Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add tufantunc/review-pro --skill review-pro-triagegit clone --depth 1 https://github.com/tufantunc/review-proWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/tufantunc/review-pro/review-pro-triage)<a href="https://agentmods.dev/skills/tufantunc/review-pro/review-pro-triage"><img src="https://agentmods.dev/badge/skills/tufantunc/review-pro/review-pro-triage/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/tufantunc/review-pro/review-pro-triage"><img src="https://agentmods.dev/badge/skills/tufantunc/review-pro/review-pro-triage.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00057 | $0.04258 |
| Opus 5.5 | $0.00023 | $0.01703 |
| Sonnet 5.5 | $0.00011 | $0.00852 |
| Haiku 4.5 | $0.00006 | $0.00426 |
Grade A, and why
review-pro-triage scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 26d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 152 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Review-Pro Triage (Stage 1)
You are the orchestrator's first stage. You do NOT review code yourself. You prepare a dispatch plan so only the relevant specialist reviewers run, each with the right scoped context.
Inputs
- The diff:
git diff <base>...HEAD(base = the sha of the branchrefs/heads/main, falling back torefs/heads/master, or of the argument's base, resolved by thereview-proskill's Base branch rule with exact ref lookups; never a tag or other ref that shares the name). - The changed-file list:
git diff --name-only <base>...HEAD. - An optional spec argument forwarded by the orchestrator: a file path or an issue URL.
Steps
- Gather the diff and changed-file list (run git). Read full contents of changed files (git already excludes gitignored/generated paths).
- Classify each changed file into buckets:
backend | frontend | test | db-migration | config-infra | docs | build-deps. - Detect active stacks from the merge base, never the working tree: a pack changes what a reviewer looks for, so a change must not be able to add, edit or remove the pack its own review applies. Resolve the merge base with
git merge-base <base> HEAD, the sha step 8 and the verifiers use. If it prints nothing, stop and report that the branch shares no history with the base: never rungit showorgit ls-treewith an empty revision, becausegit show :<path>reads the index, the change's own copy. A pack file is a file at.review-pro/<stack>/<file>;.review-pro/rules.mdis not one.- List the merge base's pack files with
git ls-tree -r --name-only --full-tree <merge-base> -- .review-pro/, which lists the repository root's.review-pro/from any directory. Each<stack>whosemanifest.jsonis on that list is a stack the user installed (vianpx review-pro) and committed. These are the repo'sactive_stacks. (No auto-detection frompackage.json: stacks are explicitly installed per repo.) If there are none,active_stacks: []and reviewers run core-only. - The change's committed pack edits:
git diff --name-status --no-renames <merge-base> HEAD -- ':/.review-pro/', one path per line. Group them by stack:addedwhenHEADhas the stack'smanifest.jsonand the merge base does not,removedwhen the merge base has it andHEADdoes not,changedotherwise. - What is not committed:
git diff --name-status --no-renames HEAD -- ':/.review-pro/'for staged and unstaged edits, andgit ls-files --others --full-name -- ':/.review-pro/'for untracked and ignored files. Group them by stack asuncommitted, whether or not the stack is committed anywhere: a pack installed or updated and not yet committed must be reported, not silently skipped, and never as part of the change. A stack can have a committed entry and anuncommittedone. - Keep only paths of the form
.review-pro/<stack>/<file>. Emitstack_signalswhen the merge base has a pack file or steps 2, 3 and 6 found any, and nothing when there are none: a repository without packs behaves exactly as before. Never read a head pack file as a signal. A pack file this change touched is a changed file like any other, reviewed as data. - A committed entry (
added,removedorchanged) dispatchessecurity, and the reviewer each changed<reviewer>.mdis named for, whatever the signal map concluded, with the pack files in theircontext.changed_files. The merge base keeps a change from weakening its own review, but a merged pack edit is what every later review applies, and without this nothing reads it. - What the base has since:
git diff --name-only --no-renames <merge-base> <base> -- ':/.review-pro/'lists pack files the base branch changed after this change branched off. Group them by stack asbehind: the author chose the branch point, and the review applied the older pack the merge base holds, so the report must say a newer one exists.
- List the merge base's pack files with
- Decide which reviewers to dispatch using the signal map below. Be conservative: when relevance is uncertain, dispatch. Skipping a real issue is worse than paying for one extra subagent.
- Classify the diff's weight as
diff_class:trivialif the changed-file set is docs-only (every file in thedocsbucket) or the whole diff is a single file under ~20 changed lines;substantiveotherwise. Emit it in the plan — Stage 3 reads it and must not re-derive it. - Resolve the spec. Find what the change was supposed to do, trying these in order and falling through on any failure:
- An explicit argument forwarded by the orchestrator: a file path, or an issue URL. An explicit instruction always wins; if the user named a spec, do not go looking for a different one.
- The PR body and issue references in commit messages (
#123,Closes #45), viagh pr viewandgh issue view. - A file under
docs/,specs/, or.scratch/. Match the branch's last path segment as a substring of the filename, ignoring any leading date prefix: branchfeat/spec-axismatchesdocs/superpowers/specs/2026-08-20-spec-axis-design.md. These directories are conventions, not guarantees, and often none exists. If more than one file matches, preferspecs/overplans/over.scratch/, then the longest match; an implementation plan is not a requirements document, and measuring a diff against one turns every deliberate deviation into a finding. If two still tie, recordkind: nonerather than picking arbitrarily. - Nothing.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 26d ago Changed · +2 lines 137baa275c1b
- 1mo ago Changed · +12 lines 9f7e82663d40
- 1mo ago Changed · +22 lines a246c82996c9
- 1mo ago First seen · 116 lines · 57 tokens per session scan A 7abfbc38538b
review-pro-triage is a skill published in the GitHub repository tufantunc/review-pro (5 stars, last pushed yesterday), licensed MIT. It adds 57 tokens to every session and 4,258 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
logic-review
Find logic bugs in a single file or function via semi-formal execution tracing (Premises → Trace → Divergence → Trigger → Remedy). Trigger when a user shares code and suspects something is wrong without naming a concrete failure — phrases like "review this", "does this look right", "check this function", "audit this…
logic-fix-all
Autonomous repository-wide audit-and-fix pipeline: health → review → locate/explain → fix → diff-verify → iterate until clean. Starts with a mandatory consent prompt (token-intensive); after consent runs hands-free. Trigger when the user wants ALL logic issues found and fixed — "fix everything", "fix all logic…
logic-health
Sweep a directory, module, or full codebase for logic correctness and produce a scored health dashboard with systemic patterns. Trigger when the user requests a health view — "audit the whole codebase", "health check", "health overview", "logic health overview", "audit src/", "audit auth and payments modules", "where…
run-iteration-eval
Run the Logic-Lens content-eval pipeline for one iteration and produce a scored summary.json — use to measure a skill change. Wraps scripts/run-content-evals.sh (runner, costs tokens) and scripts/grade-iteration.py (grader, free, re-runnable). ALWAYS sync the plugin cache first. Use when the user wants to "run the…
new-skill
Scaffold a new logic- skill in the Logic-Lens repo and wire it into every place a skill must be registered, so no step is missed. Use when adding a seventh (or later) skill to Logic-Lens.
sync-skill-cache
Sync the Logic-Lens working-copy skills/ into the installed plugin cache so content-evals test the EDITED skill, not the last published one. ALWAYS run this after editing any skills//SKILL.md or guide/shared file and BEFORE running content-evals — otherwise the eval silently grades stale content and every token is…