rpi-review

rpi-review is a skill for Claude Code from microsoft/hve-core. It costs 30 tokens per session (2,583 once invoked), scanned A, original, MIT.

A review workflow that compares an approved plan with implementation evidence and records whether the delivered work meets its requirements.

In plain words
What is it for?
Use it after implementation to check requirements, acceptance criteria, validation, blockers, follow-up items, and documented decisions.
Why use it?
It keeps execution facts separate from outcome assessment and routes gaps or remaining work to the stage that can resolve them.

Skill for Claude Code ✓ vendor

Written for Claude Code: user-invocable in frontmatter. Also seen: mentions subagents.

Good fit Use it after implementation to check requirements, acceptance criteria, validation, blockers, follow-up items, and documented decisions.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/microsoft/hve-core/rpi-review
About the project

HVE Core is a collection of agents, prompts, coding instructions, and skills for building repeatable software-development workflows with GitHub Copilot. It is intended for individuals and teams that want structured AI-assisted research, planning, implementation, and review, while the catalogue entries provide many of its reusable workflow components.

microsoft/hve-core · 1,606 stars · on GitHub

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add microsoft/hve-core --skill rpi-review
Clone the repo
git clone --depth 1 https://github.com/microsoft/hve-core

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for rpi-review

README.md
[![agentmods](https://agentmods.dev/badge/skills/microsoft/hve-core/rpi-review/github.svg)](https://agentmods.dev/skills/microsoft/hve-core/rpi-review)
Your own site
<a href="https://agentmods.dev/skills/microsoft/hve-core/rpi-review"><img src="https://agentmods.dev/badge/skills/microsoft/hve-core/rpi-review/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for rpi-review

Your own site · 80×15
<a href="https://agentmods.dev/skills/microsoft/hve-core/rpi-review"><img src="https://agentmods.dev/badge/skills/microsoft/hve-core/rpi-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 30 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 2,583 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits
  • NVIDIA SkillSpector warn 7 Sept 2026
SkillSpector: 1 finding, up to medium

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

  • medium Agent Snooping · line 25
    Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
    Fix: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
How audits are shown
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00030 $0.02583
Opus 5.5 $0.00012 $0.01033
Sonnet 5.5 $0.00006 $0.00517
Haiku 4.5 $0.00003 $0.00258

Measured 9d ago against content hash d1296e627d14, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

rpi-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.github/skills/rpi/rpi-review/SKILL.md · 84 lines

How it starts

The opening of the file, as written. The whole thing — 84 lines — stays where its author put it; the contents beside it link to each section on GitHub.

RPI Review

Goal

Produce one complete, human-readable, evidence-based review record after implementation finishes, as quickly as the evidence permits. Lead with the scoped assessment and material findings, keep evidence and resolution conditions with each finding, and make the final decisions easy to distinguish from the assessment.

Read references/review.md for the review document contract, comparison pass, optional helpers, outcome vocabulary, routing, conversation protocol, and per-finding walkthrough. Use templates/review-log.md as the canonical record skeleton.

Flow

  1. Resolve one task artifact set: current task-centered plan, latest plan critique when one ran, changes record, and relevant research. Use supplied paths, or the work's name and date: the task slug for a task's first work, or the name a later request's documents carry. Stop if multiple unrelated sets remain ambiguous.
  2. Resolve review depth. Use standard by default. Use deep only when the user explicitly requests a deep review; do not infer it from task size, complexity, uncertainty, or risk. Record depth and provenance.
  3. Resolve candidate decision participation: user-owned for standalone and manual RPI, agent-owned by default for confirmed automatic RPI Agent, and user-retained only when an automatic-session user explicitly keeps Review decisions. If the review record already exists, use its latest Parent Decision Record participation event. Record provenance.
  4. Confirm plan markers and task-local Goals, Requirements, Details, References, changes evidence, handoff prose, blockers, remaining work, follow-up items, and validation state are current and reconciled enough to form a credible review boundary. When you will use helper lanes, confirm this from the plan's markers and IDs and the changes record's status and reconciliation sections, and leave the task bodies for the comparison. Inspect the review path. When a review record exists, continue a started review from its saved record, and reuse a finished review unless the user asks for a new one.
  5. To start a review, create the record skeleton from templates/review-log.md at .copilot-tracking/reviews/logs/{{YYYY-MM-DD}}/{{task_slug}}-review.md, named like the plan it reviews, or, for a user-requested new review of the same work, at the next numbered path, such as {{task_slug}}-review-2.md. Persist Scope and Evidence and Opening Review State with review execution started and append one stable participation event to Parent Decision Record. When parent state exists, record the review path. Send the opening message defined in the reference.
  6. Compare the evidence yourself in one marker-driven pass using the review method in the reference. Activate skills whose descriptions say they are used during review and fit the task as scoped review criteria; exclude this skill and other RPI lifecycle phase entrypoints. When task Requirements: cite a BRD, PRD, or ADR source, or the changes record has Business Alignment entries, also apply references/business-alignment.md. Subagents are optional and follow the user's direction, including using none. When a dispatch tool is available and isolating context-heavy portions would help, split them into narrow independent lanes, dispatch the lanes in one parallel batch before reading the evidence they cover, at the reasoning effort each lane needs, and treat their candidates as suggestions to verify at the cited evidence, or investigate further yourself, before recording a finding. Optional helpers in references/review.md defines lanes, each lane's reasoning effort, the assignment, and the return.
    • In standard depth, cover every material contract in the supplied boundary once while minimizing elapsed work: all directly relevant supplied evidence, concise findings, and no restatement, cosmetic feedback, exhaustive strengths, low-impact suggestions, or continual narration.
    • In deep depth, trace cross-evidence more broadly, stress-test alternatives and boundaries, and include substantive lower-severity concerns within the same supplied boundary. Deep does not permit open-ended research or a second review pass.
  7. Write the evidence body as the review proceeds, saving the record each time so a reader can follow it while execution stays started: acceptance and change coverage as each area is assessed, and each RV-xxx finding with its proposed route as soon as it is verified. The finding set is complete, as one set, when execution leaves started. Then write the assessed execution status and outcome, validation coverage, limitations, and the reviewer self-check, and update review execution from started to Complete, Partial, or Blocked. A Partial review names the unassessed boundary and routes the missing work; a Blocked review names its blocker.
  8. Resolve every actionable RV-xxx according to decision participation. Treat Decision History within ## Parent Decision Record as the append-only canonical decision log. Append a stable event for each participation, walkthrough, execution, outcome, route, and continuation decision; never rewrite or remove an earlier event. Refresh the section's Current Disposition from those events as a reader-facing projection, not an independent decision authority.
    • For user-owned or user-retained, walk through each actionable finding one at a time as the Review Item Walkthrough in references/review.md defines, and persist each answer before the next item. A user-retained automatic session stays automatic and resumes once the decisions are recorded.
    • For agent-owned, skip all per-item questions, record the walkthrough as skipped-auto, and decide every proposal from evidence. Do not treat the later automatic follow-up selection as this walkthrough.
  9. Decide final execution and outcome from the evidence body and resolved or deferred findings. Append those events only to ## Parent Decision Record; preserve the evidence body and findings as written. When parent state exists, store only the record path plus derived next_action and accepted follow-up projections.
  10. Route each accepted gap once: implementation defects to later rpi-implement, decision gaps to rpi-plan, evidence gaps to rpi-research, and residual work to a distinct follow-up.
  11. Close with the Final response.

Read the full file on GitHub · 84 lines

Files

What ships with it

3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 9d ago Changed d1296e627d14
  2. 19d ago Changed · -9 lines b46173061744
  3. 24d ago Changed · +1 lines 91f4f6fcbd71
  4. 1mo ago Changed · -2 lines ef892214d3cd
  5. 1mo ago Changed · -4 lines scan B → A 365add5044c1
  6. 2mo ago Changed · +36 lines scan A → B 937cdb30364b
  7. 2mo ago First seen · 62 lines · 30 tokens per session scan A 462f2f0455ee

Subscribe to this mod's changes

rpi-review is a skill published in the GitHub repository microsoft/hve-core (1,606 stars, last pushed today), licensed MIT. It adds 30 tokens to every session and 2,583 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.

Related

rpi-review compared with skills from other repositories

rpi-review next to 6 skills from other repositories
ModTypeStarsLast pushLicenceScanTokensWorks with
rpi-reviewmicrosoft/hve-coreSkill1.6ktodayMITA30Claude Code
autoreviewopenclaw/clawhubSkill9.6ktodayMITA17Claude Code, Codex
agent-teams-simplify-and-hardenLeoYeAI/openclaw-master-skillsSkill2.2k2d agoMITA115Claude Code, Codex
omh-code-reviewrlaope/oh-my-hermesSkill5.2ktodayMITA49Claude Code, Codex
revdiff-planumputun/revdiffSkill9473d agoMITA84Claude Code
explore-unknownsdzhng/skillsSkill1.5ktodayMITA162Claude Code, Codex
re0-mergeLilMGenius/paperthinSkill1.4ktodayMITA70Claude Code