A workflow for reviewing a GitHub pull request, which is a proposed set of code changes awaiting review. It combines task context, code relationships, risk analysis, and verification before producing a review report.

Use it with a pull-request number or URL to analyze the changes, check requirements and affected code, verify findings, and optionally publish a review; it also supports a dry-run report.

It helps identify defects and risks across the changed code, including issues that may not be obvious from the pull request diff alone.

review-pr — Skill for Claude Code and Codex by mimfort: A workflow for reviewing a GitHub pull request, which…

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods

npx agentmods add skills/mimfort/rag_for_git/review-pr

Any agent

npx skills add mimfort/rag_for_git --skill review-pr

Clone the repo

git clone --depth 1 https://github.com/mimfort/rag_for_git

Made for: Claude Code, Codex.

Or install rag-reviewer, the plugin that ships this one along with the rest of its 14 skills, 2 hooks.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/mimfort/rag_for_git/review-pr.svg)](https://agentmods.dev/skills/mimfort/rag_for_git/review-pr)

Your own site

<a href="https://agentmods.dev/skills/mimfort/rag_for_git/review-pr"><img src="https://agentmods.dev/badge/skills/mimfort/rag_for_git/review-pr.svg" alt="Measured on agentmods" height="20"></a>

Per session 64 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 2,484 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. Scan, not verified.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00064	$0.02484
Opus 5	$0.00032	$0.01242
Sonnet 5	$0.00013	$0.00497
Haiku 4.5	$0.00006	$0.00248

Measured 5d ago against content hash e9abcaf9767c, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-05, from the pricing page.

Security

Grade A, and why

review-pr scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

plugin/skills/review-pr/SKILL.md · 152 lines

How it starts

The opening of the file, as written. The whole thing — 152 lines — stays where its author put it; the contents beside it link to each section on GitHub.

PR Review Pipeline

Orchestrate a full PR review using the reviewer MCP server tools. The deterministic tail (policy gate, line grounding, dedup, idempotency, comment cap, publishing) is handled by publish_review — your job is analysis quality, not formatting rules.

Inputs

Parse from $ARGUMENTS: target PR as owner/repo#N, owner/repo N, or a GitHub PR URL. --dry-run flag → pass dry_run=true to publish_review and show the report instead of posting.

Include resolution (applies to all steps below). When you read any references/*-prompt.md file to dispatch a subagent (steps 3, 4, and 5 — analyze, requirements, risk changes, blast-radius, verify), it may contain  markers. Before putting the prompt into the subagent, replace each marker with the verbatim contents of that file (path is relative to plugin/skills/). These _common/*.md files are the single source of the shared findings-schema / anti-hallucination / tool-usage blocks.

Pipeline

Prepare. Call prepare_review(repo, pr). The payload contains:
- pr: {number, title, body, base_sha, head_sha, base_ref, draft}
- policy: {severity_threshold, min_confidence, max_comments, categories, ignore, output_language}
- units: list of {path, patch, commentable_right, commentable_left}
- task_board: {type, project, key_pattern, create_target, done_target, options} or null — non-secret generic board metadata from .review.yml
- task_keys: {primary, others} or null — task keys extracted from the PR by the server
- risk_paths: bounded non-Python items with {path, status, reasons, patch, commentable_right, commentable_left}
- risk_skipped_paths: classified paths omitted by the deterministic cap
- skipped_paths, skip_drafts, suggestions_mode
If the payload has status: "skipped", this is NOT an error but an expected skip (the PR's target branch is not in REVIEW_BRANCHES). Tell the user the reason value and stop: do not run analyze/publish, and do not treat it as a failure.

Read the full file on GitHub · 152 lines

Files

What ships with it

5 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

5d ago First seen · 152 lines · 64 tokens per session scan A e9abcaf9767c

Subscribe to this mod's changes

review-pr is a skill published in the GitHub repository mimfort/rag_for_git (21 stars, last pushed 5d ago), licensed MIT. It adds 64 tokens to every session and 2,484 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Code review Git and workflow ai claude-code code-graph developer-tools mcp

graft

This repo is indexed by graft/. For ANY task here, whether understanding how something works, finding where code lives, tracing what calls a symbol or what a change breaks, or scoping an edit, get your context from graft before grepping or reading source files.

trailhq/Graft · 56 tokens

roam

Codebase comprehension via roam-code CLI. Use when exploring codebases, planning modifications, debugging failures, assessing PR risk, or checking architecture health. Triggers on: understanding project structure, pre-change safety checks, finding symbols/files, blast radius analysis, affected tests, health scoring…

Cranot/roam-code · 86 tokens

code-graph

This skill should be used when understanding code structure, finding dependencies between functions/classes, tracing call graphs, or exploring code relationships. Trigger phrases include 'code graph', 'call graph', 'who calls', 'what calls', 'find dependencies', 'code structure', 'inheritance', 'find paths'.

FalkorDB/code-graph · 64 tokens

code-knowledge-graph

Codebase'i knowledge graph olarak analiz et. Dependency, call graph, hotspot analizi.

vibeeval/vibecosystem · 24 tokens

m1nd-operator

Use when the user mentions m1nd or when repo investigation, search, review, docs/spec work, or risky change prep should go through m1nd first before grep, glob, or manual file reads. Covers m1nd-first routing, L1GHT and universal document ingestion, risky edit preparation, document-to-code binding, the served owner +…

maxkle1nz/m1nd · 111 tokens

agentmap

Use for TypeScript/JavaScript codebase navigation — symbol lookup, blast radius, reuse checks, and repo orientation. Prefer agentmap before serial grep when exploring imports, exports, or where a symbol lives. Package is @raymondchins/agentmap (not the unrelated npm package agentmap).

raymondchins/agentmap · 64 tokens