review-agent

A read-only code-review procedure that examines a requested change for defects and actionable problems.

In plain words
What is it for?
It is for reviewing uncommitted changes, commits, base-branch diffs, and changes checked against tests and call sites.
Why use it?
It helps catch correctness issues before code is merged without altering the files or branch.

Skill for Claude CodeCodex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/hkuds/deepcode/review-agent
Any agent
npx skills add HKUDS/DeepCode --skill review-agent
Clone the repo
git clone --depth 1 https://github.com/HKUDS/DeepCode

Made for: Claude Code, Codex.

Per session 48 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 552 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin 100% copy Near-identical to another mod in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00048 $0.00552
Opus 5 $0.00024 $0.00276
Sonnet 5 $0.00010 $0.00110
Haiku 4.5 $0.00005 $0.00055

Measured 2d ago against content hash 07079efd0dc7, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

review-agent scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

Origin

This is a copy

100% identical to review-agent — 0 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.

core/skills/builtin/review-agent/SKILL.md · 58 lines

How it starts

The opening of the file, as written. The whole thing — 58 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Review Agent

Inspect the requested target directly and return every finding that the author would likely fix. Do not modify files, create commits, push branches, post review comments, or delegate the review to another agent.

Review the change

  1. Read the applicable AGENTS.md instructions.
  2. Inspect the complete diff for the requested target and enough surrounding code to understand each changed path.
  3. Identify concrete regressions introduced by the change. Continue through the whole diff after finding the first issue.
  4. Check the relevant tests and call sites to confirm that each finding is real and actionable.

For a base-branch review, compare the changes that would actually merge rather than diffing directly against the branch tip. Resolve the comparison ref to the branch's upstream when that upstream exists and is ahead of the local branch; otherwise use the local branch. Run git merge-base HEAD <comparison-ref>, then inspect git diff <merge-base-sha>. If the local branch cannot be resolved, try its configured upstream explicitly before reporting that the target is unavailable.

Flag an issue only when all of these are true:

  • It affects correctness, security, performance, or maintainability in a meaningful way.
  • It is discrete and actionable.
  • It was introduced by the reviewed change.
  • The affected scenario or call path can be demonstrated from the code.
  • The author would probably fix it if they knew about it.

Do not flag speculative concerns, pre-existing problems, intentional behavior changes, or style nits that do not obscure the code.

Write the result

Present findings first, ordered by severity. Use one entry per issue in this form:

[P1] Imperative finding title — path/to/file.rs:line

Follow the title with one short paragraph explaining the affected scenario and why the behavior is wrong. Keep the cited range as small as possible and make sure it overlaps the reviewed diff.

Use these priorities:

  • P0: universal release blocker or critical failure.
  • P1: urgent defect that should be fixed next.
  • P2: ordinary defect that should be fixed.
  • P3: low-impact issue that is still worth fixing.

Read the full file on GitHub · 58 lines

Files

What ships with it

2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 58 lines · 48 tokens per session scan A 07079efd0dc7

Subscribe to this mod's changes

review-agent is a skill published in the GitHub repository HKUDS/DeepCode (16,450 stars, last pushed 4d ago), licensed MIT. It adds 48 tokens to every session and 552 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. It is 100% identical to review-agent, differing in 0 lines, and is treated as a copy.

Related

Other skills, from other repositories