A skill that reviews an agent-authored GitHub pull request in two stages: whether it follows the specification, then whether the code is well made. It posts findings to the pull request with severity labels.

Reviewing agent-created pull requests, comparing changes with an issue’s acceptance criteria, and leaving formal GitHub review comments.

It checks both correctness against the requested work and broader code quality before merging. The normal workflow expects an open pull request and green continuous-integration checks.

vibe-review — Skill for Claude Code by OAI-Labs

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add OAI-Labs/vibe-flow --skill vibe-review

Clone the repo

git clone --depth 1 https://github.com/OAI-Labs/vibe-flow

Made for: Claude Code.

Or install vibe-flow, the plugin that ships this one along with the rest of its 14 skills, 2 agents.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/oai-labs/vibe-flow/vibe-review/github.svg)](https://agentmods.dev/skills/oai-labs/vibe-flow/vibe-review)

Your own site

<a href="https://agentmods.dev/skills/oai-labs/vibe-flow/vibe-review"><img src="https://agentmods.dev/badge/skills/oai-labs/vibe-flow/vibe-review/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/oai-labs/vibe-flow/vibe-review"><img src="https://agentmods.dev/badge/skills/oai-labs/vibe-flow/vibe-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 44 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 1,986 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00044	$0.01986
Opus 5	$0.00022	$0.00993
Sonnet 5	$0.00009	$0.00397
Haiku 4.5	$0.00004	$0.00199

Measured 11d ago against content hash 7e5c66a33aa5, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-11, from the pricing page.

Security

Grade A, and why

vibe-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

plugins/vibe-flow/skills/vibe-review/SKILL.md · 210 lines

How it starts

The opening of the file, as written. The whole thing — 210 lines — stays where its author put it; the contents beside it link to each section on GitHub.

vibe-review

Overview

Fresh subagent with isolated context reviews the PR diff. Two-stage: does it meet the spec? Then, is the code good? Output is posted to GitHub as a formal review.

Core principle: Review early, review strict, preserve main-thread context.

Announce at start: "I'm using the vibe-review skill to review the PR."

When to use

A PR is open (linked via vibe-link)
CI is green (or config.review_before_ci: true)
Before merge

Do NOT use if:

Issue is tagged hotfix with ≥2 human approvals → skip to merge, review async after
PR is from a human (not an agent workspace) — this skill is for agent-authored code

Required

PR URL + number
Issue ID (for spec context)
gh CLI authenticated
Subagent capability — use Agent tool with vibe-flow:vibe-reviewer

The process

Step 1: Gather context

Fetch:

BASE_SHA=$(gh pr view <PR> --json baseRefOid --jq '.baseRefOid')
HEAD_SHA=$(gh pr view <PR> --json headRefOid --jq '.headRefOid')

Get issue spec:

MCP get_issue(issue_id) → title, description, acceptance criteria

Get diff size:

gh pr diff <PR> --name-only | wc -l  # file count
gh pr view <PR> --json additions,deletions

If diff > 1500 LoC → flag to user, ask if they want to split review or proceed anyway.

Step 2: Dispatch reviewer subagent

Use Agent tool with subagent_type vibe-flow:vibe-reviewer. Pass:

Issue title + description + acceptance criteria
PR URL, number, base/head SHAs
Prompt from references/prompt-templates.md section 5 (code review prompt)

The reviewer gets ONLY this context — no session history, no prior decisions. This is the superpowers principle.

Step 3: Parse review output

Reviewer returns <VIBE-REVIEW> block:

spec_compliance: pass|fail
quality_rating: approve|approve-with-minor|request-changes|reject
critical: [...]
important: [...]
minor: [...]

Step 4: Post to GitHub

Reviewer identity. GitHub rejects addPullRequestReview with APPROVE or REQUEST_CHANGES when the auth user is the PR author (error: "Can not request changes on your own pull request"). Resolve the auth token before calling gh:

Read the full file on GitHub · 210 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

11d ago First seen · 210 lines · 44 tokens per session scan A 7e5c66a33aa5

Subscribe to this mod's changes

vibe-review is a skill published in the GitHub repository OAI-Labs/vibe-flow (1 stars, last pushed 1mo ago), licensed MIT. It adds 44 tokens to every session and 1,986 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Claude Code Code review Git and workflow agent-orchestration ai-agents claude-code-plugin claude-plugin

pr-feedback

Work a reviewer's comments on a pull request to the end - all three comment surfaces enumerated before any is triaged, every comment fixed, declined with a reason, or ticketed, push before you reply. Use when a PR comes back with review feedback or a red check.

jjanczur/tyran · 57 tokens

upstream

Opt-in upstream contribution workflow for process improvements and field lessons. Scans the consuming repo's local AGENTS.md, {{ agentsdir }}/team.toml, and commit history for emergent rules, sanitizes sensitive client context, formats governed rule origins, and drafts an upstream Pull Request or Issue to the upstream…

NexaDuo/mARC · 83 tokens

vibe-review

Getting it into your agent

Wrote this? Show the measurements

What it costs to keep this loaded

Grade A, and why

Nothing flagged

How it starts

vibe-review

Overview

When to use

Required

The process

Step 1: Gather context

Step 2: Dispatch reviewer subagent

Step 3: Parse review output

Step 4: Post to GitHub

What this file has done since we first saw it

Other skills, from other repositories

pr-feedback

upstream

cad-reviewer-contract

loop-on-ci

quick-wrap

merging-to-main