Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add mblode/agent-skills --skill pr-reviewergit clone --depth 1 https://github.com/mblode/agent-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/mblode/agent-skills/pr-reviewer)<a href="https://agentmods.dev/skills/mblode/agent-skills/pr-reviewer"><img src="https://agentmods.dev/badge/skills/mblode/agent-skills/pr-reviewer/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/mblode/agent-skills/pr-reviewer"><img src="https://agentmods.dev/badge/skills/mblode/agent-skills/pr-reviewer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00068 | $0.04605 |
| Opus 5 | $0.00034 | $0.02302 |
| Sonnet 5 | $0.00014 | $0.00921 |
| Haiku 4.5 | $0.00007 | $0.00460 |
Grade A, and why
pr-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 182 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Local Review
- IS: read-only review of a local diff, branch diff, or PR. Returns severity-tiered findings; leaves the working tree unchanged.
- IS NOT: fixing code (
tidy), creating PRs (pr-creator), monitoring CI or review threads (pr-babysitter), frontend UX, accessibility, or rendered-quality review (ui-designAudit mode), library or CLI ergonomics (dx-audit), architecture briefs (codebase-architecture), reviewing plans (planning).
Only report issues you can defend with file:line evidence.
When to run: on the requested diff, including a failing one. Existing check results at the same revision are usable evidence; run a focused check when it can settle a finding, and report coverage limits.
Then hand off. tidy runs next in the usual flow, hunting complexity and applying what it finds, including this report's confirmed findings. So write the report to be consumed: every Fix: line has to be something a person could commit. Do not apply anything yourself, even a one-character fix; the moment this skill edits a file the user loses the read-only report they asked for.
Harness precedence
Claude Code bundles /code-review (correctness plus cleanups, with effort levels, --fix, and --comment) and /security-review (security on the current diff). A typed slash command runs the bundled skill, not this one; this skill runs when named or when a mode phrase below matches. It does not replace them. It adds Structural and Deslop modes, a whole-repo Security audit, a plausible tier the bundled commands filter out, REVIEW.md support (which the local /code-review does not read), and the same report on any harness, with git and the file tools alone. Do not run both on one diff unprompted; where a bundled review already ran this session, its findings enter the verdict step as candidates rather than being re-derived. Never reach for --fix or tidy mid-review to "confirm" a finding; that edits the tree the report is about.
Mode dispatch
What ships with it
8 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday Changed · +2 lines abb88f4c4b26
- 4d ago Changed · -4 lines · -118 tokens per session c3bf6045368c
- 9d ago First seen · 184 lines · 186 tokens per session scan A ebc2ecca6cf5
pr-reviewer is a skill published in the GitHub repository mblode/agent-skills (106 stars, last pushed yesterday), licensed MIT. It adds 68 tokens to every session and 4,605 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
spawn-reviewers
Spawn and collect the reviewer fleet at stage20spawnreviewers. Consumes spawn.json.spec (the authoritative spawn spec from derive-spawn-spec / derive-static-spec), resolves GRAPHPROJECT, builds per-agent prompts from the per-agent template + role suffixes (Bug Hunter A/B, Unified Auditor, Domain Critics, Impact…
verify-findings
Dispatch and collect the finding-verifier fleet at stage23verifyfindings (PLN-722). Reads verifymanifest.json (written by stage22bverifyprepare), spawns one falsify-oriented verifier Task per toverify[] entry with mode-specific Task scheduling (GitHub mode dispatches verifiers synchronously; local mode uses parallel…
singleton-dispatch
PLN-725 single-agent dispatch for stage11extractsignals and stage15coveragecritic. After each prepare stage writes its manifest, this skill reads the status field (cachehit / skipped / needsagent) and, only on needsagent, spawns one synchronous singleton Task that writes the by-convention pln725.json output the…
codex-review
Run Codex to review a plan file and return structured feedback with a verdict. Triggers on: debate loop Codex review rounds. Returns VERDICT:APPROVED or VERDICT:NEEDSCHANGES plus CODEXSESSION token.
critic-cache
Check if critic reviews are still valid before re-running Phase 2.5 critics. Compares plan.json + critic-gates.json content hash against stored hash from last critic run. Triggers on: entering Phase 2.5, checking critic cache, before launching critics. Returns CRITICCACHEHIT to skip critics or CRITICCACHEMISS to…
requesting-code-review
Pre-commit review: security scan, quality gates, auto-fix.