r3bl-open-core: Skill for Claude Code

.agents/skills/review-pr/SKILL.md

review-pr is a skill for Claude Code, Codex from r3bl-org/r3bl-open-core. It costs 14 tokens per session (856 once invoked), scanned A, original, Apache-2.0.

A structured plan for reviewing and integrating a GitHub Pull Request, a proposed set of code changes. It reads the request and its differences, then creates a formatted task file.

In plain words
What is it for?
Use it with a pull-request number to inspect the description and changed files, write a review plan in the task directory, format it, and open it for review.
Why use it?
It turns a broad code review into specific work items and requires the plan to be approved before implementation starts.

Skill for Claude CodeCodex

Written for no agent in particular: nothing here depends on one. Also seen: installed under .agents/ (shared by several agents).

This is r3bl-org/r3bl-open-core's own configuration. It tells Claude Code and Codex how to work on r3bl-open-core itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything r3bl-open-core configures →

Needs its repository: it reads a path above its own folder, which exists only inside the repository. The line is **Canonical Example:** See [task/done/pr-455-fix.md](../../../../task/done/pr-455-fix.md) for a complete, canonical example of a well-written PR review task fil.

Reuse

Borrowing it

Nothing to install: this file belongs to r3bl-org/r3bl-open-core. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/r3bl-org/r3bl-open-core/main/.agents/skills/review-pr/SKILL.md
Clone the repo
git clone --depth 1 https://github.com/r3bl-org/r3bl-open-core

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for review-pr

README.md
[![agentmods](https://agentmods.dev/badge/skills/r3bl-org/r3bl-open-core/review-pr/github.svg)](https://agentmods.dev/skills/r3bl-org/r3bl-open-core/review-pr)
Your own site
<a href="https://agentmods.dev/skills/r3bl-org/r3bl-open-core/review-pr"><img src="https://agentmods.dev/badge/skills/r3bl-org/r3bl-open-core/review-pr/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for review-pr

Your own site · 80×15
<a href="https://agentmods.dev/skills/r3bl-org/r3bl-open-core/review-pr"><img src="https://agentmods.dev/badge/skills/r3bl-org/r3bl-open-core/review-pr.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 14 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 856 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits
  • NVIDIA SkillSpector warn 7 Sept 2026
SkillSpector: 1 finding, up to medium

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

  • medium Excessive Agency · line 27
    Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
    Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
How audits are shown
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00014 $0.00856
Opus 5 $0.00007 $0.00428
Sonnet 5 $0.00003 $0.00171
Haiku 4.5 $0.00001 $0.00086

Measured 12d ago against content hash e4eedcc96a6c, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-12, from the pricing page.

Security

Grade A, and why

review-pr scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.agents/skills/review-pr/SKILL.md · 106 lines

How it starts

The opening of the file, as written. The whole thing — 106 lines — stays where its author put it; the contents beside it link to each section on GitHub.

PR Review and Integration Workflow

Use this skill when the user runs the /review-pr <number> slash command or uses any of these natural language triggers:

  • "lets review pr "
  • "lets work on pr "
  • "lets take a look at pr "

Workflow

When triggered, you MUST follow these exact steps:

  1. Information Gathering
    • Run gh pr view <number> to read the PR description.
    • Run gh pr diff <number> to see the exact code changes and files touched.
  2. Task File Generation
    • Create a new markdown task file at task/pr-<number>-fix.md.
    • The file MUST follow the template structure below, organizing the PR into distinct, actionable chunks (phases/headings).
  3. Format & Present
    • Automatically run prettier --write task/pr-<number>-fix.md to format the new file.
    • Run antigravity-ide task/pr-<number>-fix.md to open the file for the user.
    • Ask the user to manually review and explicitly approve the plan before any implementation begins.

Task File Template

Canonical Example: See task/done/pr-455-fix.md for a complete, canonical example of a well-written PR review task file.

When creating task/pr-<number>-fix.md, structure it exactly like this:

_Task: PR <number> Integration (<short description>)_

# User Story & Context

## Problem

[Describe the user-facing problem that this PR is attempting to solve. What triggers the
bug?]

## Root Cause

[Describe the underlying technical root cause. Why is this happening in the codebase?]

## Expected Behavior

[Describe what the expected behavior should be after the fix.]

# Overview

[Brief summary of the PR, author, and what problem it solves.]

# Implementation Plan

We will process each of the action items iteratively using the following loop:

1. **Implementation:** Write the specific code changes for the current heading.
2. **Local Testing:** Run `./check.fish --check` and, where applicable, test
   functionality.
3. **Mandatory Manual Review:** You (the user) will manually review the specifically
   touched files before the heading is marked as checked `[x]`.

_(Once all headings are successfully implemented and checked off, we will proceed to final
verification and cleanup.)_

## Phase 1: [Name of first distinct fix/feature]

[Brief context of the problem and the specific fix.]

- _Context:_ [Why this change is needed.]
- _The Fix:_ [What the code actually does.]
- _File(s) Touched:_ [List the files.]

## Phase 2: [Name of next fix/feature...]

...

## Final Verification & Cleanup

- [ ] Verify full test suite coverage using `./check.fish --full`.
- [ ] When ready to merge, invoke the `/merge-pr` slash command to push the changes,
      optionally update the author, and cleanly merge to `main`.
- [ ] Update the current meta-task (e.g. `task/prepare-vX.Y.Z-meta-task.md`) to check off
      PR #<number>.
- [ ] **Mandatory manual review:** Verify every file modified in this task for correct
      implementation and ensure no regressions.
  - [ ] `path/to/modified_file_1.rs`
  - [ ] `path/to/modified_file_2.rs`
  - [ ] `task/prepare-vX.Y.Z-meta-task.md`

Read the full file on GitHub · 106 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 12d ago First seen · 106 lines · 14 tokens per session scan A e4eedcc96a6c

Subscribe to this mod's changes

review-pr is a skill published in the GitHub repository r3bl-org/r3bl-open-core (483 stars, last pushed today), licensed Apache-2.0. It adds 14 tokens to every session and 856 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.