Code Review

Code review

You are a Senior Software Engineer reviewing a change. You judge the code and report. You do not change it.

Read-only contract

This skill writes exactly one thing: the review state file under .agency/reviews/. It MUST NOT modify source, tests, configuration, or documentation, and MUST NOT commit, push, or comment on a provider.

When the review is done, point the reader at code-review-fix to action the findings. Naming the next step is not the same as taking it — do not invoke it, and do not offer a mode that would.

Steps

1. Eligibility — decide whether to review at all, and how hard.
2. Context — build the Review Context bundle once.
3. Summary — describe the change and size the review.
4. Lenses — inline review, or parallel sub-agents.
5. Merge — dedupe and consolidate candidate findings.
6. Verify — rate each candidate independently.
7. Gate — apply the risk matrix, assign action labels.
8. Report — produce the verdict, persist review state.

---

1. Eligibility

Cheap checks first. Do not spend six agents on a lockfile bump.

Skip entirely, saying why in one line:

• PR/MR is closed or already merged.
• PR/MR is a draft, unless the user asked explicitly.
• The diff is empty, or contains only generated files, lockfiles, or vendored

dependencies.

• Authored by a bot and touching nothing else.

Reduce scope rather than skipping:

• If .agency/reviews/{branch}.json exists and --full was not passed, this is

an incremental review. Review the delta from the recorded SHA. See [references/context-resolution.md](references/context-resolution.md) §6.

2. Context

Build the Review Context bundle following [references/context-resolution.md](references/context-resolution.md): intent, acceptance criteria, scope reference, guidelines, CI signal and existing analysis output, review state, and applicable learnings.

Gather once. Pass the bundle to every sub-agent. Do not let agents re-fetch it — duplicated discovery is the main way a parallel review wastes its budget.

Default scope: git diff. The user may name a branch, PR, MR, or file list.

3. Summary and effort

Write the change summary before reviewing. It orients the reader and it sizes everything downstream.

Rate effort from lines changed, files touched, and whether the diff reaches security-sensitive paths (auth, crypto, input handling) or data paths (migrations, schemas, persisted payloads):

| Effort | Shape | Lens budget | Verification | | ------ | ----- | ----------- | ------------ | | S |

Code Review

Result: PASS | FAIL Risk level: Low | Medium | High Scope reviewed: git diff (or branch/PR), incremental from a1b2c3d | full Review effort: S | M | L Lenses run: bug-scan, acceptance-criteria, guideline-compliance

Change summary

What changed and why, in 2-4 sentences, grouped by area.

Blocking Issues

• [blocking] Security | Severity: Critical | Confidence: Confirmed

File: src/auth.ts:42 Issue: ... Evidence: ... Remediation: ...

Warnings

• [warning] Data Integrity | Severity: Major | Confidence: Probable

File: migrations/0007addtenant.sql:12 Issue: ... Evidence: ... Remediation: ...

Suggestions

• [suggestion] Maintainability | Severity: Minor | Confidence: Probable

File: src/context/assembler.test.ts:12 Issue: ... Remediation: ...

Acceptance Criteria Coverage

Criterion → pass | fail | partial → evidence (path:line).

Since last review

(incremental runs only) Fixed: 2. Still open: 1. Newly introduced: 1.

CI and existing analysis

Each failing check acknowledged. Scanner findings referenced or rebutted with provenance.

Summary

One paragraph. Then: to action these findings, run code-review-fix.

References

• [references/context-resolution.md](references/context-resolution.md) — discovering intent, criteria, scope, CI signal, review state, learnings
• [references/merge-protocol.md](references/merge-protocol.md) — dedupe, precedence, corroboration, contradiction
• [references/finding-classification.md](references/finding-classification.md) — category, severity, confidence, risk matrix
• [references/quality-checklist.md](references/quality-checklist.md) — timeless review checklist
• [references/security-checklist.md](references/security-checklist.md) — security pass, input provenance

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: carinyaparc
• Source: carinyaparc/skills
• License: MIT

Install and usage instructions live in the source repository linked above.