Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add HsuanYuLee/polaris --skill review-inboxgit clone --depth 1 https://github.com/HsuanYuLee/polarisWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/hsuanyulee/polaris/review-inbox)<a href="https://agentmods.dev/skills/hsuanyulee/polaris/review-inbox"><img src="https://agentmods.dev/badge/skills/hsuanyulee/polaris/review-inbox/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/hsuanyulee/polaris/review-inbox"><img src="https://agentmods.dev/badge/skills/hsuanyulee/polaris/review-inbox.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00210 | $0.03056 |
| Opus 5 | $0.00105 | $0.01528 |
| Sonnet 5 | $0.00042 | $0.00611 |
| Haiku 4.5 | $0.00021 | $0.00306 |
Grade A, and why
review-inbox scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 163 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Review Inbox — 批次 Review 待審 PR
找出 team 內需要自己 first review、re-approve、或 re-review 的 PR，批次執行 review， 並依來源回 Slack 通知。
Contract
此 skill 只處理多 PR discovery + batch review orchestration。單一 PR URL 轉 review-pr；
「我的 PR」approval 狀態轉 request-pr-review。
支援三個來源：
| Source | Use when |
|---|---|
| Slack | 預設；掃 PR channel 最近訊息中的 PR URLs——含 thread 回覆，不只 top-level |
| GitHub 條件掃描 | 一律與 Slack 取聯集：我投過票而 head 已推進的 open PR，不靠任何人說話 |
| Thread | 使用者提供 Slack thread URL 並要求 review |
| Label | 使用者明確提到 need review label |
不得 review 自己的 PR。不得對 waiting_for_author PR 重複 review。
Review inbox 屬 reviewer-side read-only lane；它可以 advisory，但對 awaiting_re_review、
mergeable_ready、unsupported_mutation、changes_requested 的解釋必須沿用 shared PR state。
它不得把 batch review 結果升格成 author-side completion / release authority；所有
「可 merge / 已修完 / 可 release」語句只能轉述 shared state，不可自行推論。
Reference Loading
| Situation | Load |
|---|---|
| Any run | context-budget-contract.md, review-inbox-discovery-flow.md, stale-approval-detection.md, workspace-config.yaml |
| Batch review execution | review-inbox-batch-review-flow.md, .claude/skills/review-inbox/dispatch-context-bundle.md |
| Slack notification | review-inbox-slack-reporting.md, slack-message-format.md, ../review-pr/references/github-slack-user-mapping.md, scripts/validate-language-policy.sh |
每張 PR 交給一個 sub-agent 執行。 用哪一種 agent、幾個並行、先跑哪一張，由執行的人
當下判斷——這一支提供判斷需要的事實（姊妹單關係、規模、風險等級、授權狀態），不提供結論。
它不指名任何一種 agent 型別，要求與禁止都不指名：一支 scope: universal 的 skill 指名一個
它不 ship 的東西，換一個環境就不成立。
主 session 不讀完整 diff。 這一條與怎麼派無關，它由 context-budget-contract.md 直接
規定，任何 sub-agent 都滿足它。以前這件事由一條「禁用 general-purpose sub-agent」的規定
代理，那條規定引用的證據從來沒有產出過（DP-575）；代理拿掉了，被代理的沒有。
Batch review dispatch 由 main session 讀 dispatch-context-bundle.md 一次，把它 inline 注入
每個 review packet。Packet 自帶執行 review 需要的全部內容；另外附上延伸參考的路徑，
要不要讀、讀多少由 sub-agent 自己判斷。
Flow
- 讀 workspace config 與 defaults，取得 GitHub org、PR channel、approval threshold。
- 解析 mode：Thread 優先，其次 explicit Label，其餘走 Slack。
- 取得 current GitHub username，作為 exclude author 與 review-status 判定依據。
- 依 discovery reference 產生 candidates JSON；派工前照〈Scan Freshness〉重核一次，60 秒從那次重核起算。
Slack channel scan 使用 MCP 時指定 detailed output——
concise不輸出=== Message from與Message TS:這兩個 marker，parser 會找不到 message header 而 靜默回傳 0 個 URL（stderr 只印一行 WARN，離場碼仍然是 0），而那跟「channel 真的空」 分不開；fallback CLI 的--oldest可接受 Slack timestamp 或 ISO date/datetime。 產出 candidates 之前要先過scripts/review-inbox-discovery-probe.sh。 它非零就停在 那裡、把 marker 與說明回報出來——不要宣告空的收件匣，也不要靜默改走 label scan。 它現在除了「讀不讀得懂」也問「讀完了沒」：時間窗翻到底了嗎、窗內有新回覆的 thread 讀進來了嗎。--window-seconds在 channel 模式必填，值是這一趟宣告的回溯時間窗。 4b. Slack 那條做完，再跑一次 GitHub 條件掃描並取聯集：scripts/scan-my-stale-reviews.sh --my-user <u> --org <org> --merge-with <Slack 的 candidates>。 頻道掃描的前提是有人說話，這一條沒有這個前提——2026-09-04 兩輪 discovery 都空手， 而同一時間有五顆 PR 擋在我方舊票上、作者早就推了修正。 - 將 candidates JSON 經
annotate-review-candidates.pyenrich，補上 sister PR cluster metadata 與model_tiersemantic class。Slack mapping 若含root_ticket_key，cluster 必須優先使用 root ticket；若沒有 umbrella ticket 但同一 Slack root message 有可辨識 topic，使用root_topic_key；最後才 fallback 到每張 PR 自己的 ticket。
What ships with it
42 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- dispatch-context-bundle.md 7.4 KB
- references/context-budget-contract.md 6.2 KB
- references/review-inbox-batch-review-flow.md 11 KB
- references/review-inbox-discovery-flow.md 21 KB
- references/review-inbox-slack-reporting.md 2.4 KB
- references/slack-message-format.md 1.6 KB
- references/stale-approval-detection.md 2.3 KB
- scripts/analyze-channel-dump.py 7.2 KB runs code
- scripts/annotate-review-candidates-selftest.sh 5.4 KB runs code
- scripts/annotate-review-candidates.py 15 KB runs code
- scripts/approval-staleness.sh 2.1 KB runs code
- scripts/build-review-prompt-selftest.sh 7.7 KB runs code
- scripts/build-review-prompt.sh 26 KB runs code
- scripts/check-my-review-status-selftest.sh 17 KB runs code
- scripts/check-my-review-status.sh 10 KB runs code
- scripts/extract-pr-urls-selftest.sh 15 KB runs code
- scripts/extract-pr-urls.py 20 KB runs code
- scripts/fetch-pr-info.sh 9.3 KB runs code
- scripts/fetch-prs-by-url.sh 3.4 KB runs code
- scripts/inspect-pr-section-selftest.sh 1.0 KB runs code
- scripts/inspect-pr-section.sh 1.8 KB runs code
- scripts/lib/github-rest.sh 10 KB runs code
- scripts/lib/main-checkout.sh 1.9 KB runs code
- scripts/lib/validate_language_policy_1.py 11 KB runs code
- scripts/lib/workspace-config-root.sh 2.6 KB runs code
- scripts/measure-review-inbox-session-selftest.sh 2.1 KB runs code
- scripts/measure-review-inbox-session.sh 4.5 KB runs code
- scripts/polaris-embed-setup.sh 917 B runs code
- scripts/polaris-embed.py 7.5 KB runs code
- scripts/polaris-external-write-gate.sh 13 KB runs code
- scripts/polaris-learnings.sh 9.8 KB runs code
- scripts/review-inbox-discovery-probe.sh 13 KB runs code
- scripts/review-packet-head-binding-selftest.sh 3.3 KB runs code
- scripts/scan-my-stale-reviews-selftest.sh 8.7 KB runs code
- scripts/scan-my-stale-reviews.sh 11 KB runs code
- scripts/scan-need-review-prs.sh 3.2 KB runs code
- scripts/selftests/review-inbox-discovery-probe-format-selftest.sh 8.7 KB runs code
- scripts/selftests/submit-pr-review-selftest.sh 16 KB runs code
- scripts/slack-webapi-selftest.sh 758 B runs code
- scripts/slack-webapi.sh 4.8 KB runs code
- scripts/submit-pr-review.sh 13 KB runs code
- scripts/validate-language-policy.sh 9.2 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed fe05cbaddf1f
- 4d ago Changed · +12 lines 002fc2185767
- 6d ago Changed · +7 lines 6359ed581543
- 11d ago First seen · 144 lines · 210 tokens per session scan A 65ccb71127cb
review-inbox is a skill published in the GitHub repository HsuanYuLee/polaris (5 stars, last pushed yesterday), licensed MIT. It adds 210 tokens to every session and 3,056 once invoked, about $0.0011 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
resolve-pr-comments
Evaluate, fix, answer, and reply to GitHub pull request review comments and conversation comments. Handles both change requests (fix or skip) and reviewer questions (explain using reasoning recalled from past Claude Code transcripts). Use when the user asks to "resolve PR comments", "fix review comments", "address PR…
review-code
Review code for bugs, security vulnerabilities, API misuse, consistency issues, simplicity problems, or test coverage gaps by running internal reviews and a peer review in parallel and returning combined findings. Single-concern with a type argument, or full review with no argument. Use when the user asks to "review…
assess-technical-debt
Assess project-wide structural technical debt: complexity hotspots, deprecated API usage, duplication clusters, and architecture rot. Ranks findings by impact and refactor effort into a report at .turbo/technical-debt.md. Use when the user asks to "assess technical debt", "find technical debt", "review technical…
map-codebase
Deep architecture report that fans out parallel inspections across different aspects of the codebase (structure, tech stack, APIs, patterns, data flow, dependencies, testing) and synthesizes findings into a comprehensive document at .turbo/codebase-map.md and .turbo/codebase-map.html. Use when the user asks to "map…
peer-review
Run an independent peer review via Codex. Use when the user asks to "peer review", "peer review my code", "peer review my plan", "get a second opinion", or "independent review".
claude-print
Run a non-interactive Claude Code print-mode call from Codex. Use when the user asks to "claude print", "ask claude", "run claude", "consult claude", or when a Codex Turbo skill needs Claude as an independent peer reviewer.