Borrowing it
Nothing to install: this file belongs to luainkernel/lunatik. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/luainkernel/lunatik/master/.agents/skills/review-pr/SKILL.mdgit clone --depth 1 https://github.com/luainkernel/lunatikWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/luainkernel/lunatik/review-pr)<a href="https://agentmods.dev/skills/luainkernel/lunatik/review-pr"><img src="https://agentmods.dev/badge/skills/luainkernel/lunatik/review-pr/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/luainkernel/lunatik/review-pr"><img src="https://agentmods.dev/badge/skills/luainkernel/lunatik/review-pr.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00025 | $0.02955 |
| Opus 5.5 | $0.00010 | $0.01182 |
| Sonnet 5.5 | $0.00005 | $0.00591 |
| Haiku 4.5 | $0.00003 | $0.00296 |
Grade D, and why
review-pr scanned grade D with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
(`sudo bash tools/journal.sh "<the test's print>"`, the lunatik-cycle skill); the review names Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
launching session asked to keep it: `rm -rf <tree> && git worktree prune`, since `git worktree Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
`curl -sS -H "Authorization: Bearer $GH_TOKEN" "https://api.github.com/<path>"`, and `review.js` The source is not reproduced here
Licensed GPL-2.0
The repository is licensed GPL-2.0, which this catalogue does not treat as permission to reproduce the file. Read it at the source.
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago Changed · +6 lines 97f731c9b1ec
- 6d ago Changed · +1 lines f5f206a57b38
- 10d ago Changed 1f283379d0f4
- 19d ago Changed · +4 lines b034a4754f8d
- 20d ago Changed · +3 lines e6576d86b89c
- 1mo ago Changed · +1 lines c3958a8edf76
- 1mo ago Changed · +1 lines 3e5cc1fe40fb
- 1mo ago Changed · +4 lines 1c7737f39219
- 1mo ago Changed · +14 lines 1afefb33c2d9
- 1mo ago First seen · 126 lines · 25 tokens per session scan D b8be0a45537b
review-pr is a skill published in the GitHub repository luainkernel/lunatik (608 stars, last pushed 3d ago), licensed GPL-2.0. It adds 25 tokens to every session and 2,955 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it D with 3 findings (asks for root, recursive force delete, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
Automated Refactoring with PMAT
Provides automated refactoring suggestions and complexity reduction strategies using PMAT (Pragmatic AI Labs MCP Agent Toolkit). Use this skill when: User requests code refactoring, optimization, or improvement Complexity analysis reveals high-complexity functions (cyclomatic > 10) Code review identifies…
Code Quality Analysis with PMAT
Analyzes code quality, complexity, and technical debt using PMAT (Pragmatic AI Labs MCP Agent Toolkit). Use this skill when: User mentions "code quality", "complexity", "technical debt", or "maintainability" Reviewing code or conducting code review Modifying or refactoring existing code files Creating pull requests or…
code-review
Senior embedded-engineer code review. Defaults to Classic AUTOSAR embedded C and covers two concerns: (1) Correctness review — integer overflow, volatile correctness, ISR/task race conditions, stack usage, dynamic memory, control flow, AUTOSAR/ISO 26262 readiness, with findings rated Critical/Major/Minor; (2) Naming…
misra
MISRA C:2025 expert that operates in two modes: (1) Review — scan existing C code for violations across all 223 guidelines (22 directives + 201 rules), report findings with rule IDs, corrected code, and deviation justification templates; (2) Develop — generate new C functions, modules, or data structures that are…
pr-review
Review your own ArduPilot PR the way a maintainer will - before you open it, or after review feedback arrives - and then fix what the review finds. Runs the CI gates that bounce PRs mechanically, fans out parallel reviewers over the diff, cross-checks every finding with an independent Codex pass, and iterates fixes…
hwdef-check
Review an ArduPilot new-board hwdef PR. Stashes any local changes, checks the PR out as a branch in the current repo, runs DMA / board-ID / file-presence / commit-structure checks, layers the hwdef playbook on top, and (after confirmation) posts a review comment on the PR — then restores the original branch and pops…