code-review-skill

English | 简体中文

Evidence-backed code review. Static-first, probe-driven, and gated.

The skill source lives in skills/code-review/, independently of any host's installation directory. The current version is a beta release; see VERSION.

Most AI reviews stop at “this looks risky.” This skill produces a review you can audit: every finding points to a location, a contract or code path, and a severity; every gate decision is rendered from machine-readable JSON. It reads the diff, surrounding source, tests, and project rules — no build, test run, or coverage report required.

It never modifies the code under review.

Latest news

v0.1.0-beta.3 (2026-10-31)

Removed

• Removed the independent reviewer and its Claude Code/Codex adapters. The four probes now feed the report and gate directly from raw findings; reviewer.json, review-mode, and reviewer-adapter installation are no longer used.

Changed

• The installer now installs only the host skill layout. --agent selects the Claude Code or Codex skill directory, not a reviewer adapter.

Full update history

Release status

v0.1.0-beta.3 — this is a test release. The probe contract, report schema, and gate behavior may change before 1.0.

• Severity is three levels: high, medium, low. Records written by the earlier four-level version, including any critical value, are not compatible; collect-metrics rejects them. Re-run the review or migrate the records before using them with this release.
• Scope: static-first review with four probes and JSON-derived report/gate output. It does not replace tests, CI, or human review.
• Validation: 52 offline pipeline, NEWS, and installation tests; clean-project end-to-end gate runs; additional probe smokes. These are regression checks, not a general recall claim. Concurrency-defect detection has not been validated.

Contents

• Latest news
• Release status
• Why this skill
• Quick start
• How it works
• Evidence contract
• Configuration
• What this is not
• Validation
• Requirements
• Repository layout
• Contributing
• License

Why this skill

No self-grading.

The implementation context does not sign off on its own work. Four probes run in fresh contexts, each files its own evidence, and the gate is derived from those records.

This is separation of duties, not independent human adjudication; all probes still use the same model.

Quick start

Install

Run this command inside your project:

npx -y skills add kyy-logs/code-review-skill --agent codex --skill code-review --yes

Use --agent claude-code for Claude Code. Codex installs to .agents/skills/code-review/; Claude Code installs to .claude/skills/code-review/. Node.js 22.20+ is required. This installs only the skill; there is no separate reviewer adapter.

Run

Ask in Claude Code:

Review these changes with code-review.

Or invoke the skill directly:

/code-review

For a fixed range:

Use code-review on commits abc123..def456

The skill supports two review modes:

• worktree — staged, unstaged, and untracked changes against the current HEAD.
• commits — a fixed base..head range.

Read the result

docs/work/active/{slug}/
├── code-review.md      # human report
└── probes/
    ├── behavior-review.json
    ├── test-coverage.json
    ├── repo-guard.json
    └── impact-analysis.json

How it works

scope ──► probes ──► sync ──► reconcile ──► report ──► gate

1. Scope — determine worktree or commits; record base and head as commit IDs.
2. Probes — dispatch four independent agents with the same scope and diff, each writing its own probe JSON. Run in batches if host capacity is limited, or record a serial fallback if agents are unavailable. Cross-probe duplicates are retained and counted; actual speed and token savings remain unverified.
3. Sync — validate probe JSON and derive counts with collect-metrics.
4. Reconcile — high findings must be closed or marked false-positive by the probe.
5. Report — render the human report’s fact sections from JSON, then verify them.
6. Gate — required-probe failures and open high findings block the merge.

The four probes

Probes are intentionally narrow. behavior-review is not a linter, and repo-guard is not a general bug scanner.

Evidence contract

Every finding records:

High-severity findings must cite the actual method signature and the contract they violate, or a concrete code path. A hunch is capped at medium until the evidence is checked.

Configuration

references/probes.yaml controls the probe registry:

Project-specific rules can live in .code-review/rules/, or be pointed to with CODE_REVIEW_RULES_DIR:

export CODE_REVIEW_RULES_DIR=/path/to/rules

A project rule package replaces the built-in package; it is not merged with it.

What this is not

• Not a replacement for tests, CI, or human review.
• Not a guarantee that a clean report means the change is correct.
• Not a coverage tool: coverage is used when provided, not required.
• Not a fixer: it does not modify the code under review.

Validation

• Baseline: commit 494a39bb, before behavior-review was extracted into a standalone probe. The snapshot validates the shared finding and gate contract, not the four-probe split itself.
• 11/11 cases completed; static review.
• Original behavior targets: 5/5 hit; including two independently confirmed edge cases, 5/7 required targets were found.
• Clean and fixed controls: 4/4 passed without false blocking.
• Two confirmed edge-case misses remain: legal input formatting in a parser, and a JSON representation round-trip in command rendering.
• 33 raw findings: 8 high, 20 medium, 5 low; 0 confirmed false positives, with unverified items still open.
• The full merge gate was not run.

Risk areas exercised by these cases: