code-review

Routes code diffs to an independent reviewer for security, concurrency, and performance defect analysis.

Updated Jul 12, 2026
One-click install
npx skills add https://github.com/sumitake/agent-collab --skill code-review-sumitake
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: code-review
Source: https://github.com/sumitake/agent-collab/tree/main/plugins/agent-collab/skills/code-review
Command: npx skills add https://github.com/sumitake/agent-collab --skill code-review-sumitake

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Code changes touching security-sensitive surfaces, concurrency logic, or financial calculations often contain defect classes the original author cannot see, and self-review or same-family review cannot provide independent verification. This Skill sends a materialized diff to a caller-verified independent reviewer and returns structured, verified findings. ## Core Features & Use Cases - Lens-driven defect review: Prioritizes security vulnerabilities, edge cases, race conditions, resource hazards, performance bottlenecks, and architectural anti-patterns over style feedback. - Verifier independence contract: Records reviewer lineage before and after dispatch so independent governance evidence is only accepted when the reviewer differs from both the primary and artifact author. - Spec-fidelity and smell baselines: Compares the diff against a materialized spec and flags Fowler-named code smells as separately reported, non-blocking observations. - Use Case: Before merging a PR that changes authentication token refresh logic, materialize the diff with lockfile exclusions, dispatch it for independent review, and receive verified Critical/High findings grouped by file with a merge-readiness recommendation. ## Quick Start Have the reviewer review this diff for security flaws and concurrency hazards before I merge it.

Frequently Asked Questions about code-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I get an independent code review of a pull request?▼

Materialize the actual diff with git diff over the PR range, excluding lockfiles and generated files via pathspec, then submit it as a review work unit. The caller verifies the reviewer's lineage differs from both the primary and artifact author before accepting the result as independent evidence.

What kinds of defects does an automated code review catch?▼

The review lens prioritizes security vulnerabilities like injection and SSRF, unhandled edge cases, race conditions and TOCTOU bugs, resource leaks, performance bottlenecks like N+1 queries, and architectural anti-patterns. Style and formatting issues are explicitly excluded.

When should I skip running a code review?▼

Skip reviews for typo fixes, formatting-only edits, and auto-generated output from deterministic tools like formatters or lock-file regeneration. Also skip repeat reviews of the same unchanged artifact, since the bottleneck is deciding which findings to act on.

Can a same-family reviewer satisfy an independent approval requirement?▼

No. Same-family or lineage-unverified output is labeled advisory only and cannot satisfy a required independent approval gate. The gate stays explicitly unmet with an explanation of the missing eligible reviewer, while advisory findings may still inform the work.

Why do code review findings need verification before reporting?▼

Reviewers can hallucinate issues or pattern-match on similar-looking code that lacks the actual flaw. Each finding is checked against the real file at the flagged line, then scored, grouped by module, and synthesized into a merge-readiness recommendation.