review-design-contracts

review-design-contracts is a skill for Codex from PANYUXIN6/pyx-skills. It costs 150 tokens per session (3,005 once invoked), scanned A, original, MIT.

A structured reviewer for Markdown design documents and accepted fix queues. It checks the design, challenges its assumptions, and can separately apply or verify fixes.

In plain words
What is it for?
Reviewing a new design, consuming an approved list of fixes, or independently checking an edited design with evidence and risk-based follow-up.
Why use it?
It helps catch unclear contracts, architecture mistakes, and unproven fixes before implementation. It also keeps review, editing, and verification as separate steps.

Skill for Codex

Written for Codex: agents/openai.yaml present. Also seen: runs codex exec; mentions Codex; $skill-name invocation.

Good fit Reviewing a new design, consuming an approved list of fixes, or independently checking an edited design with evidence and risk-based follow-up.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/panyuxin6/pyx-skills/review-design-contracts
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add PANYUXIN6/pyx-skills --skill review-design-contracts
Clone the repo
git clone --depth 1 https://github.com/PANYUXIN6/pyx-skills

Made for: Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for review-design-contracts

README.md
[![agentmods](https://agentmods.dev/badge/skills/panyuxin6/pyx-skills/review-design-contracts/github.svg)](https://agentmods.dev/skills/panyuxin6/pyx-skills/review-design-contracts)
Your own site
<a href="https://agentmods.dev/skills/panyuxin6/pyx-skills/review-design-contracts"><img src="https://agentmods.dev/badge/skills/panyuxin6/pyx-skills/review-design-contracts/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for review-design-contracts

Your own site · 80×15
<a href="https://agentmods.dev/skills/panyuxin6/pyx-skills/review-design-contracts"><img src="https://agentmods.dev/badge/skills/panyuxin6/pyx-skills/review-design-contracts.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 150 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 3,005 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits
  • NVIDIA SkillSpector warn 7 Sept 2026
SkillSpector: 1 finding, up to medium

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

  • medium Excessive Agency · line 85
    Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
    Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
How audits are shown
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00150 $0.03005
Opus 5.5 $0.00060 $0.01202
Sonnet 5.5 $0.00030 $0.00601
Haiku 4.5 $0.00015 $0.00300

Measured 1mo ago against content hash a0ae0ce92cfa, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

review-design-contracts scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.

The scan reads SKILL.md. This mod also ships 1 executable file (scripts/review-design.mjs), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

review-design-contracts/SKILL.md · 145 lines

How it starts

The opening of the file, as written. The whole thing — 145 lines — stays where its author put it; the contents beside it link to each section on GitHub.

审查设计契约

在不进行模型投票或以 LLM 充当裁判的情况下,优先保证质量地审查设计。审查全程保持目标文档不变。

在 review.config.json 中仅使用 low 或 high 配置子代理推理强度:明确且范围小的检查用 low,复杂的契约或架构推理用 high。保持派发的任务描述不变。

选择一种操作

严格从用户明确请求中选择一种模式,不能隐式切换:

  • review:启动新的设计审查,且不修改目标。
  • apply-fixes:验证并处理已接受队列、编辑目标,然后停止并交给独立审查任务。
  • verify-fixes:独立审查已编辑目标。只有当前任务被明确要求运行 verify-fixes 且未编辑该目标时才能进入。

完成 apply-fixes 绝不授权同一任务进入 verify-fixes,即使已提供队列运行目录也是如此。

开始审查

  1. 阅读 references/review-protocol.md。
  2. 确认当前 Codex 任务提供 Native spawn_agent、wait_agent 和 interrupt_agent。任一不可用时,在创建运行前停止;不要退回到 CLI 或 API 模型后端。
  3. 将 <skill-directory> 解析为包含此 SKILL.md 的绝对目录。
  4. 执行 references/review-protocol.md 中的权威预检查。先检查目标的 frontmatter 和直接设计链接。目标自称子设计,或委派了没有可解析路径的重要契约时,只做该文档所述的、有界的同目录和已声明索引搜索。直接关系支持的、明确且非 observed 的总设计自动纳入;否则除非未解决的外部契约对审查很重要,否则把目标视作自包含。此预检查不得调用其他技能。
  5. 检查目标仓库的 docs/REPO_MAP.md 和 docs/ARCHITECTURE.md。任一缺失时,以仓库上下文初始化模式调用 $repo-map-first;相关地图说法可能过时或矛盾时,以仓库上下文验证模式调用它。保留审查目标和权威来源。观察到的地图可定位文件,但不能确立规范性权威。架构审查所需仓库上下文仍有重要歧义时,创建运行前停止并报告 INSUFFICIENT_INPUT。
  6. 在仓库根目录运行:
node <skill-directory>/scripts/review-design.mjs prepare <design.md>

用户指定的权威项重复使用 --authority <path> 添加;预检查找到的每个明确权威项重复使用 --discovered-authority <path> 添加。不要将后者用于 observed 文档,也不要用于仅凭相邻位置、编号、时间顺序或语义相似性推断的关系。用 --retry-of <old-run-directory> 重试 FAILED 或 INVALIDATED 运行;绝不复用旧中间产物。

  1. 对 prepare 或 advance 返回的每个任务描述,使用以下精确映射调用 Native spawn_agent:
task_name        ← agent_task_name
message          ← spawn_message
fork_turns       ← fork_turns
model            ← model
reasoning_effort ← reasoning_effort

不得修改任何映射值。一个返回批次可以同时包含 L2 和互不依赖的 L3 任务;每个覆盖一个候选项或一组有界的相关候选项,分别派发。每批任务数不得超过 max_parallel_subagents。

  1. 等待已派发任务,不要解读其最终消息。遵循 references/review-protocol.md 的超时和迟到响应协调规则;只有指定 response.json 存在时任务才成功。一个或多个活跃任务生成响应时运行 advance;Runner 会处理完成工作、保留未完成的同级任务,并为每个空闲槽生成替代项:
node <skill-directory>/scripts/review-design.mjs advance <run-directory>

派发所有返回的重试或下一阶段描述,并持续等待它们和 waiting_for 中的 ID;不得随意等待整个批次屏障,也不得手动合并任务响应。

Read the full file on GitHub · 145 lines

Files

What ships with it

30 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 1mo ago Changed · +35 tokens per session a0ae0ce92cfa
  2. 1mo ago Changed · +2 lines 8bdd75d8adfc
  3. 2mo ago First seen · 143 lines · 115 tokens per session scan A 975e02d5824f

Subscribe to this mod's changes

review-design-contracts is a skill published in the GitHub repository PANYUXIN6/pyx-skills (8 stars, last pushed 17d ago), licensed MIT. It adds 150 tokens to every session and 3,005 once invoked, about $0.0006 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Related

review-design-contracts compared with skills from other repositories

review-design-contracts next to 6 skills from other repositories
ModTypeStarsLast pushLicenceScanTokensWorks with
review-design-contractsPANYUXIN6/pyx-skillsSkill817d agoMITA150Codex
autoreviewopenclaw/clawhubSkill9.5kyesterdayMITA17Claude Code, Codex
agent-teams-simplify-and-hardenLeoYeAI/openclaw-master-skillsSkill2.2k6d agoMITA115Claude Code, Codex
omh-code-reviewrlaope/oh-my-hermesSkill5.2kyesterdayMITA48Claude Code, Codex
revdiff-planumputun/revdiffSkill945yesterdayMITA84Claude Code
explore-unknownsdzhng/skillsSkill1.4k2d agoMITA162Claude Code, Codex
re0-mergeLilMGenius/paperthinSkill1.4k4d agoMITA70Claude Code