Borrowing it
Nothing to install: this file belongs to ZhuoZhuoCrayon/ai-workspace. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/ZhuoZhuoCrayon/ai-workspace/main/.agents/skills/code-review/SKILL.mdgit clone --depth 1 https://github.com/ZhuoZhuoCrayon/ai-workspaceWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/zhuozhuocrayon/ai-workspace/code-review)<a href="https://agentmods.dev/skills/zhuozhuocrayon/ai-workspace/code-review"><img src="https://agentmods.dev/badge/skills/zhuozhuocrayon/ai-workspace/code-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/zhuozhuocrayon/ai-workspace/code-review"><img src="https://agentmods.dev/badge/skills/zhuozhuocrayon/ai-workspace/code-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00211 | $0.04766 |
| Opus 5.5 | $0.00084 | $0.01906 |
| Sonnet 5.5 | $0.00042 | $0.00953 |
| Haiku 4.5 | $0.00021 | $0.00477 |
Grade A, and why
code-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 362 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Code Review
0x01 定位
code-review 负责审查 PR 或代码变更的正确性、兼容性、可维护性与发布风险。
默认只在对话中输出 review 草稿，不发布到 PR。
GitHub 写操作必须得到用户明确授权，包括评论、approve、request changes 和 dismiss review。
唯一例外：用户触发 review 后，针对已确认修复的既有未解决 review thread，可以自动 resolve。
0x02 权限门禁
a. GitHub 写操作
用户明确说以下意图时，才执行对应 GitHub 写操作：
| 用户意图 | 动作 |
|---|---|
评论到 PR / 发 review / 发到 PR |
发布对应 inline / conversation 评论。 |
Request Changes / 请求修改 |
存在 P0 或阻塞合入问题时执行 request changes。 |
Approve / 通过 |
先输出复查结论，再执行 approve，默认 approve body 为 LGTM。 |
授权模糊时必须先确认，不得猜测执行。
b. Assignees
PR review 场景开始前必须补齐 assignees，未完成前不得继续 review 或执行 GitHub 写操作。
gh api user --jq .login获取当前登录用户。gh pr view <pr> --json author --jq .author.login获取 PR 作者。- 去重后执行
gh pr edit <pr> --add-assignee <login>。 - 执行
gh pr view <pr> --json assignees --jq '.assignees[].login'校验。
失败时停止并告知用户，等待用户决策后再继续。
0x03 上下文收集
审查前备齐项目材料、变更、历史评论和关联方案。结论不得只依据 diff 片段。
a. 项目与变更
| 材料 | 动作 |
|---|---|
| 项目定位 | 目标项目已知时，按工作区项目定位规则进入项目目录 |
| 项目规范 | 阅读 AGENTS.md，再按语言阅读 pyproject.toml、package.json、go.mod 与 lint / typecheck 配置 |
| 变更内容 | 阅读 PR diff 或本地 diff，并打开相关源码、测试与配置。内容回查使用该 diff |
| 历史评论 | 阅读已有评论、未解决 review threads，以及用户点名复查的旧问题 |
b. 检索范围
关联方案只在已定位项目的知识库内检索。<name> 取 repos.json / private/repos.json 的项目 name。
| 检索根 | 缺失时 |
|---|---|
knowledge/<name>/issues/ |
跳过该根 |
private/knowledge/<name>/issues/ |
跳过该根 |
检索键不使用 PR 标题，也不从标题或分支拆取 story、bug 编号。
| 条件 | 处理 |
|---|---|
用户给出 issue 目录或 PLAN.md |
采用该路径 [1] |
| 方案声明为背景 | 仍检索 [2] |
- [1] 身份键或内容关键词指向其他方案时，不改绑。
- [2] 汇总评论写明路径。不建立一致性基线，不进入方案回写。
c. 已回写方案
以 PR 编号检索 pull/<number>，按 issue 目录聚合。
rg -n "pull/<number>" knowledge/<name>/issues private/knowledge/<name>/issues
| 命中目录数 | 绑定 | 内容回查 |
|---|---|---|
1 |
该目录。信号为「PR 编号」 | 跳过 |
>1 |
否 | 停止，转入 e. 未绑定 |
0 |
否 | 继续 [1] |
- [1] 未命中表示版本锚点尚未写入该 PR。
d. 内容回查
检索词为一级目录与高频名称。计分见 e. 命中判定。不按语言维护文件名清单。
（1）一级目录
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago Changed · +12 lines db6f582c0ff3
- 14d ago Changed · +102 lines · +65 tokens per session c62919c02a5c
- 18d ago Changed · +14 lines · +3 tokens per session 083fa8e86162
- 2mo ago First seen · 234 lines · 143 tokens per session scan A 7a3fe35d8110
code-review is a skill published in the GitHub repository ZhuoZhuoCrayon/ai-workspace (27 stars, last pushed today), licensed MIT. It adds 211 tokens to every session and 4,766 once invoked, about $0.0008 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
autoreview
Structured code review through the shared OpenClaw agent-skills installation.
omh-code-review
This is an OMH code-review workflow skill, projected for Agent Skills hosts (Claude Code, Codex, Cursor, opencode, OpenClaw, pi).
revdiff-plan
Review the last Codex assistant message (plan, analysis, or proposal) with inline annotations in a TUI overlay. Extracts the most recent response from Codex rollout files and opens it in revdiff for review and annotation. Activates on "revdiff-plan", "review plan with revdiff", "annotate plan", "review last response"…
explore-unknowns
Guide the user through a quadrant walk that maps the unknowns of a task — open by listing the known knowns, then work through known unknowns, unknown knowns, and unknown unknowns one stage at a time, ending with a complete four-quadrant map in the user's hands. Use when a request is ambiguous or underspecified, the…
re0-merge
Review and land an external contribution the way this suite does: gate it against the thesis, land it with the author's credit intact, complete a new skill rather than merging it raw, then approve, credit, and explain before closing. Use when reviewing a pull request, as any collaborator or maintainer, not only the…
asplos-writing-style
Use when drafting or revising ASPLOS prose — engineering the first two pages that rapid review actually reads, stating the cross-layer insight as one quotable sentence, structuring per-layer mechanism sections, writing bounded claims, and fitting everything into 11 self-contained pages that include figures and…