Borrowing it
Nothing to install: this file belongs to outlmd/outl. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/outlmd/outl/main/.github/skills/code-review/SKILL.mdgit clone --depth 1 https://github.com/outlmd/outlWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/outlmd/outl/code-review)<a href="https://agentmods.dev/skills/outlmd/outl/code-review"><img src="https://agentmods.dev/badge/skills/outlmd/outl/code-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/outlmd/outl/code-review"><img src="https://agentmods.dev/badge/skills/outlmd/outl/code-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00094 | $0.02789 |
| Opus 5.5 | $0.00038 | $0.01116 |
| Sonnet 5.5 | $0.00019 | $0.00558 |
| Haiku 4.5 | $0.00009 | $0.00279 |
Grade A, and why
code-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 29d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 223 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Reviewing an outl pull request
.github/copilot-instructions.md carries the rules: the invariants, the merge bar, what not to comment on, how to format the review.
Read it first and defer to it.
This file carries the routine: given what the diff touches, the concrete checks that separate a real finding from a guess. Every check below exists because the corresponding bug shipped at least once.
Work in the order given. Stop at the first section that does not apply.
Step 0 — Route by what changed
Run git diff --name-only origin/main...HEAD and match paths against this table.
Only the matching rows apply.
| Changed path | Go to |
|---|---|
crates/outl-md/src/reconcile.rs, matching/, sidecar.rs, unlogged.rs |
Reconcile and the sidecar |
crates/outl-core/src/tree/, log.rs, op.rs |
The CRDT |
Any new pub fn or helper under crates/ |
New helpers |
crates/outl-shortcuts/ |
Catalogs with a per-client verdict |
crates/outl-theme/, any client stylesheet |
Theme tokens |
crates/outl-*/src-tauri/, outl-tui/src/, outl-mobile/src/, outl-desktop/src/ |
Client code |
.github/workflows/, .claude/hooks/, scripts/ |
CI and guards |
Cargo.toml, package.json, lockfiles |
Dependencies |
Any .md |
Docs |
Reconcile and the sidecar
This is the area that already deleted user content, so it gets the most scrutiny. RFC 0210 has the full incident: 233 pages, 1,426 lines, made undetectable afterwards by the rebuilt sidecar.
Check 1: does the diff advance last_synced_hash?
git diff origin/main...HEAD -- crates/outl-md/ | grep -n 'last_synced_hash'
Writing that hash is a claim that the op log holds everything in the file.
If the diff advances it on a path that did not emit an op for every line it read, that is a blocker.
The gate must be unlogged::content_lines_missing_from(disk, &sidecar.blocks), asked against the sidecar's blocks, never against a fresh render.
A render answers "do disk and tree disagree", which is also yes for every remote edit and reorder, and that is issue #166 reintroduced with the blame moved.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 29d ago Changed 72c675319ace
- 1mo ago First seen · 223 lines · 94 tokens per session scan A 99cfa1646b61
code-review is a skill published in the GitHub repository outlmd/outl (222 stars, last pushed yesterday), licensed MIT. It adds 94 tokens to every session and 2,789 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-09.
Other skills, from other repositories
review
Comprehensive security and correctness audit. Use for review, deep review, thermo nuclear, or thermonuclear requests and branch or PR diff audits.
crit-cli
Use when an agent needs to author or reply to crit inline comments programmatically (including multi-agent workflows commenting on shared code/plans/docs/proposals), publish or unpublish a crit review with crit share, sync a crit review to or from a GitHub PR or GitLab MR, or read/interpret a crit review JSON file.…
crit
Review code changes, a plan, a live page (running dev server), or a local HTML file with Crit inline comments and structured human feedback. Use only when the user explicitly invokes /crit or directly asks to use Crit; a generic review request does not count.
crit-story
Author a crit story and continue the interactive review loop only when the user explicitly invokes crit-story or directly asks you to generate a crit story. Do not infer this skill from generic review, PR, or diff-review requests.
re0-merge
Review and land an external contribution the way this suite does: gate it against the thesis, land it with the author's credit intact, complete a new skill rather than merging it raw, then approve, credit, and explain before closing. Use when reviewing a pull request, as any collaborator or maintainer, not only the…
sip
After you create or change an artifact or skill, taste-test it with our own skills instead of trusting your in-session judgment — recursive self-improvement, made automatic. Use right after writing or editing anything, before calling it done, committing, or handing it off.