 tokens

agentteams-migrate

Analyze current OpenClaw setup and generate a migration package (ZIP) for importing into AgentTeams as a managed Worker.

agentscope-ai/AgentTeams · 28 tokens

workerflow-internal-workflow

Use when a QwenPaw-backed Worker needs to decide whether to do work directly, use native subagents for internal parallelism, or create a temporary QwenPaw agent with a custom AGENTS.md and skills.

agentscope-ai/AgentTeams · 52 tokens

find-skills

Discover and install agent skills from the open ecosystem. Use when you encounter an unfamiliar domain, framework, or workflow that you lack specialized knowledge about, or when your coordinator suggests searching for skills before starting a task.

agentscope-ai/AgentTeams · 46 tokens

higress-gateway-management

Manage the Higress AI Gateway via its Console API (consumers, routes, AI providers, MCP servers). Use when creating consumers, configuring routes, or managing AI gateway settings.

agentscope-ai/AgentTeams · 43 tokens

worker-management

Use when admin requests hand-creating or resetting a Worker, starting/stopping a Worker, managing Worker skills, enabling peer mentions, or opening a QwenPaw console. Use agentteams-find-worker only as a helper for Nacos-backed market import or when task assignment needs you to discover a suitable Worker.

agentscope-ai/AgentTeams · 65 tokens