code-review

A code-review workflow that checks changes against both repository coding rules and the original task requirements. It compares changes from a specified Git starting point and reports the two reviews side by side.

In plain words
What is it for?
Reviewing a branch, pull request, commit range, or changes since a tag, branch, commit, or other Git reference.
Why use it?
It catches both implementation-quality problems and cases where the code does not fulfill the requested behavior.

Skill for Claude CodeCodex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/astordu/qoderharness/code-review
Any agent
npx skills add astordu/qoderharness --skill code-review
Clone the repo
git clone --depth 1 https://github.com/astordu/qoderharness

Made for: Claude Code, Codex.

Per session 119 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,964 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00119 $0.01964
Opus 5 $0.00060 $0.00982
Sonnet 5 $0.00024 $0.00393
Haiku 4.5 $0.00012 $0.00196

Measured 2d ago against content hash 2b7e0665e82f, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

code-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.qoder/skills/code-review/SKILL.md · 90 lines

How it starts

The opening of the file, as written. The whole thing — 90 lines — stays where its author put it; the contents beside it link to each section on GitHub.

HEAD 与用户提供的固定基点之间的 diff 进行双维度审查:

  • 规范(Standards) —— 代码是否符合本仓库有文档记录的编码规范?
  • 需求(Spec) —— 代码是否忠实地实现了最初发起的 issue / PRD / 规格说明?

两个维度都作为并行子代理运行,以免相互污染各自的上下文,随后由本技能汇总它们的发现。

issue 追踪器应当已提供给你 —— 如果 docs/agents/issue-tracker.md 缺失,请运行 /init_goder_harness

流程

1. 确定固定基点

用户所说的即为固定基点 —— 一个提交 SHA、分支名、标签、mainHEAD~5 等。如果他们没有指定,就询问。

一次性确定 diff 命令:git diff <fixed-point>...HEAD(三点写法,因此比较是针对 merge-base 进行的)。同时通过 git log <fixed-point>..HEAD --oneline 记录提交列表。

在继续之前,确认固定基点可以解析(git rev-parse <fixed-point>)且 diff 非空。错误的引用或空 diff 应当在此处就失败 —— 而不是在两个并行子代理内部才失败。

2. 确定需求来源

按以下顺序查找最初发起的规格说明:

  1. 提交信息中的 issue 引用(#123Closes #45、GitLab 的 !67 等)—— 通过 docs/agents/issue-tracker.md 中的工作流获取。
  2. 用户作为参数传入的路径。
  3. 位于 docs/specs/.scratch/ 下、与分支名或特性相匹配的 PRD/规格说明文件。
  4. 如果什么都没找到,就询问用户规格说明在哪里。如果他们说没有,需求 子代理将跳过并汇报“无可用规格说明”。

3. 确定规范来源

仓库中任何记录代码应如何编写的内容,例如 CODING_STANDARDS.mdCONTRIBUTING.md

在仓库所记录内容的基础之上,规范维度始终携带下方的坏味道基线(smell baseline)—— 一组固定的 Fowler 代码坏味道(《重构》第 3 章),即便某个仓库什么都没记录也依然适用。有两条规则约束它:

  • 仓库优先。 有文档记录的仓库规范始终胜出;当它认可某个基线本会标记的做法时,抑制该坏味道。
  • 始终是主观判断。 每个坏味道都是带标签的启发式(“可能的 Feature Envy”),绝非硬性违规 —— 并且,如同这里的任何规范一样,跳过工具已经强制执行的部分。

每个坏味道遵循 它是什么如何修复;将其与 diff 对照:

  • Mysterious Name(神秘命名) —— 名称无法揭示其作用或持有内容的函数、变量或类型。→ 重命名;若找不到诚实的名字,说明设计混浊。
  • Duplicated Code(重复代码) —— 相同的逻辑形态出现在改动的多个代码块或文件中。→ 提取共享形态,从两处调用。
  • Feature Envy(依恋情结) —— 某方法访问其他对象的数据多于访问自身的数据。→ 将该方法移动到它所依恋的数据上。
  • Data Clumps(数据泥团) —— 相同的几个字段或参数总是结伴出现(一个想要诞生的类型)。→ 将它们捆绑为一个类型并传递之。
  • Primitive Obsession(基本类型偏执) —— 用基本类型或字符串来代表本该拥有自己类型的领域概念。→ 给该概念一个自己的小类型。
  • Repeated Switches(重复的 switch) —— 相同的 switch/if 级联在改动中反复出现于同一类型上。→ 用多态替换,或用两处共享的一张 map。
  • Shotgun Surgery(霰弹式修改) —— 一个逻辑改动迫使 diff 中许多文件出现分散的编辑。→ 把一起变化的内容聚拢到一个模块中。
  • Divergent Change(发散式变化) —— 一个文件或模块因几个不相关的原因被编辑。→ 拆分,使每个模块只因一个原因而变化。
  • Speculative Generality(夸夸其谈通用性) —— 为规格说明并不需要的需求而添加的抽象、参数或钩子。→ 删除它;内联回去,直到出现真实需求。
  • Message Chains(过长的消息链) —— 调用方不应依赖的长串 a.b().c().d() 导航。→ 将这段游走隐藏到第一个对象上的一个方法背后。
  • Middle Man(中间人) —— 一个大部分只是向下委托的类或函数。→ 去掉它,直接调用真正的目标。
  • Refused Bequest(被拒绝的遗赠) —— 一个忽略或覆盖了其继承的大部分内容的子类或实现类。→ 放弃继承,改用组合。

Read the full file on GitHub · 90 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 90 lines · 119 tokens per session scan A 2b7e0665e82f

Subscribe to this mod's changes

code-review is a skill published in the GitHub repository astordu/qoderharness (21 stars, last pushed 7d ago), licensed MIT. It adds 119 tokens to every session and 1,964 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

systematic-debugging

Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.

obra/superpowers · 21 tokens

brainstorming

You MUST use this before any creative work - creating features, building components, adding functionality, or modifying behavior. Explores user intent, requirements and design before implementation.

obra/superpowers · 37 tokens

chat-pet-sprite-creation

Use when creating or changing VS Code chat pet sprite art, sprite sheets, state animations, eye treatments, Stable/Insiders variants, or pet transitions under src/vs/workbench/contrib/chat/browser/widget/media/chatPet.

microsoft/vscode · 53 tokens

cpu-profile-analysis

Analyze V8/Chrome CPU profiles (.cpuprofile) and DevTools trace files (Trace-.json). Use when: profiling performance, investigating slow functions, comparing code paths, finding bottlenecks, analyzing timeToRequest, understanding call trees from sampling profiler data, analyzing layout/paint/rendering, investigating…

microsoft/vscode · 71 tokens

babysit-pr

Babysit a GitHub pull request after creation by continuously polling review comments, CI checks/workflow runs, and mergeability state until the PR is merged/closed or user help is required. Diagnose failures, retry likely flaky failures up to 3 times, auto-fix/push branch-related issues when appropriate, and keep…

openai/codex · 114 tokens

imagegen

Generate or edit raster images when the task benefits from AI-created bitmap visuals such as photos, illustrations, textures, sprites, mockups, or transparent-background cutouts. Use when Codex should create a brand-new image, transform an existing image, or derive visual variants from references, and the output…

openai/codex · 113 tokens