Open Code Review Skill
Lets an AI agent run OpenCodeReview code reviews in the background, triage findings by severity, and apply fixes safely.
The skill invokes one known npm CLI, is user-request driven, asks before modifying code, and runs locally with a limited permission surface; however, code diffs are sent to an external LLM provider with incomplete data-flow disclosure (telemetry exists but is unexplained), no rollback guidance, and the publisher is unverified. Deducted for external data-flow disclosure and missing recovery path.
Instructions are self-consistent with a clear pipeline (preview, background run, poll, classify, fix) and concrete mitigations for a known watchdog/buffering failure plus session-log troubleshooting; good failure feedback. But everything hinges on installable ocr and a configured LLM provider, with no test evidence and thin handling of installation/provider failure. Static cap is 10; deducted for unverified dependency availability and weak abnormal-input handling.
Trigger condition is clear (asked to review code changes) with a defined scenario and stated prerequisites; but capability boundaries (e.g., git-diff-only) are undeclared, there is no Chinese-language note, and ocr plus its LLM backend depend on overseas services, raising mainland-China reachability concerns. Deducted for incomplete boundary declaration and undisclosed overseas-service dependency.
Well-layered structure (prerequisites, steps, notes), references in-repo review-configs/ocr/ as the config source, Unlicense (public domain), and repo-level issue tracking; but the skill itself has no version/changelog and maintenance responsibility is unclear with an unverified publisher. Deducted for missing version governance and unclear ownership.
Encodes a real, non-trivial workflow (background execution to survive a watchdog, severity classification, opt-in fixes) with clear marginal value over manual agent use; but output quality depends entirely on the ocr backend and no representative-output evidence exists. Static cap 7; deducted for unverified output usability and thin alternatives comparison.
Key commands and config paths are auditable and cross-referenced against in-repo review-configs/ocr/, with an indirectly corroborating published AI-review study in the repo; but no tests or CI cover the skill path and no third-party execution evidence exists. Static cap 5; deducted for lack of reproducible execution evidence for core behavior.
- Code diffs are sent to an external LLM provider configured via the ocr CLI; users with sensitive/proprietary code should review telemetry and data-flow settings first.
- Depends on the @alibaba-group/open-code-review npm package and a working LLM provider; install path unverified, and the CLI/LLM backend may be unreachable from mainland-China networks.
- The skill has no version number or changelog; behavior may change with repo updates. Publisher identity is unverified.
- All conclusions are from static source reading; no commands were executed.
What does this skill do, and when should you use it?
open-code-review is an agent skill from the vibetools repository that instructs an agent how to review code changes using Alibaba's ocr CLI. It solves two concrete, real problems: ocr buffers all output under --audience agent until completion, so foreground runs get killed by the shell's ~2-minute process watchdog; and ocr excludes test files by default. The skill mandates previewing the review scope first, launching detached with nohup and a 20-minute timeout floor, polling until done, then classifying findings as High/Medium/Low and applying fixes only when the user asks. The repository is Unlicensed (public domain) and bundles a senior-engineer review rubric config alongside the skill.
1) Verifies prerequisites: installs the ocr CLI (npm i -g @alibaba-group/open-code-review) and confirms the LLM provider with ocr llm test; optionally copies review-configs/ocr/rule. to ~/.opencodereview/rule. to include test files and apply the review rubric. 2) Previews which files will be reviewed instantly via ocr review --preview --from <base> --to <head>. 3) Launches ocr review --audience agent --timeout 20 detached with nohup, redirecting output to /tmp/ocr_review.log and polling the PID roughly every 90 seconds. 4) Once done, reads the log (or uses --format for structured findings) and classifies findings into High (clear bugs, security issues), Medium (maintainability, edge cases), and Low (likely false positives, style). 5) If the user asked to "review and fix", applies safe High/Medium fixes directly; if only "review" was requested, asks before changing anything. Runs exceeding ~25 minutes with no output are treated as hung, with findings recoverable from .l session logs in ~/.opencodereview/sessions/.
- Having an agent review a feature branch's diff against a base (--from/--to) and summarize triaged findings in a git workflow
- Teams that require test files to be reviewed: re-include *.test.* / __tests__ via the global rule.
- Autonomous review-and-fix loops where the agent applies only clear, safe High/Medium fixes
- Full-directory scans outside a diff (ocr scan --path), honoring the same global rule
- Recovering findings from session logs after a review run is interrupted and stdout is lost
What are this skill's strengths and limitations?
- Explicitly avoids two real pitfalls: foreground runs killed by the ~2-minute watchdog (losing all buffered output) and ocr's default exclusion of test files
- Enforces a 20-minute timeout floor with a ~25-minute total patience cap and a session-log recovery path — concrete failure-mode handling
- Findings are triaged High/Medium/Low, and user intent is respected: no code changes unless fixes were requested
- Clear rule precedence: --rule > project .opencodereview > global rule. > built-in
- Comes from a repo with a published AI code-review study, and review-configs provides the matching senior-engineer rubric
- Hard dependency on the Alibaba OpenCodeReview CLI and a configured LLM provider; switching review engines requires rewriting the workflow
- Slow by design: each run uses at least a 20-minute timeout floor, with up to ~25 minutes of total waiting
- No dedicated test suite for the skill; repo Topics are empty and the README notes areas still under construction (e.g. tracked by #15)
- The Unlicense provides no warranty whatsoever
- Covers only the ocr workflow; the CodeRabbit flow is a sibling skill in the same repo and is not included here
How do you install this skill?
1) Install the skill collection: skills/install.sh for the platform-specific user skills dir, or skills/install.sh /path/to/project for a project. 2) Install the ocr CLI: npm i -g @alibaba-group/open-code-review. 3) Verify the LLM provider with ocr llm test. 4) Recommended: mkdir -p ~/.opencodereview && cp review-configs/ocr/rule. ~/.opencodereview/rule. for the global review rubric. The SKILL.md does not document per-platform discovery paths itself.
How do you use this skill?
Prompt the agent with a trigger such as: "Review the code changes from main to HEAD". The skill previews scope with ocr review --preview --from <base> --to <head>, then runs nohup ocr review --audience agent --timeout 20 --from <base> --to <head> > /tmp/ocr_review.log 2>&1 & in the background with polling, and finally delivers a High/Medium/Low triaged report. Add "review and fix" to the prompt to authorize fixes. Use --format for structured output.
How does this skill compare with similar options?
The sibling skills/coderabbit-review/ in the same repo is the direct alternative: it runs the CodeRabbit CLI instead of ocr and supports autonomous implement-review-fix cycles. The repo's review-configs/ provides configs for both, and its research concludes the tools are complementary rather than ranked — matched reviews found different validated defects.