code-review

code-review is a skill for Claude Code, Codex from devcxl/mattpocock-skills-zh. It costs 109 tokens per session (1,891 once invoked), scanned A, original, MIT.

A two-part code review process that compares your current changes with a chosen commit, branch, tag, or merge point. One review checks repository conventions, while the other checks the original requirements.

In plain words
What is it for?
Use it to review branches or pull requests, inspect the diff and commit history, check coding standards, and compare implementation against an issue, product specification, or requirements document.
Why use it?
It separates style and maintainability concerns from the question of whether the change actually delivers what was requested.

Skill for Claude CodeCodex

Written for Claude Code and Codex: shipped in a Claude Code plugin, but also agents/openai.yaml present.

Part of the mattpocock-skills plugin — 37 skills shipped together

Good fit Use it to review branches or pull requests, inspect the diff and commit history, check coding standards, and compare implementation against an issue, product specification, or requirements document.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/devcxl/mattpocock-skills-zh/code-review
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add devcxl/mattpocock-skills-zh --skill code-review
Clone the repo
git clone --depth 1 https://github.com/devcxl/mattpocock-skills-zh

Made for: Claude Code, Codex.

Or install mattpocock-skills, the plugin that ships this one along with the rest of its 37 skills.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for code-review

README.md
[![agentmods](https://agentmods.dev/badge/skills/devcxl/mattpocock-skills-zh/code-review.svg)](https://agentmods.dev/skills/devcxl/mattpocock-skills-zh/code-review)
Your own site
<a href="https://agentmods.dev/skills/devcxl/mattpocock-skills-zh/code-review"><img src="https://agentmods.dev/badge/skills/devcxl/mattpocock-skills-zh/code-review.svg" alt="Measured on agentmods" height="20"></a>
Per session 109 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,891 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits
  • NVIDIA SkillSpector pass 7 Sept 2026
How audits are shown
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00109 $0.01891
Opus 5 $0.00055 $0.00945
Sonnet 5 $0.00022 $0.00378
Haiku 4.5 $0.00011 $0.00189

Measured 8d ago against content hash 96fbc4abc216, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-08, from the pricing page.

Security

Grade A, and why

code-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/engineering/code-review/SKILL.md · 90 lines

How it starts

The opening of the file, as written. The whole thing — 90 lines — stays where its author put it; the contents beside it link to each section on GitHub.

审查

HEAD 与用户指定的固定点之间的 diff 进行双轴审查:

  • 规范——代码是否符合本仓库文档化的编码规范?
  • 规格——代码是否忠实地实现了原始 issue / PRD / 规格?

两条轴线作为并行子 agent 运行,互不污染彼此的上下文,然后由本技能汇总双方的发现。

Issue 跟踪器应该已经提供给你了。如果 docs/agents/issue-tracker.md 缺失,请告诉用户运行 /setup-matt-pocock-skills

流程

1. 确定固定点

用户说的任何东西都可以作为固定点——commit SHA、分支名、tag、mainHEAD~5 等等。不要随意发挥,直接传入即可。如果用户没有指定,则询问:"以什么为基准进行审查——一个分支、一个 commit、还是 main?" 没有得到答案之前不要继续。

捕获 diff 命令:git diff <fixed-point>...HEAD(三个点,这样比较的是 merge-base)。同时通过 git log <fixed-point>..HEAD --oneline 记录 commit 列表。

在继续之前,确认固定点能解析(git rev-parse <fixed-point>)且 diff 非空。错误的引用或空的 diff 应该在此处失败——不应该让两个并行子 agent 来处理。

2. 确定规格来源

按以下顺序查找原始规格:

  1. commit 消息中的 issue 引用(#123Closes #45、GitLab !67 等)——按照 docs/agents/issue-tracker.md 中的工作流来获取。
  2. 用户作为参数传入的路径。
  3. docs/specs/.scratch/ 下与分支名或功能名匹配的 PRD/规格文件。
  4. 如果什么都没找到,询问用户规格在哪里。如果用户说没有,规格子 agent 将跳过并报告"无可用的规格"。

3. 确定规范来源

仓库中任何记载了代码应如何编写的文档,例如 CODING_STANDARDS.mdCONTRIBUTING.md

除了仓库记录的内容外,规范轴线始终携带下面的气味基线(smell baseline)——一组来自 Fowler《重构》第 3 章的固定代码气味,即使仓库没有任何文档也适用。两条约束规则:

  • 仓库覆盖规范。 已文档化的仓库标准永远优先;如果仓库明确认可了基线的某些判定,则压制该气味。
  • 始终是判断性问题。 每个气味都是带标签的启发式判断("可能的特性依恋"),绝不是一个硬性违反——而且和这里的所有标准一样,跳过工具已强制执行的内容。

每个气味的格式为它是什么如何修复;将其与 diff 匹配:

  • 神秘命名(Mysterious Name)——函数、变量或类型的名称不能揭示其作用或含义。→ 重命名;如果找不到一个诚实的名字,说明设计本身模糊不清。
  • 重复代码(Duplicated Code)——相同的逻辑形态出现在变更中的多个 hunk 或文件里。→ 提取共享形态,从两处调用。
  • 特性依恋(Feature Envy)——方法访问另一个对象的数据比访问自己的更多。→ 将该方法移动到它所依恋的数据上。
  • 数据泥团(Data Clumps)——同一组字段或参数反复结伴出现(一个等待诞生的类型)。→ 将它们打包成一个类型,传递这个类型。
  • 基本类型偏执(Primitive Obsession)——用基本类型或字符串来表示值得拥有自己类型的概念。→ 给该概念一个自己的小类型。
  • 重复 switch(Repeated Switches)——对同一类型反复使用相同的 switch/if 级联。→ 用多态替换,或使用两者共享的一个映射。
  • 霰弹式修改(Shotgun Surgery)——一个逻辑变更迫使 diff 中散落在许多文件中的修改。→ 将一起变更的内容聚集到一个模块中。
  • 发散式变更(Divergent Change)——一个文件或模块因多个无关原因被修改。→ 拆分,使每个模块因单一原因变更。
  • 臆测通用性(Speculative Generality)——为规格中不存在的需求添加的抽象、参数或钩子。→ 删除;内联回去,直到真实需求出现。
  • 消息链(Message Chains)——调用者不应依赖的冗长 a.b().c().d() 导航。→ 将遍历隐藏在第一个对象的一个方法后面。
  • 中间人(Middle Man)——一个类或函数大部分时间只是委托给其他人。→ 砍掉它,直接调用真正的目标。
  • 拒绝遗产(Refused Bequest)——子类或实现者忽略或覆盖了大部分继承的内容。→ 放弃继承,改用组合。

Read the full file on GitHub · 90 lines

Files

What ships with it

1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 8d ago First seen · 90 lines · 109 tokens per session scan A 96fbc4abc216

Subscribe to this mod's changes

code-review is a skill published in the GitHub repository devcxl/mattpocock-skills-zh (318 stars, last pushed 3d ago), licensed MIT. It adds 109 tokens to every session and 1,891 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.