comet-review

comet-review is a skill for Claude Code, Codex from rpamis/comet. It costs 30 tokens per session (1,759 once invoked), scanned A, original, MIT.

A read-only review guide for checking the current Comet change, a managed software-change workflow. It focuses on correctness, security, and boundary problems without changing files or advancing the workflow.

In plain words
What is it for?
Use it to identify implementation risks, inspect the active change and Git differences, and report findings before verification or further workflow steps.
Why use it?
It provides a controlled way to inspect the selected change and its differences without accidentally fixing files, altering state, or treating review as proof that tests passed.

Skill for Claude CodeCodex

Written for Claude Code and Codex: disable-model-invocation in frontmatter, but also agents/openai.yaml present.

Good fit Use it to identify implementation risks, inspect the active change and Git differences, and report findings before verification or further workflow steps.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/rpamis/comet/comet-review
About the project

Comet is a resumable workflow and skill platform for coding tasks, covering requirements work as well as skill creation, evaluation, and release. It supports separate Native and Classic workflows and can coordinate implementation and verification across isolated Git worktrees. The catalogue contains skills and instructions that implement Comet-related workflows.

rpamis/comet · 3,214 stars · on GitHub · docs.comet.rpamis.com

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add rpamis/comet --skill comet-review
Clone the repo
git clone --depth 1 https://github.com/rpamis/comet

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for comet-review

README.md
[![agentmods](https://agentmods.dev/badge/skills/rpamis/comet/comet-review/github.svg)](https://agentmods.dev/skills/rpamis/comet/comet-review)
Your own site
<a href="https://agentmods.dev/skills/rpamis/comet/comet-review"><img src="https://agentmods.dev/badge/skills/rpamis/comet/comet-review/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for comet-review

Your own site · 80×15
<a href="https://agentmods.dev/skills/rpamis/comet/comet-review"><img src="https://agentmods.dev/badge/skills/rpamis/comet/comet-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 30 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,759 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits
  • NVIDIA SkillSpector pass 7 Sept 2026
How audits are shown
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00030 $0.01759
Opus 5.5 $0.00012 $0.00704
Sonnet 5.5 $0.00006 $0.00352
Haiku 4.5 $0.00003 $0.00176

Measured 1mo ago against content hash f1ec04a04cef, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

comet-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

assets/skills-zh/comet-review/SKILL.md · 122 lines

How it starts

The opening of the file, as written. The whole thing — 122 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Comet 手动代码审查

对当前选中的 Comet change 执行一次按需、只读的代码审查。这个入口不属于任何阶段,也不替代 Build 或 Verify 的验证和审查。

本入口独立于 review_mode。review_mode 控制流程内的自动审查策略,/comet-review 则由用户手动触发,只执行一次审查;调用本入口不得读取、修改或覆盖当前 change 的 review_mode。

只执行读取和审查操作

本 Skill 的整个调用必须保持只读:

  • 不修改、创建或删除文件;
  • 不暂存、提交、切换分支、创建分支或创建 worktree;
  • 不运行 comet state select、comet native select、comet state set、comet state transition、阶段守卫、comet native next 或归档命令;
  • 不修复发现的问题,不推进 phase,不更新 tasks、状态、验证报告或审查记录;
  • 不把本次结果称为 Verify 通过,也不把“没有发现”视为测试已经通过。

只允许执行读取文件、查询状态和查看 Git 差异所需的命令。任何可能运行项目代码、安装依赖或产生文件的检查都不属于本入口。

1. 定位项目与当前 change

  1. 使用只读 Git 查询确定项目根目录;如果不是 Git 仓库,则使用当前 Comet 项目根目录。

  2. 在项目根目录运行:

    comet status . --json
    
  3. 读取 .comet/current-change.json,并按以下顺序确定审查对象:

    • 文件包含有效的 comet.selection.v2 时,使用其中的 workflow 和 change;
    • 没有 selection 记录,且状态输出中只有一个未归档的 Comet change 时,只在本次审查中使用该 change,不写入 selection;
    • 没有 selection 记录且存在多个 change 时,列出名称、workflow 和 phase,请用户指定一个,然后停止当前调用;
    • selection 指向缺失、已归档或状态无效的 change 时,报告当前选择已过期或无效(stale/invalid selection),然后停止,不自行修复。

忽略不受 Comet 管理的普通 OpenSpec change。不得因为默认 workflow 与 selection 不同而改用默认 workflow。

2. 收集审查上下文

只读取当前 change 的必要上下文,并为每个事实保留来源路径或命令。

Classic

  1. 先读取并遵守 comet-classic/reference/classic-layout.md,解析当前项目的 Classic 逻辑根。

  2. 读取当前 change 的 proposal.md、design.md、tasks.md 和 specs/*/spec.md;存在关联 Design Doc 时一并读取。

  3. 使用以下只读状态查询获得 phase、基线和已有证据引用:

    comet state get <change-name> phase
    comet state get <change-name> base_ref
    comet state get <change-name> plan
    comet state get <change-name> verification_report
    
  4. 读取已有的 plan、验证报告,以及 comet status . --json 返回的 build/verify 命令检查结果。缺失的证据应标为“未提供”,不能推断为失败或通过。

Native

运行以下只读命令:

comet native show <change-name> --json
comet native status <change-name> --details --json

根据返回的引用,读取 brief、完整的拟议规格(proposed Specs)、acceptance、Builder handoff、checks、verification、risks、blockers 和验证报告(verification report)。只使用当前 candidate/iteration 的证据;历史轮次只用于解释尚未消除的风险,不能据此覆盖当前状态。

Read the full file on GitHub · 122 lines

Files

What ships with it

1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 1mo ago Changed f1ec04a04cef
  2. 1mo ago First seen · 122 lines · 30 tokens per session scan A d35317f7380c

Subscribe to this mod's changes

comet-review is a skill published in the GitHub repository rpamis/comet (3,214 stars, last pushed today), licensed MIT. It adds 30 tokens to every session and 1,759 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

load-pr-review

Load GitHub PR review comments into AI session — analyze, triage, plan. Default: analysis-only (no auto-fix). Use when: reviewing PR feedback, planning fixes, addressing review comments, replying to reviewers. Not for: creating reviews (use codex-review-fast), creating PRs (use create-pr), viewing PR status (use…

sd0xdev/sd0x-harness · 77 tokens

issue-analyze

GitHub Issue and PR review thread deep analysis with Codex blind verdict. Use when: analyzing issue root cause, classifying problems, investigation planning, triaging PR review comments for actionability. Not for: fixing bugs (use bug-fix), code exploration (use code-explore). Output: classified analysis + verdict…

sd0xdev/sd0x-harness · 73 tokens

best-practices

Industry best practices conformance audit with mandatory adversarial debate. Produces audit artifact: verdict (OK/WARN/FAIL) + gap roadmap + debate proof. Use when: auditing current implementation against industry standards, checking compliance with best practices, benchmarking implementation quality, verifying a…

sd0xdev/sd0x-harness · 101 tokens

pre-pr-audit

Pre-PR confidence audit with 5-dimension scoring. Use when: final check before commit/push/PR, evaluating PR readiness, assessing test quality + risk + coverage holistically. Triggers: pre-pr, readiness check, confidence audit, final verification, ready to PR, how confident. Not for: code review (use…

sd0xdev/sd0x-harness · 95 tokens

review-spec

Review technical spec documents from completeness, feasibility, risk, and code consistency perspectives.

sd0xdev/sd0x-harness · 19 tokens

codex-cli-review

Code review via Codex CLI with full disk access. Use when: deep review needing full codebase read, uncommitted change review. Not for: quick diff review (use codex-code-review), doc review (use doc-review). Output: severity-grouped findings + merge gate.

sd0xdev/sd0x-harness · 63 tokens