Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add stone16/harness-engineering-skills --skill review-loopgit clone --depth 1 https://github.com/stone16/harness-engineering-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/stone16/harness-engineering-skills/review-loop)<a href="https://agentmods.dev/skills/stone16/harness-engineering-skills/review-loop"><img src="https://agentmods.dev/badge/skills/stone16/harness-engineering-skills/review-loop.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00022 | $0.04943 |
| Opus 5 | $0.00011 | $0.02472 |
| Sonnet 5 | $0.00004 | $0.00989 |
| Haiku 4.5 | $0.00002 | $0.00494 |
Grade C, and why
review-loop scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
"$(find ~/.claude/plugins/cache -path "*/review-loop" -type d 2>/dev/null | head -1)" \ Enumerates other installed skillsmediumAgent snooping
Other skills' SKILL.md files reveal prompts, capabilities and secrets that should be invisible to peers.
"$(find ~/.claude/skills -path "*/review-loop" -type d 2>/dev/null | head -1)" \ Copies of this mod
1 near-identical copy found in the catalogue:
- review-loop — 100% identical, 0 lines differ
How it starts
The opening of the file, as written. The whole thing — 493 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Review Loop — Cross-LLM Iterative Code Review
Spawns a peer reviewer (Codex, Claude, or Gemini) to independently review your code changes. The host agent evaluates findings, implements accepted fixes, and re-submits for peer re-review. Iterates until both agents agree on the final code state.
Key: You (the human) do NOT need to participate. Watch progress via .review-loop/<session>/rounds.json and summary.md.
Compatibility note: rounds.json keeps the historical field name claude_actions for backward compatibility. In Codex-hosted runs, that field still stores the host agent's decisions and code changes.
Prerequisites
- Required:
gitCLI - Peer (one of):
codexCLI (codex --version),claudeCLI (claude --version), orgeminiCLI (gemini --version) - Optional:
ghCLI (for PR scope detection)
Configuration
Defaults
| Setting | Default | Options |
|---|---|---|
peer_reviewer |
codex |
codex, claude, gemini |
max_rounds |
5 |
1–10 |
timeout_per_round |
600 |
seconds |
scope_preference |
auto |
auto, diff, branch, pr |
read_only |
false |
true = report-only, no code changes |
The peer reviewer always runs with local repository access.
Read-only mode (read_only: true): Peer reviews code and the host agent evaluates findings, but NO code changes are made. Output is a findings report only — no fix commits, no code evolution loop. Useful when review-loop is used as a sensor by other skills (e.g., the bundled harness skill's Evaluator Tier 2). In read-only mode, Phase 2 (Code Evolution Loop) is skipped entirely — after Round 1 findings are evaluated, the loop goes directly to Phase 3 report generation with all findings classified as reported (not accepted/rejected).
Override via project config
Create .review-loop/config.json in the project root to override defaults:
{
"peer_reviewer": "gemini",
"max_rounds": 8
}
What ships with it
5 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed · -7 lines · -108 tokens per session e7b3e489d561
- 8d ago First seen · 500 lines · 130 tokens per session scan C d828f40219e5
review-loop is a skill published in the GitHub repository stone16/harness-engineering-skills (32 stars, last pushed today), licensed Apache-2.0. It adds 22 tokens to every session and 4,943 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it C with 2 findings (reads agent configuration directories, enumerates other installed skills). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
logic-health
Sweep a directory, module, or full codebase for logic correctness and produce a scored health dashboard with systemic patterns. Trigger when the user requests a health view — "audit the whole codebase", "health check", "health overview", "logic health overview", "audit src/", "audit auth and payments modules", "where…
logic-diff
Compare two code versions for semantic equivalence via semi-formal tracing of both versions side-by-side. Trigger when the user shares a refactor, rewrite, migration, or A/B implementation and wants to confirm behavior is unchanged — "did I break anything", "is this equivalent", "are these equivalent", "semantically…
river-review-code
A general code-review skill that checks readability, maintainability, and type safety, with routing for several specialized checks.
Standard Review Policy for Midstream
Applies standard AI review policy guidelines for midstream (implementation) phase reviews.
brooks-audit
Architecture audit that maps module dependencies, checks layering integrity, and flags structural decay across a codebase, drawing on twelve classic engineering books. Triggers when: user asks to audit architecture, review folder/module structure, check for circular imports, understand how the codebase is organized…
brooks-sweep
Full-sweep mode: runs a unified analysis across all quality dimensions — code decay, architecture, tech debt, and test quality — then applies fixes directly to the codebase. Safe changes are auto-applied; risky changes are confirmed before execution. Drawing on twelve classic engineering books. Triggers when: user…