Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add gongxuanzhang/shengsheng-skill --skill github-pr-review-loopgit clone --depth 1 https://github.com/gongxuanzhang/shengsheng-skillWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/gongxuanzhang/shengsheng-skill/github-pr-review-loop)<a href="https://agentmods.dev/skills/gongxuanzhang/shengsheng-skill/github-pr-review-loop"><img src="https://agentmods.dev/badge/skills/gongxuanzhang/shengsheng-skill/github-pr-review-loop/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/gongxuanzhang/shengsheng-skill/github-pr-review-loop"><img src="https://agentmods.dev/badge/skills/gongxuanzhang/shengsheng-skill/github-pr-review-loop.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00118 | $0.02127 |
| Opus 5 | $0.00059 | $0.01064 |
| Sonnet 5 | $0.00024 | $0.00425 |
| Haiku 4.5 | $0.00012 | $0.00213 |
Grade A, and why
github-pr-review-loop scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 217 lines — stays where its author put it; the contents beside it link to each section on GitHub.
GitHub PR Review Loop
持续观察并 review GitHub PR。目标不是“尽快通过”，而是把每个 PR 推进到可信的结论：无阻断问题则 approve，有阻断问题则 request changes，不能自 approve 时明确 comment。
身份与工具约束
- GitHub 操作必须使用本地
gh命令。 - 如果本机没有
gh，先安装gh，再继续。 - GitHub 身份必须来自本地环境变量
GITHUB_BOT_TOKEN。 - 不使用本机已有的个人
gh auth登录态。 - 不使用其他账号或 token。
- 不打印、不 echo、不暴露 token。
- 在 Codex 客户端中需要持续观察时，优先使用 heartbeat automation 做真正后台轮询，不只依赖一个前台 sleep loop。
- review 时不执行测试命令；默认 PR 提交流程或 CI 已经跑过必要测试，只从代码和 diff 判断测试覆盖是否足够。
- 推荐命令形式：
GH_TOKEN="$GITHUB_BOT_TOKEN" gh pr list --state open
GH_TOKEN="$GITHUB_BOT_TOKEN" gh pr view <pr>
GH_TOKEN="$GITHUB_BOT_TOKEN" gh pr review <pr> --approve --body "<body>"
如果 GITHUB_BOT_TOKEN 不存在，停止并要求用户提供；不要降级使用个人账号。
Loop 参数
- 默认持续时间：用户未指定时运行 2 小时。
- 扫描范围：
- 用户指定某个 PR：只持续处理该 PR。
- 用户未指定 PR：每轮扫描当前仓库所有 open PR。
- 优先创建或更新挂在当前 Codex session 上的 heartbeat automation；每次唤醒执行一轮扫描，然后交回给 automation 调度下一轮。
- 当确定当前正在处理的 PR 后，根据 PR 内容更新当前 Codex session 标题；如果运行环境没有 session 标题控制能力，则跳过，不影响 review loop。
- 如果某轮执行了任何 review/comment，立刻开始下一轮扫描。
- 如果某轮没有执行任何 review/comment，等待 5 分钟 后再扫描。
- 到达持续时间后停止，并总结：
- 本轮 review 过的 PR
- 已 approve 的 PR
- 仍阻断的 PR
- 跳过或未 review 的 PR 及原因
每轮必须检查
每轮都重新查询当前仓库 open PR，不能因为上轮 PR 数量固定就提前停止；期间可能出现新 PR。
对每个 PR 收集：
- PR number、title、author、base branch、head branch、head SHA
- 最新 commit 列表和当前 head SHA
- 最新 issue comments
- 最新 review comments / review threads
- 最新 reviews
- bot 当前身份 login
- 我们上一次针对该 PR 的 review/comment
- 上次 review 之后是否出现新 commit、评论、回复、review 或其它需要复审的事件
常用命令示例：
GH_TOKEN="$GITHUB_BOT_TOKEN" gh api user --jq .login
GH_TOKEN="$GITHUB_BOT_TOKEN" gh pr list --state open --json number,title,author,headRefOid,headRefName,baseRefName,updatedAt
GH_TOKEN="$GITHUB_BOT_TOKEN" gh pr view <pr> --json number,title,body,author,headRefOid,headRefName,baseRefName,commits,comments,reviews,updatedAt
当 gh pr view 信息不足时，用 gh api 查询 timeline、review threads 或具体 review comments。
Codex 后台轮询
当用户要求持续观察、后台监控、review loop 或 keep watching 时，不要只靠当前 turn 长时间 sleep。优先使用 Codex app 的 heartbeat automation，让当前 session 按固定节奏被唤醒。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 217 lines · 118 tokens per session scan A 1d822b0cb680
github-pr-review-loop is a skill published in the GitHub repository gongxuanzhang/shengsheng-skill (10 stars, last pushed 2mo ago), licensed MIT. It adds 118 tokens to every session and 2,127 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
review-implement-phase
Implements triaged review actions, commits focused fixes, and posts Done plus resolves threads. Use when the user wants only the implementation phase of the review-framework workflow.
engram-branch-pr
PR creation workflow for Engram following the issue-first enforcement system. Trigger: When creating a pull request, opening a PR, or preparing changes for review.
verify-behavior
Verify or reproduce visible product behavior by driving the real UI with pi-computer-use's checked tools, requiring verified expect postconditions and durable state evidence for meaningful UI flows. Use when triage needs visual reproduction, implementation needs behavioral proof, review needs interactive confirmation…
github-contributor
End-to-end playbook for shipping high-quality pull requests to open-source projects you don't maintain — discovery, CONTRIBUTING compliance, PR-size check, minimal-diff implementation, PR description with AI-assisted disclosure, conflict resolution, and post-submission maintainer interaction. Use whenever creating…
revdiff
Review diffs, files, and documents with inline annotations in a TUI overlay, or answer questions about revdiff usage, configuration, themes, and keybindings. Opens revdiff in agterm/tmux/zellij/herdr/kitty/wezterm/cmux/ghostty/iterm2/emacs-vterm, captures annotations, and addresses them. Works in git, hg, and jj repos…
write-pr
Reference standards for writing pull request titles and descriptions in the tldraw repository, plus the pre-flight comment sweep over the diff. Use as supporting guidance when another skill or workflow needs PR content standards, not as the user-facing create/update PR workflow.