review-code

review-code is a skill for Claude Code, Codex from Ryan-M-Frank/volley. It costs 65 tokens per session (1,074 once invoked), scanned A, original, Apache-2.0.

A command that reviews code changes against a project plan and its acceptance criteria, then writes the result to a review file.

In plain words
What is it for?
Use it after Codex has implemented a plan to review uncommitted changes or a specified Git revision range.
Why use it?
It helps check whether an implementation matches the agreed work and whether it added anything outside the plan.

Skill for Claude CodeCodex

Installs and runs on its own, but its text points at files inside its plugin — anything it tells you to read at a ${CLAUDE_PLUGIN_ROOT} path is only there once the plugin is installed. Installing the plugin gets both.

Part of the volley plugin — 8 skills, 1 MCP server shipped together

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/ryan-m-frank/volley/review-code
Any agent
npx skills add Ryan-M-Frank/volley --skill review-code
Clone the repo
git clone --depth 1 https://github.com/Ryan-M-Frank/volley

Made for: Claude Code, Codex.

Or install volley, the plugin that ships this one along with the rest of its 8 skills, 1 MCP server.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for review-code

README.md
[![agentmods](https://agentmods.dev/badge/skills/ryan-m-frank/volley/review-code.svg)](https://agentmods.dev/skills/ryan-m-frank/volley/review-code)
Your own site
<a href="https://agentmods.dev/skills/ryan-m-frank/volley/review-code"><img src="https://agentmods.dev/badge/skills/ryan-m-frank/volley/review-code.svg" alt="Measured on agentmods" height="20"></a>
Per session 65 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,074 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00065 $0.01074
Opus 5 $0.00032 $0.00537
Sonnet 5 $0.00013 $0.00215
Haiku 4.5 $0.00006 $0.00107

Measured 4d ago against content hash b7b4257b4852, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

review-code scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/review-code/SKILL.md · 87 lines

How it starts

The opening of the file, as written. The whole thing — 87 lines — stays where its author put it; the contents beside it link to each section on GitHub.

/volley:review-code

Claude reads what Codex built and judges it.

Steps for Claude

  1. Verify .volley/ is initialized and the lock allows Claude to act.

    [ -d .volley ] || { echo "ERROR: .volley/ not found. Run /volley:setup first." >&2; exit 1; }
    [ -f .volley/STATE ] || { echo "ERROR: .volley/STATE not found. Run /volley:setup first." >&2; exit 1; }
    . "${CLAUDE_PLUGIN_ROOT}/scripts/lib.sh"
    volley_state_assert_active .volley/STATE claude || exit 1
    
  2. Resolve the diff to review.

    • If user passed a range argument (e.g. HEAD~3..HEAD), use that.
    • Otherwise, default to uncommitted changes:
      git diff HEAD
      
    • If diff is empty, tell user "No changes to review. Did Codex finish?" and stop.
  3. Locate the plan and HANDOFF. Same logic as /volley:review-plan for finding the latest PLAN.md. Read the plan and .volley/HANDOFF.md content.

  4. Read the diff into context. Use Bash to capture the diff and Read tools as needed for full context on changed files.

  5. Review with these prompts in mind:

    • Does each change implement a specific PLAN task or acceptance criterion? (Cite which.)
    • Are there changes that go beyond the plan's scope?
    • Are there gaps - acceptance criteria not addressed?
    • Are the tests covering the new code?
    • Any obvious correctness, safety, or style issues for this codebase?
  6. Write .volley/CODE-REVIEW.md with this structure:

    # Claude Code Review
    
    **Diff range:** <range used>
    **Reviewed:** <ISO timestamp>
    **Plan:** <plan path>
    
    ## Verdict
    SHIP | FIX | DISCUSS
    
    ## Coverage of acceptance criteria
    - Criterion 1: ✓ addressed in <file:line>
    - Criterion 2: ✗ not addressed
    - ...
    
    ## Coverage of plan tasks
    - Task N: ✓
    - Task M: partial (missing X)
    
    ## Issues found
    - (file:line — description)
    
    ## Out-of-plan changes
    - (file:line — what was changed beyond the plan, with judgement)
    
    ## Suggested next moves
    - (concrete actions)
    

Read the full file on GitHub · 87 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 4d ago First seen · 87 lines · 65 tokens per session scan A b7b4257b4852

Subscribe to this mod's changes

review-code is a skill published in the GitHub repository Ryan-M-Frank/volley (2 stars, last pushed 1mo ago), licensed Apache-2.0. It adds 65 tokens to every session and 1,074 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Related

Other skills, from other repositories

maude

Use when the user is starting a session, losing track of where something is, asking "where did I put X", "where is X", "what's the state of Y", "what changed", wants to audit their config or setup, says "save this", "remember this", "remind me about Z", or invokes any /maude: command. ALSO use when the user expresses…

john-broadway/maude-for-claude · 191 tokens

model-routing

Internal routing, foreground-agent, validation, persistence, and Codex background-job rules for Stereo pair workflows.

vsladkov/claudex-stereo · 23 tokens

codex-cli-runtime

Internal helper contract for calling the codex-companion runtime from Claude Code.

vsladkov/claudex-stereo · 19 tokens

claudex-second-opinion

Suggests a cross-model second opinion after substantial or risky code changes. Use when a significant implementation, refactor, security-sensitive change, or uncertain bug fix has just been completed and is about to be committed or shipped. Advisory only — it recommends running /claudex:verdict; it never invokes Codex…

hamza-ali-shahjahan/claudex · 74 tokens

quiz-me

Use right after writing or editing code or files for the user — before ending your turn — to quiz them on what was just built and confirm they actually understand it. Also triggers on "quiz me", "test my understanding", "check what I learned", "comprehension check", or recovering the understanding that vaporizes when…

Ciucky/no-numb · 81 tokens

rubber-duck

Socratic debugging companion, at one of three intensities: lite, full (default), ultra. Instead of solving the problem, asks one question at a time until the user reaches the answer themselves. ACTIVATE ONLY ON EXPLICIT REQUEST — when the user invokes this skill, optionally naming one of those three levels, or…

centsandcode/rubber-duck · 135 tokens