# Cross Review

> >

- **Type:** Skill
- **Install:** `agentstack add skill-medivhluo-sys-codex-claude-cross-review-skill-codex-claude-cross-review-skill`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [medivhluo-sys](https://agentstack.voostack.com/s/medivhluo-sys)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [medivhluo-sys](https://github.com/medivhluo-sys)
- **Source:** https://github.com/medivhluo-sys/codex-claude-cross-review-skill

## Install

```sh
agentstack add skill-medivhluo-sys-codex-claude-cross-review-skill-codex-claude-cross-review-skill
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Cross-Review

Use this skill for an auditable review conversation stored in Git Notes. Run commands from the target Git repository.

Require Git and the `cross-review-chat`, `cross-review-send`, and `cross-review-sync` commands installed from this skill. Before sending a message in a multi-clone workflow, run `cross-review-sync --pull`; after sending, run `cross-review-sync --push`.

Never put passwords, API keys, client data, or vulnerability proof-of-concepts in messages. Notes pushed to a remote are repository data and may be visible to every remote reader.

## Commands

Prefer the long command names because macOS also ships `/usr/sbin/chat`.

```bash
cross-review-chat --tail 5
cross-review-chat --since 3
cross-review-chat --json

cross-review-send --from codex --type risk --reply 1 --content "1) ..."
cross-review-send --from codex --type review --content "审查通过，无发现问题。"

cross-review-sync --pull
cross-review-sync --push
```

Identities are fixed by tool:

- Codex: `--from codex`
- Claude Code: `--from claude`

Message types are role-specific:

- `review`: producer's summary, or reviewer's final pass/no-issue result
- `risk`: reviewer found actionable issues
- `done`: producer fixed risks

## Storage Model

Messages are JSON lines in `refs/notes/cross-review`, attached to a stable anchor object at `refs/cross-review/anchor`. This works before the repo has its first commit. `cross-review-sync` transfers both refs through the configured Git remote. Older conversations attached to the root commit remain readable.

The scripts do not modify the working tree and should not affect `git status`.

The sync command refuses to overwrite a conversation when local and remote messages diverge. Resolve the divergence deliberately instead of discarding review history.

## Reviewer Workflow

When the user says something like “用 chat 读最新消息，审查这个改动，有问题发 risk”:

1. Run `cross-review-sync --pull` when reviewing from another clone.
2. Run `cross-review-chat --tail 5` and identify the latest `review` or `done` message and its `id`.
3. Inspect the actual repository change. Prefer `git diff`, `git show`, tests, and relevant files over trusting the message alone.
4. If there are actionable issues, send:

```bash
cross-review-send --from codex --type risk --reply  --content "1) 问题 + 影响 + 建议\n2) ..."
```

5. If no actionable issues are found, send:

```bash
cross-review-send --from codex --type review --content "审查通过，无发现问题。验证：..."
```

6. Run `cross-review-sync --push` when the reviewer uses another clone.

## Producer Workflow

When producing work for later cross-review:

1. Run `cross-review-sync --pull` when the reviewer uses another clone.
2. Run `cross-review-chat --tail 5`.
3. Make the change.
4. Validate it locally.
5. Commit when appropriate.
6. Send a `review` message that includes changed files, validation, and uncertainty:

```bash
cross-review-send --from codex --type review --content "改动：...\n验证：...\n请重点看：..."
```

7. Run `cross-review-sync --push` when the reviewer uses another clone.

When fixing risks, send `done --reply `, map each numbered risk to its fix and validation result, then sync the message.

## Risk Message Quality

A `risk` message must be concrete and independently verifiable:

- Number each issue.
- Explain the failing behavior or ambiguity.
- Explain impact.
- Point to file/line or command output when possible.
- Do not send vague style preferences as risk unless they block the goal.

## Operational Notes

- Always run `cross-review-chat` before `cross-review-send`.
- Use `cross-review-sync --pull` before sending and `--push` after sending when agents work in separate clones.
- Do not rewrite or delete prior messages.
- If `cross-review-chat` says there are no messages, ask whether the other agent used the same repository.
- If `cross-review-send --reply` fails, rerun `cross-review-chat` and use an existing message ID.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [medivhluo-sys](https://github.com/medivhluo-sys)
- **Source:** [medivhluo-sys/codex-claude-cross-review-skill](https://github.com/medivhluo-sys/codex-claude-cross-review-skill)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-medivhluo-sys-codex-claude-cross-review-skill-codex-claude-cross-review-skill
- Seller: https://agentstack.voostack.com/s/medivhluo-sys
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.