pr-review

pr-review is a skill for Claude Code, Codex from LuisUrrutia/skills. It costs 31 tokens per session (2,690 once invoked), scanned A, original, MIT.

A workflow for reviewing someone else's GitHub pull request, which is a proposed change to a code repository. It combines separate reviews and publishes either a comment containing confirmed problems or an approval.

In plain words
What is it for?
It helps inspect a pull request, verify reported issues, and publish a review on GitHub.
Why use it?
It keeps review findings evidence-based and avoids changing the reviewed code or handling follow-up work outside this review.

Skill for Claude CodeCodex

Written for no agent in particular: nothing here depends on one. Also seen: mentions Codex.

Good fit It helps inspect a pull request, verify reported issues, and publish a review on GitHub.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/luisurrutia/skills/pr-review
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add LuisUrrutia/skills --skill pr-review
Clone the repo
git clone --depth 1 https://github.com/LuisUrrutia/skills

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for pr-review

README.md
[![agentmods](https://agentmods.dev/badge/skills/luisurrutia/skills/pr-review/github.svg)](https://agentmods.dev/skills/luisurrutia/skills/pr-review)
Your own site
<a href="https://agentmods.dev/skills/luisurrutia/skills/pr-review"><img src="https://agentmods.dev/badge/skills/luisurrutia/skills/pr-review/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for pr-review

Your own site · 80×15
<a href="https://agentmods.dev/skills/luisurrutia/skills/pr-review"><img src="https://agentmods.dev/badge/skills/luisurrutia/skills/pr-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 31 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 2,690 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00031 $0.02690
Opus 5.5 $0.00012 $0.01076
Sonnet 5.5 $0.00006 $0.00538
Haiku 4.5 $0.00003 $0.00269

Measured 3d ago against content hash 8937c15ef32f, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

pr-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.

The scan reads SKILL.md. This mod also ships 10 executable files (scripts/adapters.py, scripts/publish_review.py, scripts/read_only.py, …), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

pr-review/SKILL.md · 188 lines

How it starts

The opening of the file, as written. The whole thing — 188 lines — stays where its author put it; the contents beside it link to each section on GitHub.

PR review

Publish one GitHub review built from two independent reviews of one PR by Codex and Claude: a Comment review carrying the verified findings, or an Approve review when the review is complete and nothing blocking remains. Generic auditing belongs to review-code-changes. Following up on replies and new commits, resolving threads and later approval belong to pr-review-followup; repairing your own PR belongs to pr-followup; when the intended GitHub actor is the PR's author, use that instead. This workflow never requests changes, resolves threads or modifies the reviewed code.

Resolve dependencies by registered name through the host catalog, independently of the reviewed repository. Read review-code-changes before preparing inputs or judging findings. It owns audit criteria, evidence, severity and report grammar. Read compare-solutions for the same-task independent attempt and evidence-based synthesis contract. This caller retains the fixed two-engine roster and its own coordinator: no third judge, nested coordinator or facet allocation. Read origin.toml for these composition choices. Before wording comments, resolve required comment-style. It owns wording; this skill owns selection, placement and API writes. communicate-clearly is optional general support, not another mandatory prose pass. A missing dependency blocks its dependent phase; preserve independently useful work.

Prepare one reproducible review

  1. Identify the PR and its rules. Read profiles.md. Capture its full URL, number, title, body, author, closingIssuesReferences, baseRefName, baseRefOid, headRefName and headRefOid in pr.json. The URL identifies the target repository even for a fork. Resolve relevant repository instructions, requirements and standards with their source, revision and applicability. When the conversation is dedicated to reviewing this PR and the host can rename it (T3: t3_thread_update with rename), title it [REVIEW] #<number> <ticket> <author>. The ticket is the subject ticket of the Brief, in its tracker's canonical form, such as ABC-123, #141, or owner/repo#141 for another repository's issue, else NO_TICKET; the author is the PR author's login, or the name the profile's Author names give it.
  2. Establish the checkout. Follow the host's checkout ownership rules. Fetch the required target-base and PR-head objects using the authorized Git transport. The checkout must be clean and at the captured PR head. Use the actual target base, including stacked PR bases; do not substitute the tracking branch or main. A supplied SHA that is unavailable is a prerequisite to resolve.
  3. Write review-context.md. Use the Brief below. Keep existing feedback and prior conclusions out of it.
  4. Freeze the shared packet. Read reviewers.md, then run scripts/snapshot.py prepare with the catalog-resolved auditor, context, PR input and any filtered profile. Supply every applicable domain guide through --rules so both engines receive it. When the diff adds or changes rendered UI and the accessibility skill resolves by registered name, stage its web or platform reference under a path-derived name and pass it with the review-practice authority class; when it is unavailable, record that and continue. The helper records immutable base/head/merge-base, the unique changed-path JSON (including deleted paths), a rename-origin map, the exact diff, source hashes and actual Git state. Its private manifest remains with the parent. Only review-relevant profile sections enter the shared packet. An empty diff is a valid scope.

Read the full file on GitHub · 188 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 3d ago Changed · -32 lines 8937c15ef32f
  2. 5d ago Changed · +12 lines · +15 tokens per session df1141908067
  3. 8d ago Changed · +2 lines d73124ff15c2
  4. 9d ago Changed · +6 lines 76385bba8b0e
  5. 10d ago Changed · +4 lines ef46185ab625
  6. 12d ago Changed · +3 lines dd28c1fe2680
  7. 14d ago Changed · +3 lines ed48e4915315
  8. 17d ago Changed f57574e20812
  9. 21d ago Changed · +8 lines 341e59469887
  10. 25d ago First seen · 182 lines · 16 tokens per session scan A 8fa071398d17

Subscribe to this mod's changes

pr-review is a skill published in the GitHub repository LuisUrrutia/skills (2 stars, last pushed today), licensed MIT. It adds 31 tokens to every session and 2,690 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-09.

Related

Other skills, from other repositories

code-review-and-quality

Use when reviewing Android code (own or others'). Five-axis review framework: Correctness, Readability, Architecture, Security, Performance. Categorized findings with Kotlin/Compose-specific checks.

GuillemRoca/agent-skills-android · 42 tokens

code-simplification

Use when code is harder to understand than it needs to be. Guides incremental simplification that preserves behavior exactly, following project conventions and Kotlin idioms.

GuillemRoca/agent-skills-android · 35 tokens

doubt-driven-development

Use when a decision is high-stakes and hard to reverse — architecture choices, data migrations, dependency adoption, public API contracts. Adversarial self-review that attacks the chosen approach before the code does, instead of defending the first idea that worked.

GuillemRoca/agent-skills-android · 55 tokens

fw-review

Full Freshworks marketplace app review — iparams, frontend, serverless, FDK, security, and structured text report output — in one skill.

freshworks-developers/fw-dev-tools · 34 tokens

battle-tested-engineer

Engineering judgment for code write/refactor/test and frontend UI. Trigger on code review, legacy cleanup, tests, UI with data, bloat/over-engineer complaints — even with no explicit mention, before any diff/rewrite/test suite. Output ultra-terse caveman style; code, commits, PR desc, security warnings stay normal…

sayeed1999/agent-skills · 74 tokens

agent-watchdog

Use when asked to watch, babysit, audit, review, compare, or fix another agent's work from a Codex session ID, Claude Code session/transcript, chat/thread link, PR, branch, log, or pasted run summary. Monitor until the other agent is done or blocked, reconstruct what the user asked, independently investigate the same…

BuilderIO/skills · 115 tokens