Getting it into your agent
This one installs as part of its plugin. Adding the marketplace and installing the plugin brings it with everything else the plugin ships.
/plugin marketplace add iamcxa/kc-claude-plugins/plugin install kc-pr-flowWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/iamcxa/kc-claude-plugins/kc-pr-review)<a href="https://agentmods.dev/skills/iamcxa/kc-claude-plugins/kc-pr-review"><img src="https://agentmods.dev/badge/skills/iamcxa/kc-claude-plugins/kc-pr-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/iamcxa/kc-claude-plugins/kc-pr-review"><img src="https://agentmods.dev/badge/skills/iamcxa/kc-claude-plugins/kc-pr-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00037 | $0.30888 |
| Opus 5.5 | $0.00015 | $0.12355 |
| Sonnet 5.5 | $0.00007 | $0.06178 |
| Haiku 4.5 | $0.00004 | $0.03089 |
Grade B, and why
kc-pr-review scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
if chmod 0700 "$SHADOW_TMP_DIR" && How it starts
The opening of the file, as written. The whole thing — 1,975 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Language rule (two layers):
- Conversation-facing text (status updates, confirmation prompts, findings tables shown to the user) — follows unified language preference. See plugin CLAUDE.md for query flow.
- PR-facing artifacts (review body, inline comment bodies, anything POSTed to GitHub) — default to English regardless of the conversation language, matching the convention for PR title / commit messages / code comments. Override only if the target repo's CLAUDE.md explicitly requires otherwise.
Process Flow
digraph review_pr {
rankdir=TB;
node [shape=box];
detect [label="Detect PR\n(number, URL, or current branch)"];
fetch [label="Fetch PR metadata + diff"];
concerns [label="Extract user concerns\n→ verification matrix"];
ownership [label="Check repo ownership"];
triage [label="Triage: filter noise,\nsize + security + archetype\n→ agent selection"];
subgraph cluster_parallel {
label="Parallel dispatch";
style=dashed;
prescan [label="Pre-scan (main context)\nCLAUDE.md rules\n+ stale refs\n+ dependency chains\n+ prompt consistency\n+ runtime data shape\n+ lint gate\n+ non-code scan\n+ dead export detection\n+ helper rollout completeness\n+ doc claim verification\n+ intra-doc rule-vs-example"];
review [label="Review agents\n(code-reviewer,\ncomment-analyzer)"];
tests [label="Test execution\n(worktree)\nunit + eval"];
audit_prep [label="Compliance prep\n(5a: read docs,\n5b: match skills)"];
knowledge [label="Knowledge layer\n(5a-k: episodic memory\n+ review-lessons.md)"];
tob_security [label="ToB security reviewer\n(differential review,\nadversarial modeling)"];
tob_supply [label="ToB supply chain\n(dep risk + insecure defaults)\n[conditional]"];
tob_actions [label="ToB actions auditor\n(AI agent CI/CD vectors)\n[conditional]"];
probe [label="Break-point probe\n(failure chain + A/B/C/D\n+ residual uncertainty)\n[bugfix/cross-stack]"];
codex [label="Codex cross-model\n(second opinion)\n[--codex / bugfix-cross-stack]"];
}
classify [label="5c: Cross-reference\nagent + test findings\n+ root cause classify"];
reconcile [label="5.5: Cross-model\nreconciliation\n(buckets + conflict set)\n[CODEX present]"];
arbitrate [label="5.6: Gemini\narbitration\n(verdict → confidence)\n[conflict ∧ gemini]"];
draft [label="Draft review:\nCODE table\n+ DOC/NEW advisory"];
node [shape=diamond];
confirm [label="User confirms\nreview?"];
node [shape=box];
diagrams [label="Generate + preview\nsequence + architecture/status\ndiagrams (optional)"];
post [label="Post review via\ngh pr review"];
review_url [label="Return review URL"];
node [shape=diamond];
has_learning [label="Learning\ninsights exist?"];
node [shape=box];
capture [label="8: Learning\nD1: skill patterns\nD2: project knowledge"];
write_knowledge [label="D1: auto-append\nD2: threshold → confirm\n→ write + commit"];
end_node [label="Done"];
detect -> fetch -> concerns -> ownership -> triage;
triage -> prescan;
triage -> review;
triage -> tests;
triage -> audit_prep;
triage -> knowledge;
triage -> tob_security;
triage -> tob_supply [label="deps changed"];
triage -> tob_actions [label="workflows changed"];
triage -> probe [label="bugfix/cross-stack"];
triage -> codex [label="--codex / bugfix-cross-stack"];
prescan -> classify;
review -> classify;
tests -> classify;
audit_prep -> classify;
knowledge -> classify;
tob_security -> classify;
tob_supply -> classify;
tob_actions -> classify;
probe -> classify;
codex -> classify;
classify -> reconcile;
reconcile -> arbitrate [label="conflict ∧ gemini"];
reconcile -> draft [label="no conflict / no gemini"];
arbitrate -> draft;
draft -> confirm;
confirm -> diagrams [label="D: preview only"];
diagrams -> confirm [label="no post"];
confirm -> post [label="approved"];
confirm -> draft [label="edit requested"];
post -> review_url -> has_learning;
has_learning -> capture [label="yes"];
has_learning -> end_node [label="none"];
capture -> write_knowledge [label="approved"];
capture -> end_node [label="skip"];
write_knowledge -> end_node;
}
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 1,975 lines · 37 tokens per session scan B 282f920a393a
kc-pr-review is a skill published in the GitHub repository iamcxa/kc-claude-plugins (3 stars, last pushed today), licensed MIT. It adds 37 tokens to every session and 30,888 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it B with 1 finding (asks for root). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
review-implement-phase
Implements triaged review actions, commits focused fixes, and posts Done plus resolves threads. Use when the user wants only the implementation phase of the review-framework workflow.
github-pr-workflow
Prepare a GitHub pull request from a feature branch — branch hygiene, commit shape, title/body, verification notes, screenshots for UI work, and replies to review comments.
review-delta
Review only changes since last commit using impact analysis. Token-efficient delta review with automatic blast-radius detection.
work-unit-commits
Plan commits as reviewable work units. Trigger: implementation, commit splitting, chained PRs, or keeping tests and docs with code.
github-contributor
A step-by-step guide for contributing code, tests, documentation, or build changes to open-source projects you do not maintain. It explains how to prepare a pull request that follows the project’s rules and is easier for maintainers to review.
git-pr-workflows-git-workflow
Guide changes through code checks, testing, commits, and pull request preparation. Use when coordinating a complete Git workflow and verifying readiness for collaboration.