comet-review

comet-review is a skill for Claude Code, Codex from rpamis/comet. It costs 30 tokens per session (1,704 once invoked), scanned A, original, MIT.

A read-only review guide for checking the current Comet change, a managed software-change workflow. It focuses on correctness, security, and boundary problems without changing files or advancing the workflow.

In plain words
What is it for?
Use it to identify implementation risks, inspect the active change and Git differences, and report findings before verification or further workflow steps.
Why use it?
It provides a controlled way to inspect the selected change and its differences without accidentally fixing files, altering state, or treating review as proof that tests passed.

Skill for Claude CodeCodex

Written for Claude Code and Codex: disable-model-invocation in frontmatter, but also agents/openai.yaml present.

About the project

Comet is a resumable workflow and skill platform for coding tasks, covering requirements work as well as skill creation, evaluation, and release. It supports separate Native and Classic workflows and can coordinate implementation and verification across isolated Git worktrees. The catalogue contains skills and instructions that implement Comet-related workflows.

rpamis/comet · 2,931 stars · on GitHub · docs.comet.rpamis.com

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/rpamis/comet/comet-review
Any agent
npx skills add rpamis/comet --skill comet-review
Clone the repo
git clone --depth 1 https://github.com/rpamis/comet

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for comet-review

README.md
[![agentmods](https://agentmods.dev/badge/skills/rpamis/comet/comet-review.svg)](https://agentmods.dev/skills/rpamis/comet/comet-review)
Your own site
<a href="https://agentmods.dev/skills/rpamis/comet/comet-review"><img src="https://agentmods.dev/badge/skills/rpamis/comet/comet-review.svg" alt="Measured on agentmods" height="20"></a>
Per session 30 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,704 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00030 $0.01704
Opus 5 $0.00015 $0.00852
Sonnet 5 $0.00006 $0.00341
Haiku 4.5 $0.00003 $0.00170

Measured 6d ago against content hash d35317f7380c, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-06, from the pricing page.

Security

Grade A, and why

comet-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

assets/skills-zh/comet-review/SKILL.md · 122 lines

How it starts

The opening of the file, as written. The whole thing — 122 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Comet 手动代码审查

对当前选中的 Comet change 执行一次按需、只读的代码审查。这个入口不属于任何阶段,也不替代 Build 或 Verify 的验证和审查。

本入口独立于 review_modereview_mode 控制流程内的自动 review 策略,而 /comet-review 只代表用户手动触发的单次审查;调用本入口不得读取、修改或覆盖当前 change 的 review_mode

不可变约束

本 Skill 的整个调用必须保持只读:

  • 不修改、创建或删除文件;
  • 不暂存、提交、切换分支、创建分支或创建 worktree;
  • 不运行 comet state selectcomet native selectcomet state setcomet state transition、阶段守卫、comet native next 或归档命令;
  • 不修复发现的问题,不推进 phase,不更新 tasks、状态、验证报告或审查记录;
  • 不把本次结果称为 Verify 通过,也不把“没有发现”视为测试已经通过。

只允许执行读取文件、查询状态和查看 Git 差异所需的命令。任何可能运行项目代码、安装依赖或产生文件的检查都不属于本入口。

1. 定位项目与当前 change

  1. 使用只读 Git 查询确定项目根目录;如果不是 Git 仓库,则使用当前 Comet 项目根目录。

  2. 在项目根目录运行:

    comet status . --json
    
  3. 读取 .comet/current-change.json,并按以下顺序确定审查对象:

    • 文件包含有效的 comet.selection.v2 时,使用其中的 workflowchange
    • selection 缺失,且状态输出中只有一个未归档的 Comet change 时,只在本次审查内采用该 change,不写入 selection;
    • selection 缺失且存在多个 change 时,列出名称、workflow 和 phase,请用户指定一个后停止;
    • selection 指向缺失、已归档或状态无效的 change 时,报告 stale/invalid selection 后停止,不自行修复。

忽略不受 Comet 管理的普通 OpenSpec change。不得因为默认 workflow 与 selection 不同而改用默认 workflow。

2. 收集审查上下文

只读取当前 change 的必要上下文,并为每个事实保留来源路径或命令。

Classic

  1. 先读取并遵守 comet-classic/reference/classic-layout.md,解析当前项目的 Classic 逻辑根。

  2. 读取当前 change 的 proposal.mddesign.mdtasks.mdspecs/*/spec.md;存在关联 Design Doc 时一并读取。

  3. 使用以下只读状态查询获得 phase、基线和已有证据引用:

    comet state get <change-name> phase
    comet state get <change-name> base_ref
    comet state get <change-name> plan
    comet state get <change-name> verification_report
    
  4. 读取存在的 plan、验证报告,以及 comet status . --json 返回的 build/verify command checks。缺失证据应标为“未提供”,不能推断为失败或通过。

Native

运行以下只读命令:

comet native show <change-name> --json
comet native status <change-name> --details --json

读取返回的 brief、完整 proposed Specs、acceptance、Builder handoff、checks、verification、risks、blockers 和 verification report 引用。只使用当前 candidate/iteration 的证据;历史轮次仅用于解释残留风险,不得覆盖当前状态。

3. 确定实现差异

Read the full file on GitHub · 122 lines

Files

What ships with it

1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 6d ago First seen · 122 lines · 30 tokens per session scan A d35317f7380c

Subscribe to this mod's changes

comet-review is a skill published in the GitHub repository rpamis/comet (2,931 stars, last pushed yesterday), licensed MIT. It adds 30 tokens to every session and 1,704 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

issue-analyze

GitHub Issue and PR review thread deep analysis with Codex blind verdict. Use when: analyzing issue root cause, classifying problems, investigation planning, triaging PR review comments for actionability. Not for: fixing bugs (use bug-fix), code exploration (use code-explore). Output: classified analysis + verdict…

sd0xdev/sd0x-harness · 73 tokens

load-pr-review

Load GitHub PR review comments into AI session — analyze, triage, plan. Default: analysis-only (no auto-fix). Use when: reviewing PR feedback, planning fixes, addressing review comments, replying to reviewers. Not for: creating reviews (use codex-review-fast), creating PRs (use create-pr), viewing PR status (use…

sd0xdev/sd0x-harness · 77 tokens

refactor

Multi-target refactoring orchestrator. Use when: cleaning up messy code/docs, simplifying code, restructuring documents, batch cleanup. Not for: new features (use feature-dev), bug fixes (use bug-fix), code understanding (use code-explore). Output: refactored code/docs + review gate.

sd0xdev/sd0x-harness · 65 tokens

best-practices

Industry best practices conformance audit with mandatory adversarial debate. Produces audit artifact: verdict (OK/WARN/FAIL) + gap roadmap + debate proof. Use when: auditing current implementation against industry standards, checking compliance with best practices, benchmarking implementation quality, verifying a…

sd0xdev/sd0x-harness · 101 tokens

review-spec

Review technical spec documents from completeness, feasibility, risk, and code consistency perspectives.

sd0xdev/sd0x-harness · 19 tokens

pre-pr-audit

Pre-PR confidence audit with 5-dimension scoring. Use when: final check before commit/push/PR, evaluating PR readiness, assessing test quality + risk + coverage holistically. Triggers: pre-pr, readiness check, confidence audit, final verification, ready to PR, how confident. Not for: code review (use…

sd0xdev/sd0x-harness · 95 tokens