Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add SteveVitali/agent-skills --skill review-prgit clone --depth 1 https://github.com/SteveVitali/agent-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/stevevitali/agent-skills/review-pr)<a href="https://agentmods.dev/skills/stevevitali/agent-skills/review-pr"><img src="https://agentmods.dev/badge/skills/stevevitali/agent-skills/review-pr/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/stevevitali/agent-skills/review-pr"><img src="https://agentmods.dev/badge/skills/stevevitali/agent-skills/review-pr.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00066 | $0.02550 |
| Opus 5 | $0.00033 | $0.01275 |
| Sonnet 5 | $0.00013 | $0.00510 |
| Haiku 4.5 | $0.00007 | $0.00255 |
Grade A, and why
review-pr scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 224 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Review PR
Review someone else's pull request and deliver the kind of review a rigorous human Staff Engineer would: grounded in evidence, labeled by severity, and quiet about everything that doesn't matter.
The prime directive is precision over recall. Developer trust in a reviewer collapses non-linearly with false positives — a handful of wrong or noisy comments and every future comment gets skimmed. A review that surfaces three real issues beats one that surfaces three real issues buried in ten speculative ones. When unsure whether an issue is real: it isn't. Drop it.
The governing standard (Google's, and ours): favor approval once the PR definitely improves the overall code health of the system, even if it isn't perfect. You are reviewing for "better", not "perfect".
Phase 0 — Gather context
Run the bundled context fetcher from the repo root (read-only):
// turbo
bash scripts/fetch-pr-context.sh <pr>
It resolves the PR (argument, or the current branch's open PR), and writes:
/tmp/pr-context.json— title, body, author, base/head refs, draft state, changed files with add/delete counts, CI check rollup/tmp/pr-threads.json— all existing review threads with resolution state
Then gather what the script can't:
- The diff:
gh pr diff <number>(orgit diff base...headif checked out). Note which lines belong to diff hunks — GitHub rejects inline comments outside them. - Intent: read the PR title, description, and any linked issue
(
Fixes #N/Closes #N→gh issue view N). If the description is empty, reconstruct intent from the commit messages. You cannot judge "does this do what it intends, and is that good for this codebase?" without knowing the intent. If intent is genuinely unrecoverable, say so in the review summary and review what the code does. - Repo standards: read the repo's
AGENTS.md/CONTRIBUTING.md/ style or architecture docs for the touched areas. Comments grounded in the repo's own documented rules ("CONTRIBUTING.md requires X here") carry far more weight than generic best practices — prefer them. - Existing feedback (from
/tmp/pr-threads.json): what other reviewers and bots have already said. Never re-raise a point that has already been made, resolved, or explicitly dismissed on this PR.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 224 lines · 66 tokens per session scan A ada8ec21f6c7
review-pr is a skill published in the GitHub repository SteveVitali/agent-skills (12 stars, last pushed yesterday), licensed MIT. It adds 66 tokens to every session and 2,550 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
go-testing
Trigger: Go tests, go test coverage, Bubbletea teatest, golden files. Apply focused Go testing patterns.
security-review
Perform a focused security review of pending git changes to identify high-confidence security vulnerabilities with real exploitation potential. Use this skill when the user asks for a security review, security audit, vulnerability scan, or wants to check pending changes on a branch for security issues before merging.…
huggingface-llm-trainer
Train or fine-tune language models with TRL or Unsloth on Hugging Face Jobs, including SFT, DPO, GRPO, reward models, and GGUF conversion. Use for cloud LLM training; use huggingface-vision-trainer for vision tasks.
feature-dev
Guide a feature implementation through a structured seven-phase workflow with deep codebase understanding, clarifying questions, parallel architecture design, and quality review. Use this skill when the user asks to build a new feature, add functionality, or wants a methodical approach to implementation rather than…
review
Validate plans, execution, or PRs against wish criteria — returns SHIP / FIX-FIRST / BLOCKED with severity-tagged gaps.
reply-to-pr-threads
Draft, confirm, and post replies to GitHub PR review threads. Handles per-category reply formatting, re-fetches thread resolution state so auto-resolved threads are skipped, and posts via GraphQL. Use when the user asks to "reply to PR threads", "post PR thread replies", or "draft PR reply messages".