HVE Core is a collection of agents, prompts, coding instructions, and skills for building repeatable software-development workflows with GitHub Copilot. It is intended for individuals and teams that want structured AI-assisted research, planning, implementation, and review, while the catalogue entries provide many of its reusable workflow components.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add microsoft/hve-core --skill rpi-reviewgit clone --depth 1 https://github.com/microsoft/hve-coreWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/microsoft/hve-core/rpi-review)<a href="https://agentmods.dev/skills/microsoft/hve-core/rpi-review"><img src="https://agentmods.dev/badge/skills/microsoft/hve-core/rpi-review.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Agent Snooping · line 25 Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.Fix: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00030 | $0.02982 |
| Opus 5 | $0.00015 | $0.01491 |
| Sonnet 5 | $0.00006 | $0.00596 |
| Haiku 4.5 | $0.00003 | $0.00298 |
Grade B, and why
rpi-review scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Enumerates other installed skillsmediumAgent snooping
Other skills' SKILL.md files reveal prompts, capabilities and secrets that should be invisible to peers.
5. Before creating a worker reservation, inspect available skills and subagents. A candidate's stable name contains `review` or `reviewer`, or its description explicitly says it is used during review; select it only when How it starts
The opening of the file, as written. The whole thing — 98 lines — stays where its author put it; the contents beside it link to each section on GitHub.
RPI Review
Goal
Produce one complete, human-readable, evidence-based review record after implementation finishes. Lead with the scoped assessment and material findings, keep evidence and resolution conditions with each finding, and make the parent's final decisions easy to distinguish from worker proposals.
Use one selected review worker to compare the complete supplied acceptance boundary as quickly as the evidence permits. The primary review parent owns the final outcome, every route disposition, continuation, and user conversation.
Read references/review.md for the review document contract, method, outcome vocabulary, routing, and conversation protocol. Use templates/review-log.md as the canonical record skeleton.
Flow
- Resolve one task artifact set: current task-centered plan, latest plan critique, changes record, and relevant research. Use supplied paths or the stable task slug and date. Stop if multiple unrelated sets remain ambiguous.
- Resolve review depth. Use
standardby default. Usedeeponly when the user explicitly requests a deep review; do not infer it from task size, complexity, uncertainty, or risk. Record depth and provenance. - Resolve candidate decision participation:
user-ownedfor standalone and manual RPI,agent-ownedby default for confirmed automatic RPI Agent or rpi-quick, anduser-retainedonly when an automatic-session user explicitly keeps Review decisions. If the review record already exists, use only its latest Parent Decision Record participation event and ignore pre-record preference state. Record provenance. - Confirm plan markers and task-local Goals, Requirements, Details, References, changes evidence, handoff prose, blockers, remaining work, and follow-up items are reconciled enough to form a credible review boundary. Inspect the review path and parent state when present. An existing builder execution of
started, Complete, Partial, or Blocked consumes the one builder invocation; reconcile that record and do not dispatch a replacement. If an existing builder execution has no canonical participation event, stop final Review execution Blocked and outcome Not accepted rather than restoring a stale preference. - Before creating a worker reservation, inspect available skills and subagents. A candidate's stable name contains
revieworreviewer, or its description explicitly says it is used during review; select it only when its description fits evidence comparison and review-document construction for this task. Exclude this skill and other RPI lifecycle phase entrypoints from helper selection. Activate useful matching skills as scoped review criteria. Prefer one matching subagent. When none fits, select an unnamed general-purpose subagent by omitting the agent selection. Retain the selected worker identity orgeneral-purposeand dispatch availability without writingstartedor dispatching. - When no builder execution exists, create the canonical record skeleton at
.copilot-tracking/reviews/logs/{{YYYY-MM-DD}}/{{task_slug}}-review.mdusing templates/review-log.md. Persist Scope and Evidence and Opening Review State, append one stable participation event to Parent Decision Record, then, when parent state exists, require one successful state write that removes pre-record preference and stores only the record pointer/revision. Do not continue if any write fails.- When subagent dispatch is unavailable, set builder execution metadata to
Blocked (not dispatched: unavailable), append final Review execution Blocked and outcome Not accepted with the exact later-new-review condition, and persist only the record pointer and derived projections in parent state. Do not writestartedor compare evidence inline. These terminal records consume the current Review even if availability changes later. - When availability passes, persist builder candidate identity, depth and provenance, and builder execution
startedbefore dispatch. Do not dispatch if this write fails.
- When subagent dispatch is unavailable, set builder execution metadata to
- Dispatch exactly one selected review worker with the stable task identity, review purpose, review depth and provenance, exact scope, acceptance basis, complete artifact set, exact read boundary, canonical template, review-record path, compact return, and write authority limited to the review record except
## Parent Decision Record. For an unnamed general-purpose worker, explicitly prohibit source, plan, critique, research, changes-record, parent-state, and Parent Decision Record edits; user questions; final outcome or route decisions; destination invocation; and nested delegation.- In standard depth, require complete coverage of every material contract in the supplied boundary while minimizing elapsed work: one marker-driven comparison, all directly relevant supplied evidence, concise findings, and no restatement, cosmetic feedback, exhaustive strengths, low-impact suggestions, continual narration, or additional workers.
- In deep depth, require broader cross-evidence tracing, stress-test alternatives and boundaries, and include substantive lower-severity concerns within the same supplied boundary. Deep does not permit open-ended research, nested workers, or a second review pass.
- The builder writes the evidence body, one complete
RV-xxxfinding set, proposed execution status and outcome, validation coverage, limitations, and proposed routes. The builder does not ask the user, mutate parent state, select continuation, or invoke a destination.
- Read the completed review record and compact builder return once. Do not redo the evidence comparison or dispatch another worker. A Partial or Blocked builder result is terminal and must name the unassessed boundary or blocker. On recovery, stranded
startedis also terminal: record final Review execution Blocked and outcome Not accepted, preserve the evidence, and name the exact condition for a later new Review. - Resolve every actionable
RV-xxxaccording to decision participation. Treat Decision History within## Parent Decision Recordas the append-only canonical decision log. Append a stable event for each participation, walkthrough, execution, outcome, and route decision; never rewrite an earlier event. Refresh the section's Current Disposition from those events as a reader-facing projection, not an independent decision authority.- For
user-ownedoruser-retained, present one finding at a time. Before asking, link the review record and cited evidence, then explain in plain language what was found, why it matters, the proposed route, consequences, uncertainty, and a suggested answer. - Use
vscode_askQuestionswhen available. OfferUse suggested action: [plain-language action]as the recommended option,Gather more information,Skip this item, andFinish review decisions; allow freeform input so the user also has an empty response box. When unavailable, present the same choices in chat and wait. - Append each answer and its finding, route, owner, rationale, evidence need, and outcome effect before asking about the next item.
Gather more informationdefers or changes the route to the appropriate evidence owner.Skip this itemrejects the proposed route without erasing the finding.Finish review decisionsstops questions and appends deferred events for every undecided item. Material skipped or deferred findings prevent a conformant final outcome. - For
agent-owned, skip all per-item questions, record the walkthrough asskipped-auto, and decide every proposal from evidence. Do not treat the later automatic follow-up selection as this walkthrough.
- For
- Decide final execution and outcome from builder evidence and resolved or deferred findings. Append those events only to
## Parent Decision Record; preserve builder-authored evidence and findings. When parent state exists, store only the record path and revision plus derivednext_actionand follow-up projections. - Route each accepted gap once: implementation defects to later
rpi-implement, decision gaps torpi-plan, evidence gaps torpi-research, and residual work to a distinct follow-up. A later implementation does not require another Review. - Return the record, builder execution, final review execution and outcome, validation evidence, findings, decision participation and walkthrough status, route dispositions, and next action.
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed · +36 lines scan A → B 937cdb30364b
- 4d ago First seen · 62 lines · 30 tokens per session scan A 462f2f0455ee
rpi-review is a skill published in the GitHub repository microsoft/hve-core (1,436 stars, last pushed today), licensed MIT. It adds 30 tokens to every session and 2,982 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it B with 1 finding (enumerates other installed skills). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
adversarial-reviewer
Adversarial code review that assumes bugs exist and hunts for them. Use when asked to review code, find bugs, audit for correctness, stress-test a PR, or when someone says "tear this apart" or "what's wrong with this". Give no benefit of the doubt — every line is guilty until proven innocent.
go-testing
Trigger: Go tests, go test coverage, Bubbletea teatest, golden files. Apply focused Go testing patterns.
semgrep-rule-variant-creator
Creates language variants of existing Semgrep rules. Use when porting a Semgrep rule to specified target languages. Takes an existing rule and target languages as input, produces independent rule+test directories for each language.
brooks-sweep
Full-sweep mode: runs a unified analysis across all quality dimensions — code decay, architecture, tech debt, and test quality — then applies fixes directly to the codebase. Safe changes are auto-applied; risky changes are confirmed before execution. Drawing on twelve classic engineering books. Triggers when: user…
include-test-files-that-assert-on-behavior-being-changed-in-decl
When delegating a task affected by this skill, include.
plugin-review
Review plugin quality with tiered checks and dependency scoping. Use for PR and pre-release audits.