Borrowing it
Nothing to install: this file belongs to phase-rs/phase. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/phase-rs/phase/main/.claude/skills/review-engine-impl/SKILL.mdgit clone --depth 1 https://github.com/phase-rs/phaseWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/phase-rs/phase/review-engine-impl)<a href="https://agentmods.dev/skills/phase-rs/phase/review-engine-impl"><img src="https://agentmods.dev/badge/skills/phase-rs/phase/review-engine-impl/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/phase-rs/phase/review-engine-impl"><img src="https://agentmods.dev/badge/skills/phase-rs/phase/review-engine-impl.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00073 | $0.05164 |
| Opus 5.5 | $0.00029 | $0.02066 |
| Sonnet 5.5 | $0.00015 | $0.01033 |
| Haiku 4.5 | $0.00007 | $0.00516 |
Grade A, and why
review-engine-impl scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 161 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Review Implementation
Review for gaps: things that are missing or wrong. Do not spend findings on style nits, CI-enforced formatting, or a diff recap.
Review the change
This applies in every mode. Findings are defects in the change under review: what it introduces, the premises it rests on, and what it states it delivers but does not.
- A defect is pre-existing when it reproduces at the change's base. The change depends on it when a test or acceptance row the change asserts cannot pass, or would have to be weakened, without fixing it. Run that one probe only when the answer changes what happens next.
- A pre-existing defect the change depends on is a finding (
behavior; in charter mode, a decision finding). - Any other pre-existing defect goes in a separate Pre-existing list after the findings, once, with its evidence. It is untagged, never blocks, and is not repeated in a later round.
- Aim probes at the change's own claims. Do not hunt for pre-existing defects.
Workflow
- Identify the changed surface from the diff, commit, or named files.
- Classify the surface area: engine logic, parser, frontend/UI, multiplayer/transport, AI heuristics, deck/format/feeds, build/CI/release, or docs.
- Apply only the relevant lenses below.
- If the scope is a PR, fetch whatever external review comments exist (CodeRabbit, human reviewers) and confirm-or-refute each against the current head with code evidence, folding confirmed findings into your own. Assume none exist by default — Gemini Code Assist has been sunset, so no bot is guaranteed to have pre-screened this PR. Your own lenses are the complete review, not a supplement to a bot's; do not under-invest expecting a backstop. Where an external finding does exist, silently omitting it — or returning a verdict less severe than an open, unrefuted finding from another reviewer — is itself a defect. Review comments, checks, and uploaded/sticky artifacts count only when their evidence identifies the current PR head SHA; otherwise report the evidence as missing rather than attributing it to the current diff.
- If the scope is a PR touching engine/parser source, the parse-diff sticky comment (marker
<!-- coverage-parse-diff -->) is required evidence: fetch its full body and confront the card-level diff against the PR's claimed scope. Unexplained gained/lost/changed cards are findings (unintended parser blast radius). A Baseline pending body means the diff is unavailable — flag it so the handler brings the branch current to regenerate it; an absent comment despite changed engine source, or a comment/artifact not bound to the current PR head SHA, means CI evidence is missing for the current head. This PR-head requirement does not apply to Engine-Implementer Checkpoint Mode: review the committedBASE_SHA..CANDIDATE_SHAdiff instead. - Report findings, then the Pre-existing list when it has entries. Silence on both means LGTM.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago Changed · +5 lines aa92ff9a5954
- 10d ago Changed f945e7922755
- 21d ago Changed · +9 lines 6b9f213608ff
- 24d ago Changed · +4 lines daa5b2863f7d
- 1mo ago First seen · 143 lines · 73 tokens per session scan A b82d0ce92974
review-engine-impl is a skill published in the GitHub repository phase-rs/phase (312 stars, last pushed today), licensed Apache-2.0. It adds 73 tokens to every session and 5,164 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-29.
Other skills, from other repositories
critic-contract
Shared read-side contract every read-only CRITIC imports — adversarial stance, empirical verification of runtime-behavior claims, the mandatory self-red-team before APPROVE, how a finding is stated (quote the span, take the UNKNOWN escape hatch) and held (only new evidence moves a severity, never pushback), spec-UB…
code-quality
Shared clean-code / DRY / KISS / YAGNI standards and stack-specific smells for the React 19 + TypeScript + Rust (Tauri 2) monorepo. Library consumed by the code-quality-reviewer and code-quality-author agents.
review-workflow
The implement→review flow under the ≤3-reviewer budget with the conditional test stage. Use for /implement-feature, /fix-bug, /refactor-module and any change that needs structured review.
anarlog
Query Anarlog meetings, notes, summaries, transcripts, participants, action items, and recurring history, or import a local recording. Use when a user asks about their Anarlog meeting data or needs meeting context for another task.
graphify-windows
Turn any folder of files into a navigable knowledge graph with community detection, an honest audit trail, and three outputs: interactive HTML, GraphRAG-ready JSON, and a plain-language GRAPHREPORT.md.
lessons
How to propose and query distilled lessons (the experiential memory). Only project-steward persists; every other agent proposes/queries. Use when you discover a durable lesson or need prior experience for the current task.