What is cross-review-project?

A structured review in which two Claude Code instances inspect each other's projects through a shared broker. The process exchanges findings and records whether each point is accepted, rejected, or open for discussion.

Use it to compare projects, review shared architectural concerns, exchange evidence-backed findings, and discuss proposed changes.

It adds an independent perspective and helps reveal architectural patterns or problems that one project team may miss.

cross-review-project — Skill for Claude Code by pjt222

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add pjt222/agent-almanac --skill cross-review-project

Clone the repo

git clone --depth 1 https://github.com/pjt222/agent-almanac

Made for: Claude Code.

Or install agent-almanac, the plugin that ships this one along with the rest of its 122 skills, 76 agents.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/pjt222/agent-almanac/cross-review-project/github.svg)](https://agentmods.dev/skills/pjt222/agent-almanac/cross-review-project)

Your own site

<a href="https://agentmods.dev/skills/pjt222/agent-almanac/cross-review-project"><img src="https://agentmods.dev/badge/skills/pjt222/agent-almanac/cross-review-project/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/pjt222/agent-almanac/cross-review-project"><img src="https://agentmods.dev/badge/skills/pjt222/agent-almanac/cross-review-project.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 63 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 2,508 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits

NVIDIA SkillSpector warn 7 Sept 2026

SkillSpector: 2 findings, up to medium

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

medium analysis-evasion · line 1
Suspicious Unicode normalization or mixed-script content

Fix: Review the flagged content for security risks. Ensure no credentials, secrets, or sensitive data are exposed.
medium MCP Rug Pull · line 59
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Fix: Pin the version: npx @scope/[email protected]

How audits are shown

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00063	$0.02508
Opus 5	$0.00032	$0.01254
Sonnet 5	$0.00013	$0.00502
Haiku 4.5	$0.00006	$0.00251

Measured 7d ago against content hash dce8ec6846da, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-11, from the pricing page.

Security

Grade A, and why

cross-review-project scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

i18n/caveman-lite/skills/cross-review-project/SKILL.md · 196 lines

How it starts

The opening of the file, as written. The whole thing — 196 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Cross-Review Project

Two Claude Code instances review each other's projects through structured artifact exchange via the cross-review-mcp broker. The broker enforces Quantized Simplex Gossip (QSG) scaling laws — review bundles must contain at least 5 findings to stay in the selection regime (Γ_h ≈ 1.67), preventing shallow consensus from passing as agreement.

When to Use

Two projects share architectural concerns and could learn from each other
You want independent code review that goes beyond what a single reviewer sees
Cross-pollination is the goal: finding patterns in one project that are missing in the other
You need structured, evidence-backed review with accept/reject/discuss verdicts

Inputs

Required: Two project paths accessible to two Claude Code instances
Required: cross-review-mcp broker running and configured as an MCP server in both instances
Optional: Focus areas — specific directories, patterns, or concerns to prioritize
Optional: Agent IDs — identifiers for each instance (default: project directory name)

Procedure

Step 1: Verify Prerequisites

Confirm the broker is running and both instances can reach it.

Check the broker is configured as an MCP server:
```
claude mcp list | grep cross-review
```
Call get_status to verify the broker is responsive and no stale agents are registered
Read the protocol resource at cross-review://protocol — this is a markdown document describing the review dimensions and QSG constraints

Got: The broker responds to get_status with an empty agent list. The protocol resource is readable as markdown.

If fail: If the broker is not configured, add it: claude mcp add cross-review-mcp -- npx cross-review-mcp. If stale agents exist from a previous session, call deregister for each before proceeding.

Step 2: Register

Call register with:
- agentId: a short, unique identifier (e.g., project directory name)
- project: the project name
- capabilities: ["review", "suggest"]
Verify registration by calling get_status — your agent should appear with phase "registered"
Wait for the peer agent to register: call wait_for_phase with the peer's agent ID and phase "registered"

Read the full file on GitHub · 196 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

7d ago First seen · 196 lines · 63 tokens per session scan A dce8ec6846da

Subscribe to this mod's changes

cross-review-project is a skill published in the GitHub repository pjt222/agent-almanac (32 stars, last pushed today), licensed MIT. It adds 63 tokens to every session and 2,508 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.

Building agents Claude Code Code review agents agentskills ai-assisted-development skills teams

audit-pr

Audit a whole PR against the delivery contract and return MERGE-READY or evidenced blockers with the full URL. Consumes the current review-change REVIEW-PASS receipt instead of re-running review axes; posts a SHA-bound ready comment; never edits or merges. Triggers: "audit-pr", "is this PR ready", "merge gate".

gtrabanco/agentic-workflow · 71 tokens

fold-findings

Repair persisted fix-now findings in compatible atomic batches: root-cause fixes, green gate, commit/push, and per-row folded: yes updates. Never reclassify or substitute backlog notes. Triggers: "fold-findings", "fix the review findings", "repair audit blockers".

gtrabanco/agentic-workflow · 65 tokens

review-change

Review a change with only applicable internal axes, classify every finding, persist fix-now work, and return one evidence-backed decision. Findings only; --adversarial N uses isolated reviewers; --synthesize fuses supplied reviewer tables. Triggers: "review-change", "review this change", "adversarial review".

gtrabanco/agentic-workflow · 67 tokens

review-plan

Independent read-only review of a frozen Engineering plan before execution, in a context that did not cut it: feature or fix snapshot, obligation ledger sweep, phase and validator checks. Returns only PLAN-REVIEW-PASS or PLAN-REVIEW-FAIL with a snapshot-bound receipt (a product-intent gap is PLAN-REVIEW-FAIL with…

gtrabanco/agentic-workflow · 100 tokens

review-perf

Internal performance review pass of the agentic-workflow review pack — composed in-turn by review-change and product-audit; not a menu entry. Checks the changed paths for algorithmic and resource regressions: N+1s, hot-path allocations, asset weight, and leaks. Findings only; never edits code.