code-review

code-review is a skill for Claude Code, Codex from PANYUXIN6/pyx-skills. It costs 103 tokens per session (3,161 once invoked), scanned A, original, MIT.

A structured review of code and related implementation files that looks for defects, risks, and failures to meet requirements.

In plain words
What is it for?
Use it to review source code, tests, settings, schemas, database migrations, build scripts, Git changes, or pull requests.
Why use it?
It provides evidence for review findings while keeping the target code and repository history unchanged.

Skill for Claude CodeCodex

Written for no agent in particular: nothing here depends on one. Also seen: mentions CLAUDE.md; mentions AGENTS.md; mentions Codex.

Good fit Use it to review source code, tests, settings, schemas, database migrations, build scripts, Git changes, or pull requests.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/panyuxin6/pyx-skills/code-review
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add PANYUXIN6/pyx-skills --skill code-review
Clone the repo
git clone --depth 1 https://github.com/PANYUXIN6/pyx-skills

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for code-review

README.md
[![agentmods](https://agentmods.dev/badge/skills/panyuxin6/pyx-skills/code-review/github.svg)](https://agentmods.dev/skills/panyuxin6/pyx-skills/code-review)
Your own site
<a href="https://agentmods.dev/skills/panyuxin6/pyx-skills/code-review"><img src="https://agentmods.dev/badge/skills/panyuxin6/pyx-skills/code-review/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for code-review

Your own site · 80×15
<a href="https://agentmods.dev/skills/panyuxin6/pyx-skills/code-review"><img src="https://agentmods.dev/badge/skills/panyuxin6/pyx-skills/code-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 103 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 3,161 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00103 $0.03161
Opus 5.5 $0.00041 $0.01264
Sonnet 5.5 $0.00021 $0.00632
Haiku 4.5 $0.00010 $0.00316

Measured 16d ago against content hash 2d99795d3b04, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

code-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 16d ago.

The scan reads SKILL.md. This mod also ships 2 executable files (scripts/review.mjs, scripts/review.test.mjs), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

code-review/SKILL.md · 104 lines

How it starts

The opening of the file, as written. The whole thing — 104 lines — stays where its author put it; the contents beside it link to each section on GitHub.

代码审查

本技能是代码审查的轻量协调层。Codex 负责理解意图、契约、行为和风险;scripts/review.mjs 负责可机械判定的目标成员、快照、证据坐标、声明的处理状态、质疑覆盖、输入新鲜度和结论一致性。Runner 不派发模型,也不能证明代理理解了项目,或质疑结论在语义上真实、独立;命令成功只能证明冻结输入和已记录的流程状态,不能证明语义完整性或正确性。

在用户另行授权修复前,目标代码、规格和 Git 历史保持只读。除非用户明确选择其他位置,运行时和候选产物只能写到目标仓库外。

调用 Runner 或创建审查产物前,同时需要实现目标和明确审查意图。查找缺陷或风险、评估质量、验证正确性或需求符合性、检查编码或实现标准、执行具名审查维度,或产出 Findings,都满足意图门槛。仅阅读、解释、总结、绘制地图,或追踪架构、数据流、实现行为或实现方法的请求不满足。“inspect”“check”“look at”或“检查一下”等中性动词单独出现也不满足。探索性请求不得调用 Runner 或创建 Finding 产物;使用普通仓库探索或其他直接适用技能。

审查目标必须至少包含一个软件实现产物。散文需求和设计文档只能作为评估实现的权威或上下文。用户要求审查文档自身的清晰度、结构、一致性或设计质量时,本技能和 Runner 不适用。

模型与推理配置

主审和发现质疑统一使用 gpt-6.1-sol,推理程度为 xhigh。只有已确认当前会话同时使用这两项设置时,才在当前会话执行语义审查。

技能文本不能切换宿主会话的模型。当前设置不符或无法确认时,使用 Native spawn_agent,明确传入 model: "gpt-6.1-sol"、reasoning_effort: "xhigh" 和 fork_turns: "none",将完整审查交给一个主审子代理。提供用户请求、目标绝对路径、已确认约束与验收来源、本技能绝对路径;由该代理读取技能并执行后续完整流程。主审子代理以 Native 任务的明确派发参数确认设置,不再为模型设置重复委派主审。宿主依据返回的 Runner 产物核对并交付结果,不重复全面审查。Native 委派或指定模型、推理程度不可用时,说明限制并停止,不静默替换设置。

独立质疑子代理也明确传入上述模型、推理程度和隔离参数;是否需要独立质疑仍按 发现质疑协议 的风险路由决定。

1. 确定权威和目标

阅读约束目标的全部仓库规则,如适用的 AGENTS.md、CLAUDE.md、CONTRIBUTING.md 和编码标准。只加载与变更模块、契约或调用路径有关的架构文档和 ADR。仓库规则和已确认需求优先于本通用基线。

解析被请求目标:

  • 当前变更:将 HEAD -> index 已暂存变更、index -> worktree 未暂存变更及未跟踪文件作为独立项目冻结;绝不可合并为一个 HEAD -> worktree 净 diff。
  • 分支、提交、范围或 PR 对比:只解析一次固定比较点;三点比较使用其合并基点。
  • 当前状态功能审查:从入口、调用方、契约、配置和测试中按语义发现完整文件范围,再将其作为显式文件冻结;此模式不需要 Git、diff 或基线。
  • 只有归因变更、回归、遗漏或变更集范围结论需要 Git 基线。仓库证据无法识别所请求目标时才询问。

“已修复,再审查”等后续请求,除非用户要求更广范围,否则默认验证原发现、修复变更及受影响调用路径。把已有报告和质疑记录作为证据线索。重新检查先前反证是否仍适用;只有新证据、契约变更或相关代码变更使其失效时,才重新提出已反驳的主张并解释原因。insufficient_evidence 不是反驳。针对当前后续范围准备全新运行;不得把旧锚点、处理状态、质疑结论或批准当作当前验证。报告原发现的当前状态,并让结论仅覆盖实际复查内容;仅验证修复并不批准整个 PR。

工作区使用 node <skill-directory>/scripts/review.mjs prepare --repo <repository>;固定范围增加 --base <ref> --head <ref>;当前状态范围重复使用 --file <path>。读取返回的 queue_path,而非完整 Manifest:队列只含语义审查所需的项目 ID、路径、变更范围、元数据和排除项。冻结源代码相对于队列目录位于 snapshots/<item_id>.before|after;完整完整性数据由 Runner 保留在模型上下文外。

Read the full file on GitHub · 104 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 16d ago Changed · +8 lines 2d99795d3b04
  2. 1mo ago Changed · -110 lines · +23 tokens per session 4c93ac3a0293
  3. 1mo ago Changed · +17 lines 6ba54d1fb50c
  4. 2mo ago Changed · -113 tokens per session 5c8cd58a7474
  5. 2mo ago First seen · 189 lines · 193 tokens per session scan A f992ee9b5ed0

Subscribe to this mod's changes

code-review is a skill published in the GitHub repository PANYUXIN6/pyx-skills (8 stars, last pushed 17d ago), licensed MIT. It adds 103 tokens to every session and 3,161 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Related

code-review compared with skills from other repositories

code-review next to 6 skills from other repositories
ModTypeStarsLast pushLicenceScanTokensWorks with
code-reviewPANYUXIN6/pyx-skillsSkill817d agoMITA103Claude Code, Codex
autoreviewopenclaw/clawhubSkill9.5kyesterdayMITA17Claude Code, Codex
agent-teams-simplify-and-hardenLeoYeAI/openclaw-master-skillsSkill2.2k6d agoMITA115Claude Code, Codex
omh-code-reviewrlaope/oh-my-hermesSkill5.2kyesterdayMITA48Claude Code, Codex
revdiff-planumputun/revdiffSkill945yesterdayMITA84Claude Code
explore-unknownsdzhng/skillsSkill1.4k2d agoMITA162Claude Code, Codex
re0-mergeLilMGenius/paperthinSkill1.4k4d agoMITA70Claude Code