Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/kyto64/codex-pr-review-toolkit-minimalnpx agentmods add skills/kyto64/codex-pr-review-toolkit-minimal/pr-reviewWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/kyto64/codex-pr-review-toolkit-minimal/pr-review)<a href="https://agentmods.dev/skills/kyto64/codex-pr-review-toolkit-minimal/pr-review"><img src="https://agentmods.dev/badge/skills/kyto64/codex-pr-review-toolkit-minimal/pr-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/kyto64/codex-pr-review-toolkit-minimal/pr-review"><img src="https://agentmods.dev/badge/skills/kyto64/codex-pr-review-toolkit-minimal/pr-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00053 | $0.02833 |
| Opus 5 | $0.00026 | $0.01417 |
| Sonnet 5 | $0.00011 | $0.00567 |
| Haiku 4.5 | $0.00005 | $0.00283 |
Grade A, and why
pr-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 196 lines — stays where its author put it; the contents beside it link to each section on GitHub.
PR Review (Unified)
Codex 標準の /review の代替ではなく、観点固定の追加レビューレイヤーとして使う統合 Skill です。PR やブランチ差分を、複数の専門観点でレビューし、重要度を揃えた Finding として出力します。
位置づけ
- Codex 標準レビューに加えて、特定観点（エラー処理、テスト、コメント、型設計など）を深掘りする
- 自動修正・GitHub Action・MCP 連携は行わない
- sandbox bypass や承認スキップを前提にしない
実行モード
Codex subagent（.codex/agents/ のカスタムエージェント）が利用可能な場合は並列モードを優先する。利用できない、または spawn されない場合は順次モードにフォールバックする。
| モード | いつ | 動き |
|---|---|---|
| 並列 | .codex/agents/ に観点エージェントがあり、親が明示的に spawn できる |
適用対象の観点ごとに subagent を並列起動し、結果を統合 |
| 順次 | subagent 非対応、spawn 失敗、ユーザーが単一セッションを指定 | 1 セッション内で観点を順に適用 |
並列モードでは親セッションがオーケストレーターとして動く。subagent 間で Finding の重複排除はできないため、統合・去重は親が行う。
レビュー手順
1. スコープを確定する
ユーザーから受け取るコンテキストは次のいずれか。指定がなければ main...HEAD を使う。
| 入力 | 取得方法 |
|---|---|
| base branch（推奨） | git diff <base>...HEAD |
| ローカル未コミット変更 | git diff |
| PR 番号 / URL | gh pr diff <n>、gh pr view <n> |
| ファイル指定 | 指定ファイルの差分のみ |
git diff main...HEAD
git diff --name-only main...HEAD
レビュー開始時に、対象（base、ブランチ、変更ファイル数）を1行で明示する。プロジェクトに AGENTS.md 等の規約があれば先に読む。
2. 適用する観点を決める
ユーザーが観点を指定した場合（例: 「エラー処理とテストだけ」）はそれに従う。指定がなければ、変更内容に応じて適用する。
| 観点 | Skill | Category | 適用条件 |
|---|---|---|---|
| 正しさ・セキュリティ・保守性 | code-reviewer |
correctness, security, maintainability |
常に適用 |
| サイレント障害・エラー処理 | silent-failure-hunter |
silent-failure |
常に適用 |
| 複雑さ・簡潔さ | code-simplifier |
simplicity |
常に適用 |
| テスト網羅 | pr-test-analyzer |
test-coverage |
ロジック変更がある場合（テスト追加の有無に関わらず）。docs-only / metadata-only でロジック変更がなければスキップ |
| コメント・docs の事実確認 | comment-analyzer |
comments |
コードコメントの追加・変更、または README / docs / LICENSE / NOTICE / attribution / SECURITY / CONTRIBUTING 等のリポジトリ docs 変更時 |
| 型設計 | type-design-analyzer |
type-design |
型・データモデルが追加・変更された場合。型やデータモデル変更がなければスキップ |
各 Skill の詳細手順は skills/<name>/SKILL.md を参照。スキップした観点は最終出力で「適用外（理由）」として1行報告する。
外部出典・ライセンス・attribution の確認
外部 repo、license、NOTICE、upstream path、third-party notice を主張する変更では、可能なら一次ソースで確認する。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 196 lines · 53 tokens per session scan A 7c6c7de5dc04
pr-review is a skill published in the GitHub repository kyto64/codex-pr-review-toolkit-minimal (1 stars, last pushed 2mo ago), licensed Apache-2.0. It adds 53 tokens to every session and 2,833 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
code-review-excellence
This skill should be used when the user asks to review a diff or pull request, write review comments, audit code quality, establish review standards, or improve how a team performs code review.
resolve-pr-comments
Evaluate, fix, answer, and reply to GitHub pull request review comments and conversation comments. Handles both change requests (fix or skip) and reviewer questions (explain using reasoning recalled from past Claude Code transcripts). Use when the user asks to "resolve PR comments", "fix review comments", "address PR…
review-code
Review code for bugs, security vulnerabilities, API misuse, consistency issues, simplicity problems, or test coverage gaps by running internal reviews and a peer review in parallel and returning combined findings. Single-concern with a type argument, or full review with no argument. Use when the user asks to "review…
assess-technical-debt
Assess project-wide structural technical debt: complexity hotspots, deprecated API usage, duplication clusters, and architecture rot. Ranks findings by impact and refactor effort into a report at .turbo/technical-debt.md. Use when the user asks to "assess technical debt", "find technical debt", "review technical…
map-codebase
Deep architecture report that fans out parallel inspections across different aspects of the codebase (structure, tech stack, APIs, patterns, data flow, dependencies, testing) and synthesizes findings into a comprehensive document at .turbo/codebase-map.md and .turbo/codebase-map.html. Use when the user asks to "map…
peer-review
Run an independent peer review via Codex. Use when the user asks to "peer review", "peer review my code", "peer review my plan", "get a second opinion", or "independent review".