skill-code-review

Reviews code changes using multi-provider AI consensus with security analysis and PR comment posting.

Updated Aug 15, 2026
One-click install
npx skills add https://github.com/GongYuanCaiJi/dsh-claude-octopus --skill skill-code-review-gongyuancaiji
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: skill-code-review
Source: https://github.com/GongYuanCaiJi/dsh-claude-octopus/tree/main/.claude/skills/skill-code-review
Command: npx skills add https://github.com/GongYuanCaiJi/dsh-claude-octopus --skill skill-code-review-gongyuancaiji

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Single-model code reviews miss defects and reflect one model's biases. This Skill runs a multi-LLM review pipeline that synthesizes perspectives from several AI providers, detects security vulnerabilities and incomplete implementations, and posts findings directly to pull requests. ## Core Features & Use Cases - Multi-Provider Review Pipeline: Orchestrates parallel reviews across external AI providers (Codex, Copilot, Qwen, and others) with a 75% consensus gate before delivering findings. - Security and Quality Analysis: Detects OWASP vulnerabilities, performance issues, architecture problems, and autonomous-codegen risk patterns like placeholder logic and dead branches. - Stub Detection and PR Integration: Scans changed files for TODO markers, empty functions, and mock data in production paths, then posts the review synthesis as a GitHub PR comment via the gh CLI. - Use Case: Before merging a PR with authentication changes, invoke the review to get multi-model security findings, TDD evidence assessment, and implementation completeness verification posted directly to the PR. ## Quick Start Ask the AI to review the current pull request for security issues and code quality using the multi-provider code review pipeline.

Frequently Asked Questions about skill-code-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run a multi-AI code review on a pull request?▼

Invoke the review skill on your branch, which runs the orchestrate.sh pipeline to gather parallel reviews from multiple AI providers and synthesizes them with a 75% consensus gate. Quick mode handles small PRs with just grasp and tangle phases.

What does the code review check for security issues?▼

The review detects OWASP Top 10 vulnerabilities, error handling weaknesses, memory leaks, and performance problems. It also flags autonomous-codegen risks like placeholder logic, dead branches, and mock data leaking into production paths.

Can the review post comments directly to GitHub pull requests?▼

Yes, if the gh CLI is installed and the current branch has an open PR, the review synthesis is posted as a PR comment through a credential-gated script. Standalone invocations ask before posting; automated workflows post automatically.

How does the review detect incomplete or stub implementations?▼

It scans changed source files for TODO/FIXME comments, empty function bodies, null returns, and mock data references. Empty functions and unwired components block merge, while TODO comments are noted as non-blocking follow-ups.

When should I use quick mode instead of the full review?▼

Use quick mode for staged changes, small PRs, and pre-commit sanity checks where only the grasp and tangle phases run. Use the full pipeline for PRs with security or architecture impact requiring multi-provider synthesis.