What is flow-next-impl-review?

A process for reviewing code changes in a flow-next project, using the configured review system.

Use it to review a current diff, optionally run deeper validation, and produce findings based on the selected review backend.

It helps find correctness, design, and implementation problems in a branch before the changes are accepted.

flow-next-impl-review — Skill for Claude Code and Codex by gmickel

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add gmickel/flow-next --skill flow-next-impl-review

Clone the repo

git clone --depth 1 https://github.com/gmickel/flow-next

Made for: Claude Code, Codex.

Or install flow-next, the plugin that ships this one along with the rest of its 32 skills, 28 commands, 20 agents.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/gmickel/flow-next/flow-next-impl-review.svg)](https://agentmods.dev/skills/gmickel/flow-next/flow-next-impl-review)

Your own site

<a href="https://agentmods.dev/skills/gmickel/flow-next/flow-next-impl-review"><img src="https://agentmods.dev/badge/skills/gmickel/flow-next/flow-next-impl-review.svg" alt="Measured on agentmods" height="20"></a>

Per session 34 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 4,857 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00034	$0.04857
Opus 5	$0.00017	$0.02429
Sonnet 5	$0.00007	$0.00971
Haiku 4.5	$0.00003	$0.00486

Measured today against content hash ced150cc2ba8, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-06, from the pricing page.

Security

Grade A, and why

flow-next-impl-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

plugins/flow-next/codex/skills/flow-next-impl-review/SKILL.md · 285 lines

How it starts

The opening of the file, as written. The whole thing — 285 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Implementation Review Mode

Workflow is backend-split. Read workflow-common.md for Phase 0 (backend detection + philosophy + trivial-diff triage), then read ONLY the file matching your active backend. The opt-in --deep/--validate/--interactive phase detail (including the phase-ordering matrix) lives in optional-phases.md, loaded only when a flag fires:

BACKEND=codex → workflow-codex.md
BACKEND=copilot → workflow-copilot.md
BACKEND=cursor → workflow-cursor.md
BACKEND=claude → workflow-claude.md
BACKEND=host → workflow-host.md
BACKEND=rp → workflow-rp.md

Do not load the others — only the active backend's file is needed. Each backend file carries its own Critical Rules and anti-patterns.

Conduct a John Carmack-level review of implementation changes on the current branch.

Role: Code Review Coordinator (NOT the reviewer) Backends (branch on the Phase 0 RP_ELIGIBLE probe):

When RP_ELIGIBLE=1: RepoPrompt (rp), Codex CLI (codex), GitHub Copilot CLI (copilot), Cursor CLI (cursor), Claude Code CLI (claude), or host-native (host)
When RP_ELIGIBLE=0: Codex CLI (codex), GitHub Copilot CLI (copilot), Cursor CLI (cursor), Claude Code CLI (claude), or host-native (host) — rp is macOS-only; never list it in guidance you surface (--review=rp stays accepted)

Preamble — execute Phase 0 exactly once

The executable Phase 0 lives in workflow-common.md §"Phase 0: Backend Detection" — Read it and execute it ONCE, before any other bash in this skill. It defines $FLOWCTL (bundled — NOT installed globally; which flowctl fails, expected), probes RP_ELIGIBLE, resolves $BACKEND via the single flowctl review-backend call, and handles the ASK / none cases. Every later bash block here (triage, deep-pass selection) uses the $FLOWCTL it defines. Never invoke flowctl review-backend a second time in the same run.

Read the full file on GitHub · 285 lines

Files

What ships with it

18 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

today Changed · +2 lines ced150cc2ba8
yesterday Changed 4e8ebe2db30a
3d ago Changed · +27 lines 19ee47a662aa
7d ago First seen · 256 lines · 34 tokens per session scan A 0c2f20d36a7d

Subscribe to this mod's changes

flow-next-impl-review is a skill published in the GitHub repository gmickel/flow-next (691 stars, last pushed yesterday), licensed MIT. It adds 34 tokens to every session and 4,857 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Backend and APIs Claude Code Code review Planning execution marketplace plugin workflow

pr

Comprehensive PR/issue review - analyzes architecture, tests, identifies unrelated changes mixed in, drafts review comment or issue comment. Use when user asks to review a PR, check a PR, look at PR changes, or comment on an issue.

umputun/cc-thingz · 51 tokens

st-lint

Smalltalk best-practices linter for Tonel files. Use when validating .st files before importing to the Smalltalk image (Pharo or Squeak), checking code quality after editing, or diagnosing style issues in a package.

mumez/smalltalk-dev-plugin · 52 tokens

review-workflow-management

This skill reviews the HTTP management endpoints (start, status, terminate, pause, resume, raise-event, purge) that an app exposes for Dapr Workflows. Use this skill when the user asks to "review workflow management", "audit workflow management API", "check workflow HTTP endpoints", or similar.

diagrid-labs/dapr-skills · 66 tokens

review-workflow-activity

This skill reviews Dapr Workflow activity implementations for idempotency, retries, error boundaries, and convention violations. Use this skill when the user asks to "review workflow activities", "check activity idempotency", "audit Dapr activities", or similar.

diagrid-labs/dapr-skills · 57 tokens

polish

Polish a completed code change with a bounded independent review protocol. Use after implementation and before final approval or PR to review intent, acceptance criteria, non-goals, diff, relevant files, verification, and previously rejected findings.

takubii/smithy · 48 tokens

gate-check

Final quality gate before reporting task completion (Gate 3). Fills confidence assessment, runs supplementary verification for <95% items, completes self-check checklist. Writes PASS/FAIL result to subtask.md, then calls autoworker:dispatch for routing.

phj128/autoworker · 55 tokens