Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add TalonT-Org/AutoSkillit --skill audit-review-decisionsgit clone --depth 1 https://github.com/TalonT-Org/AutoSkillitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/talont-org/autoskillit/audit-review-decisions)<a href="https://agentmods.dev/skills/talont-org/autoskillit/audit-review-decisions"><img src="https://agentmods.dev/badge/skills/talont-org/autoskillit/audit-review-decisions/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/talont-org/autoskillit/audit-review-decisions"><img src="https://agentmods.dev/badge/skills/talont-org/autoskillit/audit-review-decisions.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00084 | $0.03081 |
| Opus 5 | $0.00042 | $0.01541 |
| Sonnet 5 | $0.00017 | $0.00616 |
| Haiku 4.5 | $0.00008 | $0.00308 |
Grade A, and why
audit-review-decisions scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 329 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Audit Review Decisions Skill
Mine merged PR review threads for agreed-but-deferred suggestions that were never implemented. Identify review debt before it compounds.
When to Use
- User says "audit review decisions", "find deferred review items", "surface review debt", "what did reviewers flag for later"
Arguments
$1— Time period (e.g.14d,30d,7d). Default:14d.$2— Output path. Default:${AUTOSKILLIT_TEMP}/audit-review-decisions/review_decisions_audit_$(date +%Y-%m-%d_%H%M%S).md
Critical Constraints
NEVER:
- Create files outside
${AUTOSKILLIT_TEMP}/audit-review-decisions/ - Have triage or validation subagents make GitHub API calls (local data only for Step 2)
- Post duplicate
[AUDIT]markers — check for existing marker before posting - Run subagents in the background (
run_in_background: trueis prohibited) - Use
gh pr listwithout--limitto avoid pagination truncation - Use
\|in Grep patterns — use|for alternation (ERE, not BRE)
ALWAYS:
- Save raw PR JSON to temp before any analysis (Step 1)
- Use GraphQL alias batching (~20 PRs per query) for data collection
- Include
rateLimit { cost remaining resetAt }in every GraphQL query - Sleep 1s between consecutive mutating GitHub API calls (Step 5 watermark posts)
- Step 2 triage subagents read local JSON files only — zero API calls
- Step 3 validation subagents grep the actual current codebase
- Skip threads that already contain an
[AUDIT]comment - Resolve owner/repo from
git remote get-url origin— never hardcode - Use
/autoskillit:prefix when invoking any other skill
Workflow
Step 0: Watermark Resolution
-
Parse
$1for time period. Default14d. ComputePERIOD_DAYS. -
Resolve
OWNERandREPOfromgit remote get-url origin. -
Query the most recent
[AUDIT]sentinel comment across recently merged PRs:gh api graphql -f query=' query($owner:String!, $name:String!) { rateLimit { cost remaining resetAt } repository(owner:$owner, name:$name) { pullRequests(first:500, states:MERGED, orderBy:{field:UPDATED_AT,direction:DESC}) { nodes { number reviewThreads(first:50) { nodes { comments(first:10) { nodes { body createdAt } } } } } } } }' -f owner="${OWNER}" -f name="${REPO}"Extract the most recent
createdAtfrom any comment whosebodystarts with[AUDIT]. Store asLAST_AUDIT_TS(empty string if none — first run).
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 329 lines · 84 tokens per session scan A 2d060a250263
audit-review-decisions is a skill published in the GitHub repository TalonT-Org/AutoSkillit (5 stars, last pushed today), licensed MIT. It adds 84 tokens to every session and 3,081 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
agent-review
Critically review a Stencila agent and suggest improvements. Use when asked to review, audit, critique, evaluate, or improve an agent directory or AGENT.md file. Covers frontmatter validation, system instruction quality, configuration correctness, and adherence to the Agent schema.
pr
Use when reviewing an incoming GitHub pull request — runs the multi-level (L1-L5) audit against the PR's real diff range, posts findings as one batched review (inline, summary, or local-only), offers the standard fix chain on NEEDSFIX, and optionally merges. The maintainer-side counterpart to /hyperflow:issue. Trigger…
代码审查员
A code-review agent that examines changes for correctness, security, maintainability, performance, and test coverage.
laravel-audit
Perform a deep, structured, evidence-based audit of a Laravel application and produce actionable findings backed by concrete project evidence. Use when asked to audit, review, assess, or evaluate an existing Laravel codebase.
laravel-audit-dsa
Run a read-only, orchestrated audit of a Laravel codebase for data structures, state representation, algorithms, and ownership. Use when asked for a DSA audit, subsystem inventory, or Aaron-style bounded agent audit.
audit-expert
Expert-level security auditing, compliance, code review, and vulnerability assessment. Use when the user mentions compliance, security review, code review, vulnerability assessment, SOC 2, or GDPR, or when the task involves Audit Types, Audit Frameworks, Audit Process, or Authentication Review.