A structured code-review procedure for pull requests, branches or uncommitted changes. It checks the changes against project architecture and pre-merge rules.

Use it to review a branch, pull request or working tree, inspect the changed files, apply project checklists, and decide whether the changes are ready to merge.

A change can look correct while violating project conventions or missing important tests. The review produces findings grouped by whether they block merging, need attention, or are minor.

review — Skill for Claude Code by markmhendrickson

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add markmhendrickson/neotoma --skill review

Clone the repo

git clone --depth 1 https://github.com/markmhendrickson/neotoma

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/markmhendrickson/neotoma/review.svg)](https://agentmods.dev/skills/markmhendrickson/neotoma/review)

Your own site

<a href="https://agentmods.dev/skills/markmhendrickson/neotoma/review"><img src="https://agentmods.dev/badge/skills/markmhendrickson/neotoma/review.svg" alt="Measured on agentmods" height="20"></a>

Per session 57 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 6,257 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits

NVIDIA SkillSpector pass 7 Sept 2026

How audits are shown

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00057	$0.06257
Opus 5	$0.00028	$0.03129
Sonnet 5	$0.00011	$0.01251
Haiku 4.5	$0.00006	$0.00626

Measured 8d ago against content hash 9c93c3567903, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-08, from the pricing page.

Security

Grade A, and why

review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.claude/skills/review/SKILL.md · 366 lines

How it starts

The opening of the file, as written. The whole thing — 366 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Review

Perform a structured code review of a GitHub PR, a branch, or the current working tree against a base ref.

Invocation forms

Form	Meaning
`/review`	Review uncommitted + committed changes on current branch vs `main`
`/review <base>..<head>`	Review a specific ref range (e.g. `v0.13.0..HEAD`, `main..feature/x`)
`/review PR#N`	Fetch PR diff via `gh pr diff N` and review it
`/review --base <ref>`	Override the base ref; head defaults to `HEAD`

When to invoke

Before merging any feature branch to main
As part of /release Step 3.6 (test coverage review) on the full release diff
When changes went directly to main and need a retroactive review pass
When asked to review a specific PR or diff range
From run_feature_workflow before the final merge step

Workflow

Phase 1 — Scope the diff

Determine base and head refs from the invocation form above.
Run:
```
git diff --stat <base>..<head>
git diff --name-only <base>..<head>
```
For a PR: gh pr diff <N> --name-only and gh pr view <N> for metadata.
Compute surface summary:
- Files changed, lines added/removed
- Which surface categories are touched (data layer, API/contract, auth/security, CLI, tests, docs, release, observability)
- Whether any high-risk surfaces are present (destructive ops, file-shape parsers, new CLI commands, HTTP runtime config, auth middleware)
Print a one-line scope summary before proceeding:

"Reviewing .. — N files, +X/−Y lines. Surfaces: [list]. High-risk: [yes/no]."

Phase 2 — Load docs

Always load (3 docs — true invariant kernel only):

docs/NEOTOMA_MANIFEST.md
docs/foundation/layered_architecture.md
.claude/rules/change_guardrails_rules.md

Load conditionally based on paths in the diff (per docs/developer/pr_review_reading_list.md):

If diff touches	Also load
`src/reducers/`	`docs/subsystems/reducer.md`
`src/services/ingestion`, `src/services/store`	`docs/subsystems/ingestion/ingestion.md`, `docs/architecture/idempotence_pattern.md`
`src/services/observation`, `src/services/sources`	`docs/subsystems/sources.md`, `docs/subsystems/observation_architecture.md`
`src/services/interpretation*`	`docs/subsystems/interpretations.md`
`src/services/relationships*`	`docs/subsystems/relationships.md`
`src/services/entity`, `src/services/schema_registry`	`docs/foundation/entity_resolution.md`, `docs/subsystems/schema_registry.md`, `docs/subsystems/schema.md`
`src/services/entity_merge*`	`docs/subsystems/entity_merge.md`
`src/services/timeline`, `src/services/events`	`docs/foundation/timeline_events.md`, `docs/subsystems/events.md`
`src/services/search`, `src/shared/action_handlers/entity_handlers`	`docs/subsystems/search/search.md`
`src/services/deletion*`	`docs/subsystems/deletion.md`
`src/services/peer*`	`docs/subsystems/peer_sync.md`
`openapi.yaml`, `src/shared/contract`, `src/shared/openapi`	`docs/architecture/openapi_contract_flow.md`
`src/tool_definitions.ts`, `src/server.ts`, `docs/developer/mcp/`	`docs/developer/mcp/instructions.md`, `docs/developer/agent_instructions_sync_rules.mdc`
`src/cli/`	`docs/developer/cli_reference.md`
`src/actions.ts`, `src/services/local_auth*`, `src/middleware/`	`docs/subsystems/auth.md`, `docs/security/advisories/2026-05-11-inspector-auth-bypass.md`
`src/actions.ts`, `src/server.ts`, any auth/middleware path	`docs/security/threat_model.md`
Guest access, public routes	`docs/subsystems/guest_access_policy.md`
`src/services/root_landing/`	`docs/security/threat_model.md`
New call to `registry.register()` (i.e. a new entity type being registered, not a schema field addition)	`docs/subsystems/record_types.md`, `docs/foundation/data_models.md`
Any `if (entityType`, `switch (entity_type`, or hardcoded entity-type list in diff	`docs/foundation/schema_agnostic_design_rules.md`
Any new error code, tightened validation, or changed error response shape	`docs/subsystems/errors.md`
`Math.random`, `Date.now` in non-observability paths, new sort/grouping in stored-output path	`docs/architecture/determinism.md`
Any change to stored fields, observation shape, or entity snapshot output	`docs/foundation/core_identity.md`, `docs/foundation/philosophy.md`
Logging, metrics, tracing	`docs/observability/logging.md`, `docs/observability/metrics_standard.md`, `docs/subsystems/privacy.md`
`tests/`	`docs/testing/testing_standard.md`
`docs/releases/`	`docs/developer/github_release_process.md`
`package.json` scripts	`docs/developer/package_scripts.md`
`.claude/settings.json`, `*.sh`, `.github/workflows/`	(no doc to load) — apply Phase 5 portability check

Read the full file on GitHub · 366 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

8d ago First seen · 366 lines · 57 tokens per session scan A 9c93c3567903

Subscribe to this mod's changes

review is a skill published in the GitHub repository markmhendrickson/neotoma (31 stars, last pushed today), licensed MIT. It adds 57 tokens to every session and 6,257 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Code review ai-agents entity-resolution event-sourcing mcp privacy-first provenance

reviewer

Code review - correctness, tests, merge-readiness.

sipyourdrink-ltd/bernstein · 14 tokens

review-thread

Record review verdicts and run the StateNote review thread on an agent-operation instance — every ReviewRequest verdict is one atomic batch-direct-write that advances status and co-writes a reviewnote explaining why, and findings are corrected by appending notes rather than editing them.

cruxible-ai/cruxible · 56 tokens

cratis-code-review

Review changed code in a Cratis application against the architecture, style, and specification-coverage criteria that the compiler cannot check, and produce a structured report with blocking issues separated from suggestions. Use when asked to review, check, or validate a change. Do not substitute it for a focused…

Cratis/AI · 73 tokens

cratis-engineering-csharp-conventions

Apply the Cratis C# house conventions when writing or reviewing C# in a Cratis repository - formatting, naming, records and primary constructors, nullable handling, XML documentation, custom exceptions, structured logging, dependency injection, and service lifetimes. Use for any "how should this be written" C# style…

Cratis/AI · 86 tokens

review-code

Use this skill when asked to review, check, or validate code in a Cratis-based project. Produces a structured review report with blocking issues and suggestions, checked against all project architecture and style standards.

Cratis/AI · 44 tokens

cratis-engineering-effect-boundaries

Apply the Cratis effect-boundary contract when writing or reviewing code that publishes, persists, generates, propagates, or releases. On those boundaries partial success is failure - no catch-and-continue, no defaulting to success on an unknown outcome. Use when a degraded run could still report success; defer style…

Cratis/AI · 80 tokens