Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add NYTC69/review-loop --skill guidegit clone --depth 1 https://github.com/NYTC69/review-loopWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/nytc69/review-loop/guide)<a href="https://agentmods.dev/skills/nytc69/review-loop/guide"><img src="https://agentmods.dev/badge/skills/nytc69/review-loop/guide/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/nytc69/review-loop/guide"><img src="https://agentmods.dev/badge/skills/nytc69/review-loop/guide.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00025 | $0.00929 |
| Opus 5.5 | $0.00010 | $0.00372 |
| Sonnet 5.5 | $0.00005 | $0.00186 |
| Haiku 4.5 | $0.00003 | $0.00093 |
Grade A, and why
guide scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 64 lines — stays where its author put it; the contents beside it link to each section on GitHub.
review-loop Guide
What review-loop Does in Codex
A review-loop request goes to the Codex review-loop skill, which resolves the entry key in
.review-loop/config.md and hands the work item to the Codex paired-session skill. That skill
runs the coordinator through plan, implementation and review. With lifecycle on, finish, polish, docs
and security follow, up to DONE. With lifecycle off, it stops after the gate; acceptance returns the uncommitted tree.
It accepts only on your explicit acceptance.
A request to review existing code hands off the same way as run --review-only, and an existing
plan becomes the work item (PLAN drafts and reviews it again). entry: legacy, asking for "the legacy
review-loop workflow" and resuming a legacy session are refused, and a failed check before the
coordinator starts refuses instead of falling back. Runs are efficient by
default (every sandbox, no permission-probe PASS required); --strict or
"safety_mode": "strict" in the operator profile adds the probe gate.
The legacy workflow was removed in v2.13.0 (routing) and v2.13.1 (the Codex plan and execute skills, the
Codex Stage 1 workflow and its agents). Legacy session files under .review-loop/sessions/ are left on
disk and never read.
Details: docs/paired-session-migration.md.
A request to review a pull request ("review PR 123", a PR URL), a branch or
ref goes to the Codex review-pr skill, which runs the paired-session report mode
(entry: legacy and asking for the legacy review-pr are refused): it reviews it in a temporary clone with no tests
unless you confirm one, writes review-report.md, and fixes, commits or posts
nothing; posting is a separate request with a secret scan and a second
confirmation of the full body. simplify is not available there (Claude Code:
run /review-loop:code-quality-loop on the change (its POLISH-Q simplifier)).
Skills in Codex
review-loop,paired-session,review-prguide
Not on Codex:
code-quality-loop(ask review-loop to review an existing change instead: a review-only run with the quality writers on)reorganize
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago Changed · +3 lines 0d8a13d79fcf
- 10d ago Changed · +2 lines 458b1659a788
- 15d ago Changed · -40 lines · +4 tokens per session 89015152ab05
- 16d ago Changed · +9 lines a31563710c55
- 17d ago Changed · +17 lines a6148001b834
- 1mo ago Changed · +5 lines 28af984f086b
- 1mo ago First seen · 68 lines · 21 tokens per session scan A f7ca3330da84
guide is a skill published in the GitHub repository NYTC69/review-loop (3 stars, last pushed today), licensed Apache-2.0. It adds 25 tokens to every session and 929 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
ship-it-or-fix-it
Oracle-frozen Builder and independent-Judge convergence cycle. Load ONLY when the operator explicitly sets Governance Dial G2 for the task, or explicitly names this skill or an active work unit already running it. Never auto-activate on task class, such as security, auth, or payments. If a task seems to warrant G2 and…
test-verification
Requires behavioral, failure-path, and durable-seam evidence for tests and review. Use when writing tests, reviewing test coverage, assessing behavioral test quality, or accepting high-risk behavior on test evidence.
socratic-review
Socratic code review and refactoring session — whether it's your own code, a teammate's PR, or something you inherited. Leads you to see the issues through questions, names smells and moves precisely, then closes with a concrete plan.
simplify
Reduce the complexity of existing code without changing behavior - deep nesting, long functions, dead code, unclear names, the wrong abstraction. Use after a feature works but reads heavier than it should, or to clean up code written under time pressure. Pass --aggressive to reshape a working feature into the form it…
prior-art
Discover how a codebase already handles a specific concern — search broadly, find every instance, and assess consistency. The "how does this app do X?" tool.
code-review
Review code with a sharp, encouraging voice - inline GitHub PR comments + a tight summary. Supports PR (default), pending changes, commit hash, and codebase modes. Encodes an opinionated review style: severity-prefixed, concise, actionable, no fluff. Pass --refactor for the local reuse/slop lens (never posts). For the…