Borrowing it
Nothing to install: this file belongs to ZhuoZhuoCrayon/ai-workspace. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/ZhuoZhuoCrayon/ai-workspace/main/.agents/skills/code-review/SKILL.mdgit clone --depth 1 https://github.com/ZhuoZhuoCrayon/ai-workspaceWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/zhuozhuocrayon/ai-workspace/code-review)<a href="https://agentmods.dev/skills/zhuozhuocrayon/ai-workspace/code-review"><img src="https://agentmods.dev/badge/skills/zhuozhuocrayon/ai-workspace/code-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/zhuozhuocrayon/ai-workspace/code-review"><img src="https://agentmods.dev/badge/skills/zhuozhuocrayon/ai-workspace/code-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00143 | $0.03152 |
| Opus 5 | $0.00072 | $0.01576 |
| Sonnet 5 | $0.00029 | $0.00630 |
| Haiku 4.5 | $0.00014 | $0.00315 |
Grade A, and why
code-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 234 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Code Review
0x01 定位
code-review 负责审查 PR 或代码变更的正确性、兼容性、可维护性与发布风险。
默认只在对话中输出 review 草稿，不发布到 PR。
GitHub 写操作必须得到用户明确授权，包括评论、approve、request changes 和 dismiss review。
唯一例外：用户触发 review 后，针对已确认修复的既有未解决 review thread，可以自动 resolve。
0x02 权限门禁
a. GitHub 写操作
用户明确说以下意图时，才执行对应 GitHub 写操作：
| 用户意图 | 动作 |
|---|---|
评论到 PR / 发 review / 发到 PR |
发布对应 inline / conversation 评论。 |
Request Changes / 请求修改 |
存在 P0 或阻塞合入问题时执行 request changes。 |
Approve / 通过 |
先输出复查结论，再执行 approve，默认 approve body 为 LGTM。 |
授权模糊时必须先确认，不得猜测执行。
b. Assignees
PR review 场景开始前必须补齐 assignees，未完成前不得继续 review 或执行 GitHub 写操作。
gh api user --jq .login获取当前登录用户。gh pr view <pr> --json author --jq .author.login获取 PR 作者。- 去重后执行
gh pr edit <pr> --add-assignee <login>。 - 执行
gh pr view <pr> --json assignees --jq '.assignees[].login'校验。
失败时停止并告知用户，等待用户决策后再继续。
0x03 上下文收集
开始审查前，必须同时建立项目规范、变更内容和历史评论三类上下文。
| 上下文 | 要求 |
|---|---|
| 项目定位 | 目标项目已知时，先按工作区项目定位规则进入项目 local_path。 |
| 项目规范 | 优先读取目标仓库 AGENTS.md，再按项目类型读取 pyproject.toml、package.json、go.mod、lint / typecheck 配置等。 |
| 变更内容 | 查看 PR diff、本地 diff、相关源码、测试和配置变更。 |
| 历史评论 | 查看已有评论、未解决 review threads，以及用户要求复查的旧问题。 |
| 关联方案 | 用户以方案文档作为需求文档时，完整读取该 issue 目录的 README.md（需求）与 PLAN.md（方案）而非只读片段，据此建立需求基线、PR ↔ 里程碑映射与方案一致性基线。 |
不要只看 diff 片段就下结论。
0x04 审查重心
优先关注会影响合入安全的问题，再评估长期可维护性。
a. 合入安全
| 重心 | 审查问题 |
|---|---|
| 向前兼容 | 未明确声明 breaking change 时，默认按非破坏性改动审查，重点检查既有调用方、配置、数据、API 和行为兼容性。 |
| 正确性 | 优先找会导致错误结果、异常、数据损坏、安全风险或发布回滚的问题。 |
| 测试覆盖 | 检查变更是否覆盖关键路径、兼容场景、失败路径和回归风险。 |
| 方案一致性 | review 关联方案时核对 PR 实现与方案约定的架构、协议、落点与边界是否一致：偏离若是实现缺陷按 P1 提出并指出对应方案条目，若是实现更优或方案已过期则记录差异并进入方案回写（见 0x09 方案回写）。 |
b. 可维护性
| 重心 | 审查问题 |
|---|---|
| 命名与可读性 | 检查命名规范、代码格式、局部复杂度、注释必要性和项目风格一致性。 |
| 简洁实现 | 发现重复、绕路或过度复杂实现时，建议更简洁、可读的方案。 |
| 抽象设计 | 代码已出现扩展苗头时，评估是否需要合适的抽象或设计模式，不为假想扩展过早设计。 |
0x05 输出草稿
用户说 review、复查、代码审查 等时，先输出对话草稿报告。
报告固定包含：
汇总评论：整体结论、风险点、是否建议合入。新增问题：本轮新发现的问题，按 P0 / P1 / P2 排序。已存在未解决 review 线程的解决情况：用表格输出。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 234 lines · 143 tokens per session scan A 7a3fe35d8110
code-review is a skill published in the GitHub repository ZhuoZhuoCrayon/ai-workspace (27 stars, last pushed 2d ago), licensed MIT. It adds 143 tokens to every session and 3,152 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
autoreview
Pre-commit/ship code review: Codex default; optional Claude or Pi.
rework-rate
Measure and interpret PR rework rate — the emerging 5th DORA metric.
omh-code-review
This is a Hermes-native code-review workflow skill.
revdiff-plan
Review the last Codex assistant message (plan, analysis, or proposal) with inline annotations in a TUI overlay. Extracts the most recent response from Codex rollout files and opens it in revdiff for review and annotation. Activates on "revdiff-plan", "review plan with revdiff", "annotate plan", "review last response"…
code-reviewer
Code review specialist focused on patterns, bugs, security, and performance.
agent-teams-simplify-and-harden
Implementation + audit loop using parallel agent teams with structured simplify, harden, and document passes. Spawns implementation agents to do the work, then audit agents to find complexity, security gaps, and spec deviations, then loops until code compiles cleanly, all tests pass, and auditors find zero issues or…