csa-review

Automate CSA code reviews with machine-readable findings and reports.

12|1|Updated Feb 6, 2026
One-click install
npx skills add https://github.com/RyderFreeman4Logos/cli-sub-agent --skill csa-review
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: csa-review
Source: https://github.com/RyderFreeman4Logos/cli-sub-agent/tree/main/patterns/csa-review/skills/csa-review
Command: npx skills add https://github.com/RyderFreeman4Logos/cli-sub-agent --skill csa-review

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Automates structured, autonomous CSA code reviews by routing to an independent model stack and producing machine-readable findings and reports.

Core Features & Use Cases

  • Independent model routing for code review when orchestrating CSA agents
  • Three-pass review workflow (discovery, evidence filtering, adversarial security)
  • AGENTS.md compliance discovery across changed files and root-to-leaf scans
  • Output artifacts: review-findings.json and review-report.md, session persistence for follow-ups
  • Supports standard and red-team review modes, plus fix workflow via --fix
  • Context-aware: can align with spec.toml or TODO.md when provided
  • Tooling orchestration: SA-mode propagation and pre-PR alignment prompts

Quick Start

Invoke the skill against the current changeset to generate a structured review and artifacts.

Frequently Asked Questions about csa-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate code reviews to enforce AGENTS.md compliance?▼

Automated code reviews enforce AGENTS.md compliance by running a three-pass workflow across changed files and root-to-leaf scans. It produces machine-readable findings and reports to ensure reproducible governance artifacts.

What is an autonomous static analysis review and how does it work?▼

An autonomous static analysis review uses an independent model stack to run discovery, evidence filtering, and adversarial security passes. It routes code changes through a structured protocol to validate outputs against a strict schema.

Can I run a red-team security review on my uncommitted git diff?▼

Red-team security reviews can run on uncommitted diffs using a specific base range scope. The review mode applies adversarial security passes and session isolation to ensure rigorous, independent threat detection.

Does automated static analysis require external dependencies to generate reports?▼

Automated static analysis requires no external dependencies or changes to generate reports. It operates entirely within the existing environment to produce review-findings.json and review-report.md artifacts.

How do I generate machine-readable findings from a code review?▼

Generate machine-readable findings by invoking the review against your current changeset. The workflow automatically outputs review-findings.json and review-report.md files validated against the Output Schema.

What is the best way to handle fixes found during an automated code review?▼

Handle fixes found during automated code reviews by activating the fix workflow. This mode uses session persistence from the initial review to apply corrections and align with pre-PR prompts.