A review procedure for checking completed code changes against a plan and its required rules before merging. It determines which branch and changes should be reviewed, then uses a code-review agent when available.

Use it to review a feature branch, recent commit, or local changes and identify problems before they are merged.

It removes the guesswork from deciding what to review, especially when changes are staged, unstaged, committed, or part of a pull request.

code-review — Skill by yimwoo

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods

npx agentmods add skills/yimwoo/hotl-plugin/code-review

Any agent

npx skills add yimwoo/hotl-plugin --skill code-review

Clone the repo

git clone --depth 1 https://github.com/yimwoo/hotl-plugin

Made for: Claude Code, Codex.

Per session 20 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 1,438 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. Scan, not verified.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5	$0.00020	$0.01438
Opus 5	$0.00010	$0.00719
Sonnet 5	$0.00004	$0.00288
Haiku 4.5	$0.00002	$0.00144

Measured yesterday against content hash c3d1f99336df, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

code-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/code-review/SKILL.md · 154 lines

How it starts

The opening of the file, as written. The whole thing — 154 lines — stays where its author put it; the contents beside it link to each section on GitHub.

HOTL Code Review

User-facing entry point for getting a code review. Dispatches the full code-reviewer agent by default; falls back to inline review when subagents aren't available.

Process

1. Gather Context

Resolve base branch (fallback ladder — use the first that succeeds):

PR base branch: gh pr view --json baseRefName
Repo default branch: git symbolic-ref refs/remotes/origin/HEAD
main
master

Resolve review scope:

Feature branch: committed branch diff against base (base...HEAD), plus staged and unstaged local changes when present
On base branch with staged changes: staged diff
On base branch with unstaged changes: working tree diff
On clean base branch: HEAD~1..HEAD
Ambiguous (detached HEAD, no commits beyond base, no local changes): ask the user

Detect workflow file:

First, glob for canonical workflows in docs/plans/*-workflow.md
If one canonical match: use it
If multiple canonical matches: prefer the most recently modified canonical workflow, unless the user named one
If no canonical matches: glob for legacy hotl-workflow-*.md in project root
If one legacy match: use it
If multiple legacy matches: prefer the most recently modified legacy workflow, unless the user named one
If no matches: proceed without workflow context

Extract contracts from workflow frontmatter if available (intent, constraints, success_criteria, risk_level).

Gather verification evidence:

Primary (deterministic): .hotl/state/*.json and .hotl/reports/*.md — most recent artifacts if present
Best-effort: recent test/lint output if discoverable; if unavailable, report "not available"

2. Dispatch Review

If subagents are available (Claude Code, Codex):

Dispatch the code-reviewer role as a subagent via the Agent tool. Use the structured dispatch template from requesting-code-review:

Review type: direct
Git range: resolved scope from step 1
Workflow and contracts: if available
Verification evidence: if available

Read the full file on GitHub · 154 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

yesterday First seen · 154 lines · 20 tokens per session scan A c3d1f99336df

Subscribe to this mod's changes

code-review is a skill published in the GitHub repository yimwoo/hotl-plugin (26 stars, last pushed 1mo ago), licensed MIT. It adds 20 tokens to every session and 1,438 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Code review Git and workflow Planning agent-workflow ai-coding claude-code cline codex developer-tools

first-plan-co-change-analysis

Skill que constrói o Co-change Graph - "quando arquivo X muda, qual outro arquivo geralmente muda junto?". Use durante Discovery e em /fp:cochange. Baseado em git history. Detecta arquivos co-dependentes que devem ser editados juntos para evitar PRs incompletos. v0.3.0+ usa engine nativo Rust quando disponível…

vynazevedo/first-plan · 88 tokens

first-plan-provenance-tracker

Skill que define o schema de proveniência e o sistema de freshness tracking para findings em .first-plan/. Use durante Discovery e refresh para registrar source (file:line@SHA), TTL, confidence inicial e cadeia de supersedeção. Aplica decay de confidence baseado em idade.

vynazevedo/first-plan · 64 tokens

first-plan-protocol

Esta skill DEVE ser carregada em qualquer comando do plugin first-plan. Define o protocolo PLAN-FIRST (Discovery -> Plan -> Approval -> Execution -> Report), as 7 regras invioláveis e o comportamento esperado em cada fase. Ative quando o usuário invocar /fp: ou mencionar "first-plan", "context compilation", "discovery…

vynazevedo/first-plan · 81 tokens

first-plan-reconciliation

Skill que define Spec-Code Reconciliation - matching contínuo entre artefatos de intenção (docs, specs, JIRA, GitHub issues) e implementação (código, testes, PRs). Use durante Discovery e em /fp:check para identificar feature ja implementada, em flight, drifted ou abandonada.

vynazevedo/first-plan · 70 tokens

first-plan-git-intelligence

Skill que extrai inteligência do git history - heatmap de atividade, ownership, branches/PRs in-flight. Use durante Discovery e em /fp:hot, /fp:owner, /fp:in-flight. Tudo via comandos git read-only.

vynazevedo/first-plan · 58 tokens

first-plan-lens-engine

Skill que define o motor de detecção e roteamento de stack lenses do first-plan. Mapeia manifestos (go.mod, package.json, etc) -> stack -> papel -> lens skill correspondente. Use quando precisar decidir qual lens aplicar a uma pasta durante Discovery, ou quando estender suporte a uma nova stack.