Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add lupingluke-ai/general-ai-spec --skill change-reviewgit clone --depth 1 https://github.com/lupingluke-ai/general-ai-specWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/lupingluke-ai/general-ai-spec/change-review)<a href="https://agentmods.dev/skills/lupingluke-ai/general-ai-spec/change-review"><img src="https://agentmods.dev/badge/skills/lupingluke-ai/general-ai-spec/change-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/lupingluke-ai/general-ai-spec/change-review"><img src="https://agentmods.dev/badge/skills/lupingluke-ai/general-ai-spec/change-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00067 | $0.08364 |
| Opus 5 | $0.00034 | $0.04182 |
| Sonnet 5 | $0.00013 | $0.01673 |
| Haiku 4.5 | $0.00007 | $0.00836 |
Grade A, and why
change-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 563 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Change Review & Archive
Overview
接管 dispatch runner 执行完成后的全部收尾流程:PR 审查 → 分形同步(在 feature branch 上)→ 本地 CI → rebase → 三维 Verify → 合并实现 PR → main-side sync → governance archive PR → 更新 backlog。
Branch-Centric 模型: 四件套和实现代码都在 feature branch 上,通过 PR 审查和合并。审查者可在 PR diff 中同时看到方案(四件套)和实现(代码),确保一致性。
可恢复闭环: 所有可能阻止交付的硬检查都在实现 PR 合并前完成。required checks 尚未完成时启用 auto-merge 并结束本轮;实现 PR 合并后,归档与共享治理文件通过确定性 governance/change-review/<change-id> PR 发布。重跑本 skill 会同时检查实现 PR 与 governance PR,因而不会重复 sync、move 或提交。
Announce at start: "Running change-review: checking for changes ready for review."
Bash 命令规范
为兼容 Claude Code / Codex 等不同执行环境的权限与审批模型,所有 Bash 操作必须遵循:
- 每条命令独立调用 — 不在一条 Bash 中用
&&、||、;串联多条命令 - 管道可以用 — 单条命令内的管道(如
git branch -r | grep feat/)是允许的 - 并行无依赖时分开调用 — 多条独立命令应作为多个并行 Bash tool call 发送
类型 → 分支前缀映射规则
type 的事实源是 product/backlog.md 的类型列(Step 1 方式 A 扫描 backlog 时同一行直接读到);方式 B/D 从 PR 的 headRefName 分支前缀直接得到。由 type 映射 branch / commit 前缀:
| type | branch 前缀 | commit type |
|---|---|---|
| feature | feat/ |
feat |
| bug | fix/ |
fix |
| chore | chore/ |
chore |
| hotfix | hotfix/ |
fix |
下方 Step 1 / Step 3 / Step 6 所有命令中的 <branch-prefix> 和 <commit-type> 均按本规则映射,不从 change-id 字符串反解析。
示例:
# ❌ 错误:复合命令触发确认
git fetch origin && git branch -r | grep feat/ && gh pr list --state open
# ✅ 正确:拆分为独立调用
# Call 1: git fetch origin
# Call 2: git branch -r | grep feat/
# Call 3: gh pr list --state open --json number,headRefName,title,isDraft
Step 1 — 发现待审查 Change
四种发现方式:
方式 A:扫描 Backlog + Feature Branch
读取 main 上 product/backlog.md,找到阶段为 proposed 且有 change-id 的条目(backlog 只有 4 阶段:idea/exploring/proposed/done;执行中 / 审查中的细粒度由 tasks.md YAML status 承担)。对每个 change-id:
git fetch origin <branch-prefix>/<change-id>
git show origin/<branch-prefix>/<change-id>:openspec/changes/<change-id>/tasks.md
筛选 YAML 头 status: review 的 change。
若 fetch feature branch 失败,但 main 上 backlog 仍为 proposed,不要直接放弃;进入方式 D 检查是否属于"已 merge 但未 archive"恢复场景。
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 563 lines · 67 tokens per session scan A 3372f13eec87
change-review is a skill published in the GitHub repository lupingluke-ai/general-ai-spec (5 stars, last pushed 1mo ago), licensed MIT. It adds 67 tokens to every session and 8,364 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
review-trtmc-pr
Review a TensorRT-Model-Connect GitHub PR or local contributor branch against the current post-#1093 model-family isolation architecture, repository rules, behavioral correctness, and exact-head validation evidence. Use for contributor self-review before marking a PR ready, or when deciding whether a community PR is…
submit-github-pr
Use when publishing an existing TensorRT-Model-Connect change as a GitHub pull request. Verifies authenticated repository access, branch and diff scope, validation evidence, commit identity, reviewer-facing text, exact pushed head, and the created draft PR without merging it.
write-git-messages
Draft, revise, or review Git commit messages, PR titles, PR descriptions, and squash or rebase merge messages. Use when Codex needs to summarize a diff for reviewers, convert rough notes into a commit or PR message, check a message against Git and Conventional Commits style, or prepare repository contribution text…
dhpk-gitnexus-refactoring
Safely rename, extract, split, move, or restructure code using the GitNexus graph + coordinated rename. Use when: renaming a symbol across files, extracting a module, splitting a function/service, moving code. Not for: understanding code (use dhpk-gitnexus-exploring), pre-change risk only (use…
dhpk-gitnexus-impact-analysis
Assess the blast radius of a code change via the GitNexus graph. Use when: asking what breaks if you change X, who depends on a symbol, or for a pre-commit safety check. Not for: understanding how code works (use dhpk-gitnexus-exploring), bug tracing (use dhpk-gitnexus-debugging), performing the rename/refactor (use…
PR Standards
Pull request description, review depth, and merge standards so every PR carries enough context to review and merge safely.