Install
$ agentstack add skill-gsarig-skills-code-review ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ● Environment & secrets Used
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
Steps
1. Determine source and fetch the diff
Read ~/.claude/skills/code-review/references/review-shared.md and follow its source detection and diff fetching sections. By the end of this step you have:
- A resolved source mode:
pr/uncommitted/branch/both/file - The diff content
- The list of changed file paths
2. Compute triage signals
From the diff and the changed file list, compute:
| Signal | How | |---|---| | lines_added | count of ^+ lines (excluding +++ headers), excluding lockfiles and build-output paths | | files_changed | unique +++ b/ paths, excluding lockfiles | | all_docs | every changed path matches \.(md\|mdx\|txt\|rst)$ or lives under docs/, content/, posts/ | | has_infra | any path under .github/, ends in .tf, matches Dockerfile, or matches docker-compose* | | has_security_paths | any path matches (auth\|crypto\|password\|token\|secret\|\.env\|sql\|migration) |
Apply recommendation logic (first match wins):
has_infratrue: recommend code-review-infraall_docstrue: recommend code-review-contenthas_security_pathstrue ORlines_added >= 500: recommend code-review-deep- Default: recommend code-review-lite
Print this classification line before proceeding:
> Triage: lines / files / . > Recommended: **** ().
3. Confirm the type
Resolve state location. Run:
bash ~/.claude/skills/code-review/scripts/code-review-state.sh resolve
If output is non-empty, that's the state_file path. If empty, persistence is skipped for this run (no project context, or .claude/ missing).
Compute source_id:
- PR mode:
pr: - File mode:
file: - Git modes:
git::, where `is one ofbranch,uncommitted,both, andis the output ofgit branch --show-current(usedetached` if empty)
Pick the type, in this order:
--type=was passed. Use that type. If the value is not one ofcontent,code-lite,code-deep,infra, ignore it and continue to step 2. Ifstate_fileis set, run:
bash ~/.claude/skills/code-review/scripts/code-review-state.sh set
Skip the prompt.
- Stored type exists. If
state_fileis set, run:
bash ~/.claude/skills/code-review/scripts/code-review-state.sh get
If the output is non-empty, use that type and print:
> Using previously chosen review type: ****. Pass --type= to override.
Skip the prompt.
- Prompt the user. Call
AskUserQuestion:
- question: "Which review type should I run?"
- header: "Review type"
- multiSelect: false
- options: the recommended type first with
(Recommended)appended to the label, then the other three in this fixed order: code-deep, code-lite, infra, content (skipping whichever is recommended).
After the user picks, if state_file is set, run the set command from step 1 to persist the choice.
The chosen label maps to a child skill: content -> code-review-content, code-lite -> code-review-lite, code-deep -> code-review-deep, infra -> code-review-infra.
4. Dispatch to the child skill
Invoke the chosen child skill via the Skill tool. Build the args string from the resolved source so the child does not re-prompt:
- PR mode:
--source=pr --pr= - File mode:
--source=file --file= - Uncommitted / branch / both:
--source= - If the user passed
--lint, append--lint
The child performs the actual review and produces all output. Do not produce any review content yourself: your job ends after dispatching.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: gsarig
- Source: gsarig/skills
- License: MIT
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.