AI Code Review Triage

AI writes code faster than you can read it. Stop reading harder and review differently.

English · 简体中文

A Claude Code skill that reviews AI-generated pull requests by splitting "reading the code" into three separate jobs.

The problem

Agent-written PRs pile up faster than anyone can review them line by line. Reading harder doesn't help much either: the code is tidy on the surface, so the real problems hide well enough to survive a careful read. "Just merge and roll back if it breaks" works technically, but a human still answers for the incident.

The idea

"Reviewing code" has always bundled three different jobs. That worked when code arrived slowly. At agent speed, each job needs its own process:

flowchart LR
    PR([AI-written PR]) --> T{Step 0<br/>Triage<br/>risk tier}
    T --> B["**1 · Catch bugs**<br/>fresh-context sub-agent<br/>+ tests / repro"]
    B --> C["**2 · Align context**<br/>orders of magnitude<br/>history & neighbors<br/>requirement match"]
    C --> S["**3 · Own the sign-off**<br/>explain · detect · undo<br/>scoped approval"]
    S --> R([Review report])

Low-risk PRs only run Step 1. High-risk PRs (production behavior, data, security, money) run all three.

What it catches that line-by-line review misses

A PR changes SESSION_TIMEOUT = 30 to 30000 and drops one line of unit conversion. Tests pass. The code is clean. A line-by-line reader approves it in 30 seconds.

• Step 1 has a fresh-context sub-agent add a boundary test. Result: sessions now expire after 30 seconds.
• Step 2 checks history and callers. The same change was reverted once before, the mobile client hard-codes the old value, and the request was only for "remember me" users while the diff changes everyone.
• Step 3 blocks the approval. Nobody can explain what the PR actually does.

Full run: examples/session-timeout-walkthrough.md

A second runnable example follows a pagination change from 100 to 1000 rows per request: a capped API returns 100 rows, and the exporter silently stops with 150 of 250 rows missing. See the pagination walkthrough for the contract check, reproduction, and recovery scope. Both walkthroughs use invented scenarios.

Install

As a plugin (inside Claude Code):

/plugin marketplace add laulauraluo/ai-code-review-triage
/plugin install ai-code-review-triage@ai-code-review-triage

As a standalone skill:

git clone https://github.com/laulauraluo/ai-code-review-triage.git
cp -r ai-code-review-triage/skills/ai-code-review-triage ~/.claude/skills/

Usage

Ask Claude Code something like:

• "Review this AI-generated PR before I merge it."
• "Can this diff be merged? Claude wrote it."
• "I'm about to approve #123. What should I verify first?"

The skill triggers on its own and returns a report (illustrative example):

## Extend session lifetime for "remember me" · Risk: High

### 1. Bugs (independent fresh-context review)
- [CONFIRMED] auth/session.py:3 — unit conversion dropped; sessions expire after 30 s. Repro: test_session_expires_after_timeout

### 2. Context
- Magnitudes: SESSION_TIMEOUT 30 → 30000 (comment says min, code treats as ms) — suspicious
- History / neighbors: reverted once before (a1b2c3d); mobile/src/config.ts hard-codes 30 min
- Requirement match: asked for remember-me users only; diff changes everyone

### 3. Sign-off
- Detection: login-rate and 401-rate alerts · Rollback: config revert
- Recommendation: request changes
- Verification scope: verified units and callers; did not load-test

Review questions and limitations

• How do I review AI-generated code before merging?
• Why can passing tests miss incomplete exports?
• Can this review Codex, Copilot, or Cursor output?
• Does it replace scanners or human review?

The installation targets Claude Code. The workflow can review code from other agents; native integration with those tools is not provided.

Repository layout

.claude-plugin/
  plugin.json          # plugin manifest
  marketplace.json     # lets /plugin marketplace add this repo
skills/
  ai-code-review-triage/
    SKILL.md           # the skill itself
examples/
  session-timeout-walkthrough.md   # timeout units and requirement scope
  pagination-limit-walkthrough.md # API contract mismatch, runnable repro

Works well with

This skill organizes the review and decides what has to be true before you approve. It doesn't replace specialized checkers. Run them inside Step 1:

• correctness-focused review (e.g. Claude Code's built-in /code-review)
• security / performance checklists
• over-engineering reviews

Acknowledgments

The three-job framing was inspired by a public talk on reviewing AI-written code.

License

MIT

If this caught a bad merge for you, a ⭐ helps other reviewers find it.