SKILL PLAN · DETERMINISTIC

A small plan for a real job

Start with the minimum useful stack. Add nothing unless it has a clear responsibility in the run.

Task
PR review
Agent
Codex
Priority
Balanced
Start over

Change any option, then update this plan. Rules + reviewed metadata only. No LLM. Same inputs produce the same plan.

03 SKILLS · Install order

Your Skill Plan

Install and verify one role at a time. The plan never forces three Skills when fewer are enough.

Read the public task guide ↗
01Core execution

Portable · Codex

differential-review

Prioritizes blast radius and security-sensitive changes in the diff.
Open differential-review profile and install guide ↗
Review permissions, limitations, and evidence
Agent fit
Portable · Codex
Main limitation
Not intended for greenfield code or broad initial vulnerability discovery.
First risk
False assurance from incomplete context · High
Source
Pinned source · 32e34f81
02Guardrail

Portable · Codex

codeql

Adds a targeted static check with explicit limits.
Open codeql profile and install guide ↗
Review permissions, limitations, and evidence
Agent fit
Portable · Codex
Main limitation
Requires CodeQL, jq, uv, a buildable target, and potentially long database construction.
First risk
Build and scan side effects · High
Source
Pinned source · 32e34f81
03Evidence

Portable · Codex

build-evidence-map

Links review claims to visible or repository evidence.
Open build-evidence-map profile and install guide ↗
Review permissions, limitations, and evidence
Agent fit
Portable · Codex
Main limitation
Validation proves graph integrity, not source quality or inference correctness.
First risk
Sensitive excerpts in portable artifacts · High
Source
Pinned source · 1f564408

CONSIDER ANOTHER PATH

Alternatives when your constraints change

These are nearby options for a specific role, not extra installs. Swap only after checking the tradeoff.

Core execution

context-map

Choose this when
you want fewer declared permissions for the same role
Tradeoff to check
The workflow is intentionally brief and may miss dynamic dependencies or runtime ownership.
Inspect context-map ↗
Guardrail

semgrep

Choose this when
this role's workflow fits your project better after you inspect the tradeoff
Tradeoff to check
Requires Semgrep and network access for registry or third-party rules; Pro-only cross-file analysis may be unavailable.
Inspect semgrep ↗
Evidence

pr-screenshots

Choose this when
you want fewer declared permissions for the same role
Tradeoff to check
GitHub has no clean public API for PR-description image upload in this workflow.
Inspect pr-screenshots ↗

Combined permission budget

This is the union of declared permissions across the plan. Review each package before installation.

Read filesRun commandsWrite documentsWrite repositoryNetwork access

Finish with evidence

Find the highest-impact change risks without drowning the reviewer in generic comments.

Review only the proposed diff and directly affected paths; scanning is not certification.

  1. 3-step acceptance check
  2. Map each important finding to a changed line or affected path.
  3. Separate blocking defects from optional improvements.
  4. Verify the highest-risk path with a targeted test or scan.
  • Stop conditions
  • The review expands into unrelated repository cleanup.
  • A scanner result is presented as proof of safety.
  • The reviewer cannot explain the impact of a blocking comment.