Hodor uses the upstream @mariozechner/pi-coding-agent skills system (agentskills.io style).
Skills are:
- Discovered from the reviewed repository at
.pi/skillsor.hodor/skills - Advertised to the model as metadata
- Loaded lazily by the agent with the
readtool when relevant
Create a skill in the repository you want Hodor to review:
mkdir -p .pi/skills/security-review<!-- .pi/skills/security-review/SKILL.md -->
---
name: security-review
description: Security checklist for API and auth related pull requests.
---
## Authentication
- All protected endpoints must enforce auth middleware.
- Session and token checks must happen server-side.
## Input Validation
- Reject invalid payloads at API boundaries.
- Use parameterized queries for all DB access.Run Hodor with verbose logs:
bun run dist/cli.js <PR_URL> --workspace . --verboseHodor discovers skills from both .pi/skills and .hodor/skills (if either exists):
- Flat markdown files:
.pi/skills/*.md(or.hodor/skills/*.md) - Subdirectory skills:
.pi/skills/<skill-name>/SKILL.md(recommended)
Use the subdirectory SKILL.md format when possible because it keeps one skill per folder and avoids name collisions.
Skills should include YAML frontmatter:
---
name: security-review
description: Security checklist for API and auth related pull requests.
---descriptionis required for the SDK to activate the skill.nameis strongly recommended and should match the parent directory forSKILL.mdskills.
When Hodor starts a review:
- It initializes the SDK resource loader with the review system prompt.
- It discovers skills from
.pi/skillsand.hodor/skillsin the reviewed repository. - It passes skill metadata to the agent.
- The agent reads matching skill files on demand during review.
Hodor no longer inlines skill markdown into the system prompt and no longer uses .cursorrules or AGENTS.md as repository skills.
If skills are not used:
- Verify files are under
.pi/skillsor.hodor/skillsin the repository being reviewed. - Ensure each skill has valid frontmatter with
description. - Prefer
.pi/skills/<name>/SKILL.mdwithname: <name>. - Run with
--verboseand check skill discovery logs.