bob-review

bob-review is a skill for Claude Code from PounceAI/bob-control. It costs 108 tokens per session (1,470 once invoked), scanned A, original, Apache-2.0.

A skill that sends a Git code difference to IBM Bob for a read-only code review. The result is a prioritized list of problems, locations, categories, and sometimes suggested fixes.

In plain words
What is it for?
It checks for an existing review task, creates one when needed, and dispatches Bob to review the chosen changes.
Why use it?
It adds a separate review step for finding correctness and security issues before changes are accepted.

Skill for Claude Code

Written for Claude Code: allowed-tools in frontmatter.

Part of the bob-companion plugin — 4 skills, 8 commands, 1 agent, 1 MCP server shipped together

Good fit It checks for an existing review task, creates one when needed, and dispatches Bob to review the chosen changes.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/pounceai/bob-control/bob-review
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add PounceAI/bob-control --skill bob-review
Clone the repo
git clone --depth 1 https://github.com/PounceAI/bob-control

Made for: Claude Code.

Or install bob-companion, the plugin that ships this one along with the rest of its 4 skills, 8 commands, 1 agent, 1 MCP server.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for bob-review

README.md
[![agentmods](https://agentmods.dev/badge/skills/pounceai/bob-control/bob-review/github.svg)](https://agentmods.dev/skills/pounceai/bob-control/bob-review)
Your own site
<a href="https://agentmods.dev/skills/pounceai/bob-control/bob-review"><img src="https://agentmods.dev/badge/skills/pounceai/bob-control/bob-review/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for bob-review

Your own site · 80×15
<a href="https://agentmods.dev/skills/pounceai/bob-control/bob-review"><img src="https://agentmods.dev/badge/skills/pounceai/bob-control/bob-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 108 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,470 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00108 $0.01470
Opus 5 $0.00054 $0.00735
Sonnet 5 $0.00022 $0.00294
Haiku 4.5 $0.00011 $0.00147

Measured 8d ago against content hash f00f9029c5a4, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-08, from the pricing page.

Security

Grade A, and why

bob-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

claude-plugin/skills/bob-review/SKILL.md · 75 lines

How it starts

The opening of the file, as written. The whole thing — 75 lines — stays where its author put it; the contents beside it link to each section on GitHub.

You are the foreman. The user wants IBM Bob to code-review a set of changes in this repo. Bob reviews in its read-only review mode — it never edits; it returns a structured findings list (severity, location, category, often a fixed_diff). The auto-dispatch worker now parses those findings onto the board (the task result plus a bob-review note), so the findings come back to you — you don't need Bob's webview panel.

Do this:

  1. Get board state in one call. Call board_status — it returns open_tasks (the live, non-terminal tasks) for the dedup check and worker_draining for step 4. Scan open_tasks for a near-identical pending review task; if one exists, point the user at it instead of creating another. (Ignore a blocked/needs_input near-match — it can't be pulled, so deduping against it would dead-end the request.) Only if open_tasks_truncated is true and you're unsure, fall back to list_tasks {status: 'pending', tag: 'review'}. worker_draining is a step-1 snapshot — keep it for step 4 rather than re-calling board_status.

  2. Scope the review — let Bob gather the diff itself. Bob's review mode has the read + command groups and is told to run git diff / git log itself, so don't embed a big diff — hand Bob a scope and let it pull the diff.

    • Explicit git range ($ARGUMENTS has .., e.g. main...HEAD): review git diff <range>.
    • Uncommitted changes (default): from git status --porcelain, name the paths in scope — in a shared tree, exclude unrelated in-progress work — and review them via git diff HEAD -- <files> (untracked files by path).
    • No working-tree changes → branch vs base: git diff @{upstream}...HEAD, or git diff main...HEAD with no upstream.
    • Only embed when there's no git scope to point at (a diff pasted into the request, or not a repo): a fenced ```diff block, bounded to ~12,000 chars (note any truncation).
    • If there is genuinely nothing to review, say so and stop — don't create an empty task.
  3. File the review task with create_task:

    • mode: review — Bob's native code-review mode (read-only, safe to drain unattended).
    • title: Code review: <short summary of the change> (imperative, specific).
    • tags: ['review'] (the dedup key). If step-1 worker_draining shows a tag-pinned drainer serving this checkout, add its pin tag too — a worker only pulls tasks whose tags include its pin, so a review-only task sits pending under one. Don't pad with tags it won't match (code-review, etc.).
    • priority: high if the user signals urgency, else medium.
    • description: a one-line ask to review for correctness bugs first, then reuse / simplification / efficiency — then the scope (the git command + file list, or the fenced diff only if embedding), then the user's focus note if any. Keep it short; review mode supplies its own rubric.
  4. Wait for Bob, then surface the findings. Report the new task id and that it routes to {review}. Use the worker_draining from step 1 (it reflects a 2.0 in-process loop as well as a 1.x worker): if worker_draining.draining is false, nothing is draining the board — tell the user it's queued as #id and to start a drainer (open the repo in a Bob 2.0 window, whose in-process loop drains automatically, or run a 1.x worker via launch-worker.cmd), then stop. Otherwise a drainer is live and step 3 tagged the task to its pin, so don't report "queued" for a tag-pinned drainer — call await_task {task_id: id}. It blocks until the drainer runs the task and Bob settles it, so the review completes this turn:

    • analysis_done (or done) → the review is in the task result plus a structured bob-review note (severity / location / fixed_diff). Present the findings, correctness issues first.
    • waiting (the poll window elapsed) → call await_task again and keep waiting while Bob works. If it stays waiting across several calls, nothing is draining the board — tell the user it's queued as #id and to start a drainer (as above) or check /bob-board.
    • needs_input → Bob asked a question (it's in the response). A 1.x worker parks it on the board — surface it; once the user answers (answer_task_question or the board) call await_task again. A 2.0 in-process Bob has no board reply channel, so surface the question for the user to steer in Bob's window (or re-file a follow-up with the answer baked in).
    • blocked / cancelled → Bob stopped without completing; report that with the reason from the task notes.

Read the full file on GitHub · 75 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 8d ago First seen · 75 lines · 108 tokens per session scan A f00f9029c5a4

Subscribe to this mod's changes

bob-review is a skill published in the GitHub repository PounceAI/bob-control (1 stars, last pushed yesterday), licensed Apache-2.0. It adds 108 tokens to every session and 1,470 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Related

Other skills, from other repositories

improve

Autonomous quality improvement loop. Scores a target against a rubric, selects the highest-leverage axis, attacks it, verifies, documents, and loops. No pre-planning between iterations — each loop re-scores from scratch.

SethGammon/Citadel · 48 tokens

triage

GitHub issue and PR investigator. Pulls open issues/PRs, classifies them, searches the codebase for root cause or reviews contributed code, proposes fixes with file:line references, and optionally implements fixes. Use for investigating GitHub issues and reviewing PRs; do NOT use for general code review unrelated to…

SethGammon/Citadel · 71 tokens

review

5-pass structured code review — correctness, security, performance, readability, consistency.

SethGammon/Citadel · 17 tokens

code-review

The depth half of a review - the dimensions a diff is read against (correctness, boundaries, concurrency, failure paths, secrets, data access, structure, test quality) and the rule that a finding is refuted before it is reported. The verdict stays with the reviewer agent. Use when reviewing a diff or a pull request…

jjanczur/tyran · 80 tokens

deslop

The optimization pass, defined - delete before you add, one smell class per pass, behaviour pinned by a test that ran BEFORE the edit. Lints a SKILL.md and prose by the same instinct. Use for the per-story optimization pass or when code has grown noisy without growing capable.

jjanczur/tyran · 58 tokens

pr-feedback

Work a reviewer's comments on a pull request to the end - all three comment surfaces enumerated before any is triaged, every comment fixed, declined with a reason, or ticketed, push before you reply. Use when a PR comes back with review feedback or a red check.

jjanczur/tyran · 57 tokens