Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add The01Geek/prflow --skill review-and-fixgit clone --depth 1 https://github.com/The01Geek/prflowWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/the01geek/prflow/review-and-fix)<a href="https://agentmods.dev/skills/the01geek/prflow/review-and-fix"><img src="https://agentmods.dev/badge/skills/the01geek/prflow/review-and-fix/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/the01geek/prflow/review-and-fix"><img src="https://agentmods.dev/badge/skills/the01geek/prflow/review-and-fix.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 9 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Rogue Agent · line 125 Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.Fix: Prevent the skill from modifying its own code, SKILL.md, or configuration files. Treat skill files as read-only at runtime.
- high Rogue Agent · line 323 Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.Fix: Prevent the skill from modifying its own code, SKILL.md, or configuration files. Treat skill files as read-only at runtime.
- high Rogue Agent · line 345 Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.Fix: Prevent the skill from modifying its own code, SKILL.md, or configuration files. Treat skill files as read-only at runtime.
- medium Agent Snooping · line 21 Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.Fix: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
- medium Agent Snooping · line 28 Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.Fix: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
- medium Agent Snooping · line 61 Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.Fix: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
- medium Agent Snooping · line 353 Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.Fix: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
- medium Output Handling · line 28 Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.Fix: Set explicit limits on output length, generation count, and rate. Use max_tokens and truncation to prevent unbounded output.
- medium Output Handling · line 42 Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.Fix: Set explicit limits on output length, generation count, and rate. Use max_tokens and truncation to prevent unbounded output.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00088 | $0.10882 |
| Opus 5 | $0.00044 | $0.05441 |
| Sonnet 5 | $0.00018 | $0.02176 |
| Haiku 4.5 | $0.00009 | $0.01088 |
Grade A, and why
review-and-fix scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 380 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/prflow:review-and-fix — Review, Fix, and Verify Loop
You are the review-and-fix orchestrator. Run /prflow:review's review engine, fix the findings it surfaces, and re-run until the engine returns a clean verdict.
Input: $ARGUMENTS may contain an optional PR number, the flag --push-each-iteration, and/or the flag --issue N. Parse the three independently — any, all, or none may be present. If no PR number is given, review and fix the current branch. The bare numeric token (if any) is $PR_NUMBER; the --issue value (if any) is $ISSUE_OVERRIDE. A value following --issue is never read as the PR number — only a bare numeric token binds $PR_NUMBER. Every later PR-mode predicate and every gh command reads $PR_NUMBER — never the raw $ARGUMENTS string, which fails an is-a-PR-number test and leaks the flag tokens into any command it is interpolated into.
--push-each-iteration (default off). When set, each fix and Loop Exit use the gated base checkpoint and push, keeping the PR and CI current. Otherwise fix commits stay local and the base is untouched. The flag never posts a GitHub verdict; mandatory telemetry persistence remains independent. Loop correctness uses local HEAD (with the PR head override), not pushed state.
Key principle: You perform fixes DIRECTLY in this session. Do NOT delegate fixes to a subagent. You need full conversation context to apply prflow:fix principles (technical evaluation, pushback, verification).
Subagent dispatch is user-requested at the loop's own dispatch points (injection-condition clause). Invoking /prflow:review-and-fix is the user's request for subagent dispatch at the points that are this loop's own — the Step 2.6 shadow fan-out, the Step 3.5 fix-delta gate, the Step 3 scoped comment-analyzer re-dispatch, the parked-class sweep, and the Loop Exit post-shadow edit gate — thereby satisfying any injected "do not call the AgentTool unless the user requested it" condition there and nowhere else, and authorizing none of the inline work: you still perform fixes DIRECTLY and never delegate a fix, or the whole engine, to a subagent. (The shared engine's own dispatch points are authorized by the /prflow:review clause this loop inherits and does not copy.)
Portable helper anchor (single-statement). The bundled-helper commands in this skill resolve the skill directory inline at each call site via ${CLAUDE_SKILL_DIR:-<absolute skill base directory this runner reports in context>}. When $CLAUDE_SKILL_DIR is set and non-empty (Claude Code), run each command exactly as written. Otherwise locate the directory yourself — this text lives in a file inside it, whose sibling ../../scripts/ directory exists — by replacing the placeholder with the skill base directory the runner reports in context (e.g. a Base directory for this skill: line) and accepting a candidate only once ls <candidate>/../../scripts/ succeeds in the same shell the helper commands run in. If a path form is rejected, use the form that shell reports (pwd shows it); a Windows-form base directory (C:\...) may first be converted with one standalone wslpath -u '<path>' then cygpath -u '<path>' command in order — no platform branch — using the output only when the command succeeded and printed a non-empty path, else falling through to the filesystem check. Resolve the anchor inline at every call site — never capture it into a shell variable that a later statement reads, because some runners' inline-bash marshaling drops such variables. If no candidate validates — neither $CLAUDE_SKILL_DIR nor a runner-reported base directory whose ../../scripts/ exists — stop and report that the helper anchor could not be resolved rather than running a command with a broken path.
Cloud command-shape discipline. A granted command head is not sufficient: the cloud runner's harness — the command tier this bundle runs under, and the review tier the shared engine runs under — denies whole command shapes even when every head is granted, silently, burning budget until a run can end with no verdict. This is additive to the three call-form rules in this bundle root — the inline-resolved portable anchor, the granted vendored-literal leading token, and the tier-agnostic invocation procedure. Keep every command you emit to a permitted shape, consistent with the equivalent discipline in skills/review/SKILL.md whose engine this bundle executes inline. The permitted and denied shapes are:
What ships with it
8 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago Changed · +2 lines a67e4fd2e174
- 3d ago Changed · +2 lines 396ba8abb85f
- 6d ago Changed · +2 lines 116b10445e63
- 10d ago First seen · 374 lines · 88 tokens per session scan A 6cda3f723918
review-and-fix is a skill published in the GitHub repository The01Geek/prflow (115 stars, last pushed 2d ago), licensed MIT. It adds 88 tokens to every session and 10,882 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
taiyi-review
A pre-merge review guide for checking code changes, design decisions, tests, and documentation. A merge adds reviewed changes to the main code branch.
taiyi-plan
A TaiyiForge planning step that turns a README, product requirements document, or technical plan into a list of separate project changes. Each change includes a suggested work profile, dependencies, and priority.
taiyi-requirement
A requirements-analysis process that turns a proposed change into a REQUIREMENT.md document. It records user needs, acceptance checks, terminology, triggers, and dependencies, with different levels of detail for different project sizes.
taiyi-change
A TaiyiForge workflow stage for writing a change proposal in CHANGE.md, with checks for scope, risks, success criteria, and related project documents.
taiyi-integration
A project workflow skill for closing a TaiyiForge change and recording it in a CHANGELOG.md file. It checks review results, tests, and the state of the working tree before archiving the change.
taiyi-test
A project workflow skill for verifying an implementation and producing a TEST.md record. TDD means writing a failing test, implementing the change, and then making the test pass; this skill checks that process and other regression cases.