Install
$ agentstack add skill-putchi-agentic-code-reviewer-skill-acr-config ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
Configure Agentic Code Reviewer (.acr.json)
Create or update the repo-level .acr.json that controls the Agentic Code Reviewer's Stop-hook gate, model choices, and review scope.
Recognized .acr.json keys
Only these keys are read — never write anything else:
| Key | Type | Effect | |---|---|---| | disableStopHook | boolean | true fully disables the session-exit review gate for this repo | | stopHookMode | "prompt" \| "auto" \| "disabled" | Gate behavior: ask before reviewing, review automatically, or stay silent | | models | object | Per-role model overrides: { "balanced": "...", "fast": "...", "judge": "..." }. Values must be full model IDs (e.g. claude-haiku-4-5-20251001), not aliases | | outOfScope | string[] | Glob patterns for changed files reviewers should treat as out of scope (only CRITICAL security findings are kept for them) |
Related: a repo-level .acrignore file (gitignore-style patterns, no ! negation) excludes files from the review diff entirely.
Steps
- Read existing config. Check the working tree
.acr.jsonfirst, then
git show HEAD:.acr.json. Also check .acrignore. Preserve any existing keys you are not changing.
- Map the user's intent:
- "Stop reviewing, I'm still working" / "pause reviews" → set
"stopHookMode": "disabled". Mention the session-only alternative (export ACR_STOP_HOOK_MODE=disabled) and how to re-enable ("stopHookMode": "prompt" or delete the key).
- "Never review this repo" → set
"disableStopHook": true. - "Only review when I ask" → set
"stopHookMode": "disabled"and note
/code-review still works manually.
- "Ask me before reviewing" →
"stopHookMode": "prompt"(the default). - "Review automatically" →
"stopHookMode": "auto". - "Reviews are too slow" → suggest faster
modelsoverrides and pruning
scope with outOfScope / .acrignore.
- "Don't review X" → add glob(s) to
outOfScope(kept but deprioritized)
or .acrignore (excluded from the diff entirely). Prefer outOfScope unless the user explicitly wants files invisible to reviewers.
- Propose scope exclusions when creating a new file. Inspect the project
and suggest outOfScope globs for: generated code, vendored dirs, migrations, snapshots/fixtures (e.g. **/__snapshots__/**, migrations/**, vendor/**, **/*.generated.*). Lockfiles, minified assets, images, and build dirs are already excluded from the diff by default — do not add them. Show the proposed JSON and ask the user to confirm before writing.
- Write the file. Valid JSON, 2-space indent, only recognized keys.
.acr.json takes effect immediately — no commit needed (the gate reads HEAD first, then falls back to the working tree). Suggest committing it if the team should share the config.
- Confirm. Summarize what changed and what behavior to expect at the next
session exit.
Proactive suggestion
The review gate records consecutive no/skip answers per repo in ~/.claude/agentic-code-reviewer/skip-counts.json (or $ACR_SETTINGS_DIR). When the user has skipped 3+ prompts in a row, or their messages indicate they are mid-work and don't want reviews yet, offer once — do not nag:
> You've skipped the last N review prompts. Want me to create .acr.json with > "stopHookMode": "disabled" so the gate stays quiet while you work? You can > re-enable it later or keep using /code-review manually.
Only write the file after the user agrees.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: putchi
- Source: putchi/agentic-code-reviewer-skill
- License: MIT
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.