review-duo

review-duo is a skill for Codex from murray17/rovai-ai. It costs 92 tokens per session (1,248 once invoked), scanned A, original, MIT.

A workflow for two people to review the same fixed code change: one checks requirements and the other checks coding rules, correctness, and quality. The review is read-only unless the user separately asks for changes.

In plain words
What is it for?
Running a paired code review, checking acceptance criteria and repository standards, and producing a report with both independent findings.
Why use it?
It separates product-requirement checks from technical checks and prevents reviewers from examining different versions of the change.

Skill for Codex

Written for Codex: agents/openai.yaml present.

Good fit Running a paired code review, checking acceptance criteria and repository standards, and producing a report with both independent findings.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/murray17/rovai-ai/review-duo
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add murray17/rovai-ai --skill review-duo
Clone the repo
git clone --depth 1 https://github.com/murray17/rovai-ai

Made for: Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for review-duo

README.md
[![agentmods](https://agentmods.dev/badge/skills/murray17/rovai-ai/review-duo/github.svg)](https://agentmods.dev/skills/murray17/rovai-ai/review-duo)
Your own site
<a href="https://agentmods.dev/skills/murray17/rovai-ai/review-duo"><img src="https://agentmods.dev/badge/skills/murray17/rovai-ai/review-duo/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for review-duo

Your own site · 80×15
<a href="https://agentmods.dev/skills/murray17/rovai-ai/review-duo"><img src="https://agentmods.dev/badge/skills/murray17/rovai-ai/review-duo.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 92 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,248 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits
  • NVIDIA SkillSpector pass 7 Sept 2026
How audits are shown
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00092 $0.01248
Opus 5 $0.00046 $0.00624
Sonnet 5 $0.00018 $0.00250
Haiku 4.5 $0.00009 $0.00125

Measured 11d ago against content hash cff02012331f, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-11, from the pricing page.

Security

Grade A, and why

review-duo scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/review-duo/SKILL.md · 76 lines

What it actually says

双人代码评审

两位成员检查同一份固定代码改动:固定搭档检查仓库规范、正确性与代码质量,当前评审者检查需求与验收条件,最终报告保留两个独立方向。

评审默认只读。完成报告不自动修改代码、创建任务、提交、推送或更新 PR;用户同时要求修改时,先完成报告。

角色与关联

  • 用户发起双人评审:作为发起者,负责需求检查和最终整理。
  • 当前 AgentRun 由规范与质量检查请求直接触发:作为固定搭档,只处理当前请求。
  • 当前输入是固定搭档对本轮有效请求的直接回复:作为发起者继续。

使用 Runtime 或 Core 提供的可信身份和直接回复关系判断角色。固定搭档必须不是自己、仍在当前 Camp、能够接收请求,并使用可信 Agent ID 寻址。

发起者只接受当前固定搭档对本轮请求的直接回复,并核对固定评审范围完全一致;标题和范围帮助阅读,不能替代可信发送者与直接回复。同一发起者在一个 Camp 中一次只推进一场未完成的 Review Duo。

固定评审输入

开始前读取 评审范围。两位成员必须读取同一份固定输入,例如已解析为不可变提交标识的 Git 范围,或用户提供且双方都能读取的固定 patch。

同时固定需求与验收来源、仓库规范来源和覆盖限制。没有明确需求时,需求方向标记为 not_assessed;没有稳定代码范围时,请用户提供提交范围或固定 patch,不能用两个时间点的实时工作区冒充同一输入。

独立检查

固定搭档只检查仓库规则、明确正确性、错误处理、数据一致性、并发、重试、安全、API、数据库、迁移、生命周期、关键测试缺口和显著维护成本,不判断产品需求是否满足。

当前评审者只检查需求是否缺失、部分实现或实现错误,验收条件是否成立,是否加入未要求的行为,以及需求来源是否冲突或不足,不把一般代码风格写成需求问题,也不从代码反向创造需求。

发起者必须在吸收搭档结论前完成并公开自己的需求检查;发给搭档的请求不得包含自己的结论。

结果与消息方式

每个方向使用一条有界的完整结果。无法保留必要问题和证据时, 标记为 partial 并建议缩小范围。具体格式见 Finding 与报告

  • 评审请求只发给固定搭档:rovai send --to <固定搭档 Agent ID> --body <请求>; 搭档结果只返回请求发送者:rovai send --to <请求发送者 Agent ID> --body <结果>; 需求检查和最终报告通过 rovai send --body <正文> 公开发布。
  • 发送后确认实际收件人符合上述关系。正文中的 @ 只是代码或引用时, 放入代码块或转义。
  • 只有发送成功的消息才能作为后续依据;发送成功不代表对方已经完成。

四条消息

  1. 发起者向固定搭档发送规范与质量请求,包含固定范围、需求与规范来源、 覆盖限制和分工。发送后在同一响应中独立完成需求检查,不等待搭档。
  2. 发起者公开保存一条携带相同固定范围的完整需求检查结果,然后结束当前响应。
  3. 固定搭档只处理当前请求,用一条携带相同固定范围的消息返回完整结果。
  4. 发起者核对搭档身份、直接回复、固定范围和结果职责后,公开发布最终报告。

正常流程只有上述四条消息。

结果独立性

两个方向保留各自的 finding 内容、ID、严重度和顺序,不跨方向合并。 同一行为可以在两个方向分别报告。最终固定先呈现“规范与质量”, 再呈现“需求符合度”,不生成单一总分。

完成与降级

最终报告表示当前会话中的评审完成。同一范围的最终报告发布后,重复、旧搭档或迟到结果只作补充,不再推进或发布报告。

搭档请求发送成功后保持固定。只有明确不可用或投递失败时更换;更换后只接受新搭档对新请求的直接回复,旧结果只作补充。

  • 没有合格搭档且用户不强制双人:降级为单人双方向评审,并明确不具备双人独立性;用户强制双人时停止。
  • 搭档无法读取固定范围:更换一次或停止,不改读实时分支。
  • 需求缺失:规范与质量继续,需求方向标记为 not_assessed
  • 范围在最终整理前变化:旧范围报告标记 stale;需要最新结果时开始新评审。
  • 用户取消或替换目标:结束旧评审,旧结果不能推进新评审。
Files

What ships with it

4 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 11d ago First seen · 76 lines · 92 tokens per session scan A cff02012331f

Subscribe to this mod's changes

review-duo is a skill published in the GitHub repository murray17/rovai-ai (64 stars, last pushed today), licensed MIT. It adds 92 tokens to every session and 1,248 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.