Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add PounceAI/bob-control --skill bob-reviewgit clone --depth 1 https://github.com/PounceAI/bob-controlWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/pounceai/bob-control/bob-review)<a href="https://agentmods.dev/skills/pounceai/bob-control/bob-review"><img src="https://agentmods.dev/badge/skills/pounceai/bob-control/bob-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/pounceai/bob-control/bob-review"><img src="https://agentmods.dev/badge/skills/pounceai/bob-control/bob-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00108 | $0.01470 |
| Opus 5 | $0.00054 | $0.00735 |
| Sonnet 5 | $0.00022 | $0.00294 |
| Haiku 4.5 | $0.00011 | $0.00147 |
Grade A, and why
bob-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 75 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are the foreman. The user wants IBM Bob to code-review a set of changes in this
repo. Bob reviews in its read-only review mode — it never edits; it returns a structured
findings list (severity, location, category, often a fixed_diff). The auto-dispatch worker
now parses those findings onto the board (the task result plus a bob-review note), so
the findings come back to you — you don't need Bob's webview panel.
Do this:
-
Get board state in one call. Call
board_status— it returnsopen_tasks(the live, non-terminal tasks) for the dedup check andworker_drainingfor step 4. Scanopen_tasksfor a near-identical pending review task; if one exists, point the user at it instead of creating another. (Ignore ablocked/needs_inputnear-match — it can't be pulled, so deduping against it would dead-end the request.) Only ifopen_tasks_truncatedis true and you're unsure, fall back tolist_tasks {status: 'pending', tag: 'review'}.worker_drainingis a step-1 snapshot — keep it for step 4 rather than re-callingboard_status. -
Scope the review — let Bob gather the diff itself. Bob's
reviewmode has theread+commandgroups and is told to rungit diff/git logitself, so don't embed a big diff — hand Bob a scope and let it pull the diff.- Explicit git range (
$ARGUMENTShas.., e.g.main...HEAD): reviewgit diff <range>. - Uncommitted changes (default): from
git status --porcelain, name the paths in scope — in a shared tree, exclude unrelated in-progress work — and review them viagit diff HEAD -- <files>(untracked files by path). - No working-tree changes → branch vs base:
git diff @{upstream}...HEAD, orgit diff main...HEADwith no upstream. - Only embed when there's no git scope to point at (a diff pasted into the request, or not a repo): a fenced ```diff block, bounded to ~12,000 chars (note any truncation).
- If there is genuinely nothing to review, say so and stop — don't create an empty task.
- Explicit git range (
-
File the review task with
create_task:- mode:
review— Bob's native code-review mode (read-only, safe to drain unattended). - title:
Code review: <short summary of the change>(imperative, specific). - tags:
['review'](the dedup key). If step-1worker_drainingshows a tag-pinned drainer serving this checkout, add its pin tag too — a worker only pulls tasks whose tags include its pin, so areview-only task sitspendingunder one. Don't pad with tags it won't match (code-review, etc.). - priority:
highif the user signals urgency, elsemedium. - description: a one-line ask to review for correctness bugs first, then reuse / simplification / efficiency — then the scope (the git command + file list, or the fenced diff only if embedding), then the user's focus note if any. Keep it short; review mode supplies its own rubric.
- mode:
-
Wait for Bob, then surface the findings. Report the new task id and that it routes to
{review}. Use theworker_drainingfrom step 1 (it reflects a 2.0 in-process loop as well as a 1.x worker): ifworker_draining.drainingis false, nothing is draining the board — tell the user it's queued as #id and to start a drainer (open the repo in a Bob 2.0 window, whose in-process loop drains automatically, or run a 1.x worker vialaunch-worker.cmd), then stop. Otherwise a drainer is live and step 3 tagged the task to its pin, so don't report "queued" for a tag-pinned drainer — callawait_task {task_id: id}. It blocks until the drainer runs the task and Bob settles it, so the review completes this turn:analysis_done(ordone) → the review is in the taskresultplus a structuredbob-reviewnote (severity / location /fixed_diff). Present the findings, correctness issues first.waiting(the poll window elapsed) → callawait_taskagain and keep waiting while Bob works. If it stayswaitingacross several calls, nothing is draining the board — tell the user it's queued as #id and to start a drainer (as above) or check/bob-board.needs_input→ Bob asked a question (it's in the response). A 1.x worker parks it on the board — surface it; once the user answers (answer_task_questionor the board) callawait_taskagain. A 2.0 in-process Bob has no board reply channel, so surface the question for the user to steer in Bob's window (or re-file a follow-up with the answer baked in).blocked/cancelled→ Bob stopped without completing; report that with the reason from the task notes.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 75 lines · 108 tokens per session scan A f00f9029c5a4
bob-review is a skill published in the GitHub repository PounceAI/bob-control (1 stars, last pushed yesterday), licensed Apache-2.0. It adds 108 tokens to every session and 1,470 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
improve
Autonomous quality improvement loop. Scores a target against a rubric, selects the highest-leverage axis, attacks it, verifies, documents, and loops. No pre-planning between iterations — each loop re-scores from scratch.
triage
GitHub issue and PR investigator. Pulls open issues/PRs, classifies them, searches the codebase for root cause or reviews contributed code, proposes fixes with file:line references, and optionally implements fixes. Use for investigating GitHub issues and reviewing PRs; do NOT use for general code review unrelated to…
review
5-pass structured code review — correctness, security, performance, readability, consistency.
code-review
The depth half of a review - the dimensions a diff is read against (correctness, boundaries, concurrency, failure paths, secrets, data access, structure, test quality) and the rule that a finding is refuted before it is reported. The verdict stays with the reviewer agent. Use when reviewing a diff or a pull request…
deslop
The optimization pass, defined - delete before you add, one smell class per pass, behaviour pinned by a test that ran BEFORE the edit. Lints a SKILL.md and prose by the same instinct. Use for the per-story optimization pass or when code has grown noisy without growing capable.
pr-feedback
Work a reviewer's comments on a pull request to the end - all three comment surfaces enumerated before any is triaged, every comment fixed, declined with a reason, or ticketed, push before you reply. Use when a PR comes back with review feedback or a red check.