Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/RainFlashPoint/capital-agent-skillsnpx agentmods add skills/rainflashpoint/capital-agent-skills/cap-reviewWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/rainflashpoint/capital-agent-skills/cap-review)<a href="https://agentmods.dev/skills/rainflashpoint/capital-agent-skills/cap-review"><img src="https://agentmods.dev/badge/skills/rainflashpoint/capital-agent-skills/cap-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/rainflashpoint/capital-agent-skills/cap-review"><img src="https://agentmods.dev/badge/skills/rainflashpoint/capital-agent-skills/cap-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00371 | $0.08555 |
| Opus 5 | $0.00186 | $0.04278 |
| Sonnet 5 | $0.00074 | $0.01711 |
| Haiku 4.5 | $0.00037 | $0.00856 |
Grade A, and why
cap-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 460 lines — stays where its author put it; the contents beside it link to each section on GitHub.
cap-review — 多角色评审 + 验证收尾
入口先执行
../cap/SKILL.md的“研发上下文门禁”：.cap检查不可跳过，知识库注入失败可记录后离线继续。
全程契约：开始实质工作前读取并执行
../cap-flow/references/progress-protocol.md与../cap-flow/references/task-reconnaissance.md。先播报当前动作和下一步；新任务没有新鲜.cap/task-context.md时，先调查当前仓库代码，不能只依赖 PROFILE。
同时读取 ../cap-flow/references/harness-action-protocol.md。Review Run 默认只读源码：只产 Findings 和 Review Evidence；任何修复都必须进入独立 Patch Action，新 Commit 再走新的 Test/Review，禁止“边审边改再给自己 PASS”。
高风险改动还必须读取并执行 ../cap-flow/references/independent-review.md 的 fresh-context 独立复核门。
你正在执行研发主线的评审阶段。目标:在改动落地前,从改动代码自动选出的多个专业角色视角审一遍,
做完整性 / 范围审计与安全门控,把每条问题分类处置,产出可审计的 findings,并把门控结论写回 STATE.md。
引擎 = 一个能 Read/Edit/Bash/Grep 的模型。 所有知识在纯文件里(
cap-flow/references/roles/*.md、本文)。 不依赖子代理人格 / 特定目录约定 / 富交互控件。 可移植铁律:交互用纯文本编号列表,并行能并行就并行、不能就串行(见 §0)。
0. 可移植前置（每次入口先做）
共享 references 的位置:本文引用的
role-routing.md、roles/<role>.md、receiving-feedback.md物理上 都在编排器目录cap-flow/references/下,不在本阶段目录里。解析路径一律指向cap-flow/references/...(相对 skills 根)或经软链接定位,别当相对本目录去 Read。
0.1 交互降级 —— 纯文本编号选项
凡需向用户提问(确认 scope-drift 处置、批准 fix、确认接受风险),优先用纯文本编号列表:
我需要你选一个:
1) 选项 A —— 说明
2) 选项 B —— 说明
回复编号即可。
宿主有结构化提问控件可用,但回退路径必须是上面这种编号文本。默认按编号文本写。
0.2 并行降级 —— 能并行就并行，不能就串行
多角色评审天然可并行。探测有无并行能力:
- 有并行能力 → fan-out:每个角色一个独立分支,各自只写
review/<role>.md,最后由主流程合并。 - 无并行能力(纯 Codex 等)→ 串行 inline:逐个角色加载该角色卡当透镜,顺序产 findings,逐个写
review/<role>.md。
单写者原则:STATE.md 永远只由主流程写;并行角色只写各自的 review/<role>.md,绝不并发写 STATE。
0.3 非交互 / headless 变体
当本阶段被子代理、workflow、CI 或 headless 调起(无人应答):
- 不发任何编号提问。所有需要用户裁决的点,改为:按"安全默认"处置 + 把待决项写进 finding 的
disposition: needs-human。 - 安全默认 = Review 不修改被审源码，机械问题也生成 Patch Action；不替用户接受安全风险(open 安全项 → 阻断, 不放行)。
- 全部 findings 落
review/<role>.md,门控结论落 STATE,正文最后输出机器可读的## REVIEW SUMMARY(§7)。
1. 入口条件（进入本阶段的前提）
进入 cap-review 前应满足(由 cap-flow 或上一阶段保证;若不满足,先回对应阶段):
- 有改动可审:
git diff相对 base 非空。若为空 → 输出Nothing to review — 工作区与 base 无差异并停。 - build 已 green:
STATE.gates里tests written (red)与implement (green)已勾(或当前确实有实现 diff)。 - verify 已跑(推荐但不强制):
STATE.verify-checks已解析,.cap/verify/下有对应报告。- 若 verify 未跑且改动触及用户可见面 / AI 策略 → 提示"建议先跑 cap-test",但不阻断 review(review 可独立跑)。
- 能定位状态:
<target-repo>/.cap/STATE.md可读(没有则按 stage=review 新建一份骨架,见 §5)。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago Changed · +19 lines · +26 tokens per session 44124492e755
- 5d ago Changed · +2 lines 8b94f1a14fb8
- 9d ago First seen · 439 lines · 345 tokens per session scan A 0b91c2a067cb
cap-review is a skill published in the GitHub repository RainFlashPoint/capital-agent-skills (2 stars, last pushed 5d ago), licensed MIT. It adds 371 tokens to every session and 8,555 once invoked, about $0.0019 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
autoreview
Pre-commit/ship code review: Codex default; optional Claude or Pi.
rework-rate
Measure and interpret PR rework rate — the emerging 5th DORA metric.
omh-code-review
This is a Hermes-native code-review workflow skill.
revdiff-plan
Review the last Codex assistant message (plan, analysis, or proposal) with inline annotations in a TUI overlay. Extracts the most recent response from Codex rollout files and opens it in revdiff for review and annotation. Activates on "revdiff-plan", "review plan with revdiff", "annotate plan", "review last response"…
code-reviewer
Code review specialist focused on patterns, bugs, security, and performance.
agent-teams-simplify-and-harden
Implementation + audit loop using parallel agent teams with structured simplify, harden, and document passes. Spawns implementation agents to do the work, then audit agents to find complexity, security gaps, and spec deviations, then loops until code compiles cleanly, all tests pass, and auditors find zero issues or…