What does this skill do, and when should you use it?
This is an agent skill inside the vibetools repository that teaches an AI agent how to drive Alibaba's OpenCodeReview (ocr) CLI to review code changes correctly. It encodes hard-won operational discipline: preview the review scope first, launch the review as a detached background process with a 20-minute timeout floor, and poll with short tool calls rather than running in the foreground, where the shell's ~2-minute watchdog kills the process and loses all buffered output. Once results arrive, the skill classifies findings as High/Medium/Low, reports them, and applies High and Medium fixes when the user explicitly asked for fixes. A global rule. from the repo's review-configs pulls test files into the review and applies a senior-engineer rubric.
- Runs
ocr review --previewto instantly confirm which files (including tests) will be reviewed. - Launches
ocr review --audience agent --timeout 20detached vianohup, logging to /tmp/ocr_review.log. - Polls with
ps -p $PIDevery ~90 seconds until done, then reads the log; treats >~25-minute silent runs as hung and checks~/.opencodereview/sessions/JSONL logs. - Groups review comments into High (clear bugs/security), Medium (maintainability/edge cases), and Low (likely false positives/style) buckets.
- Applies safe High and Medium fixes directly when the user asked for "review and fix"; asks before changing anything on a review-only request.
- Verifies the LLM provider with
ocr llm testand optionally installs a global review rule so test files are included.
- A developer about to open a PR who wants a fully automated AI review of the `--from <base> --to <head>` diff with a severity-ranked report.
- A team maintainer who wants test files included in reviews, since ocr excludes them by default — fixed by installing the global rule..
- Engineers on agent platforms like Claude Code, LLxprt Code, or Gemini CLI who need a runbook that avoids ocr's foreground-timeout failure mode.
- An author who says "fix the high and medium issues" after a review, letting the agent apply those fixes safely.
- A reviewer handling a very large changeset who raises `--timeout` to 30 while still running in the background.
- Environments without the ocr CLI and a configured LLM provider — these are hard prerequisites.
- Sandboxed execution environments that cannot run long-lived background processes or read `~/.opencodereview/`.
- Fully offline review workflows — ocr requires a networked LLM provider to produce findings.
How do you install this skill?
- Code diffs are sent to an external LLM provider configured via the ocr CLI; users with sensitive/proprietary code should review telemetry and data-flow settings first.
- Depends on the @alibaba-group/open-code-review npm package and a working LLM provider; install path unverified, and the CLI/LLM backend may be unreachable from mainland-China networks.
- The skill has no version number or changelog; behavior may change with repo updates. Publisher identity is unverified.
- All conclusions are from static source reading; no commands were executed.
- Shell / CLI
- Network access
- Local filesystem
ocr CLI (npm i -g @alibaba-group/open-code-review)configured LLM provider for ocr
This skill ships in the skills/ directory of the vibetools repo as a SKILL.md. Claude Code / LLxprt Code / Gemini CLI: use the repo's bundled installer (the README states it installs to the platform's user skills dir; exact per-platform paths are not documented here):
git clone https://github.com/acoliver/vibetools
skills/install.sh
Or install into a specific project:
skills/install.sh /path/to/project
Also install the ocr CLI and (recommended) the global review rule:
npm i -g @alibaba-group/open-code-review
mkdir -p ~/.opencodereview
cp review-configs/ocr/rule. ~/.opencodereview/rule.
tmp="$(mktemp -d)"
git clone --depth 1 https://github.com/acoliver/vibetools.git "$tmp"
mkdir -p ~/.claude/skills
cp -R "$tmp/skills/open-code-review" ~/.claude/skills/
rm -rf "$tmp"Generated from the source repository and skill path; it copies only this skill's folder. If the author's install steps above differ, follow those first. To scope it to one project, replace ~/.claude/skills with that project's .claude/skills.
How do you use this skill?
Once installed, send your agent any of these to trigger it:
- Review my latest changes on the main branch with ocr and give me a severity-ranked report.
- Review and fix the diff between feature/auth and develop; go ahead and apply high and medium fixes.
- Run --preview first to see which files will be reviewed and confirm test files aren't excluded, then run the full review.
- This changeset is huge — run the review in the background with a 30-minute timeout and summarize all findings when done.
The skill triggers when the user asks the agent to review code changes. Flow: preview scope with --preview; run the review detached in the background and poll the log; classify and report findings by severity. Options worth knowing: --timeout 20 (floor, do not lower), --format for structured findings (file, line, severity, suggestion), --rule <file> for ad-hoc test inclusion or rule override, and ocr scan --path <dir> for full-file review without a diff. Rule priority is --rule > <repo>/.opencodereview/rule. > ~/.opencodereview/rule. > built-in. On a review-only request the agent asks before changing anything; on "review and fix" it applies safe High and Medium fixes directly.
What are this skill's strengths and limitations?
- Explicitly avoids ocr's known failure mode under `--audience agent`, where a foreground run is killed by the ~2-minute shell watchdog and all buffered output is lost.
- Enforces a 20-minute timeout floor and provides a concrete hang-investigation path via session JSONL logs.
- Includes test files and a senior-engineer rubric via the global rule., closing the gap left by ocr's default test exclusion.
- Clear three-tier severity triage: High/Medium are fixable, Low is evaluated case by case rather than discarded outright.
- Hard dependency on the ocr CLI and a configured LLM provider, with no alternative backend offered.
- The background-plus-polling flow can occupy up to ~25 minutes of wall time, which is slow interactively.
- Fixes cover only High and Medium findings, and only when judged safe — unsafe fixes are merely described.
- No evidence of an automated test suite for the skill itself; its correctness rests on documented procedure rather than validation.
How does this skill compare with similar options?
Side by side with related skills; every score comes from the same FSRS standard.
| Skill | FS score | Stars | Last updated | License |
|---|---|---|---|---|
| Open Code Review this page | 50 · Use with care | ★ 35 | 2mo ago | Unlicense |
| CodeRabbit Review Skill | 53 · Use with care | ★ 35 | 2mo ago | Unlicense |
| Move Code Quality Checker | 54 · Use with care | ★ 23 | 1y ago | MIT |
| Open Code Review — AI Code Quality Gate | 46 · Use with care | ★ 40 | 6mo ago | NOASSERTION |
| OpenCodeReview Code Review Skill | Not yet reviewed | ★ 47k | 11d ago | Apache-2.0 |
The sibling coderabbit-review skill in the same repo is the closest alternative: it runs the CodeRabbit CLI locally with --agent structured findings and supports autonomous implement-review-fix cycles, while this skill is built on Alibaba's OpenCodeReview. The repo's review-configs ship templates for both, and its published research study concludes complementarity rather than ranking — matched reviews found different validated defects.
How did FollowSkills review this skill?
The skill invokes one known npm CLI, is user-request driven, asks before modifying code, and runs locally with a limited permission surface; however, code diffs are sent to an external LLM provider with incomplete data-flow disclosure (telemetry exists but is unexplained), no rollback guidance, and the publisher is unverified. Deducted for external data-flow disclosure and missing recovery path.
Instructions are self-consistent with a clear pipeline (preview, background run, poll, classify, fix) and concrete mitigations for a known watchdog/buffering failure plus session-log troubleshooting; good failure feedback. But everything hinges on installable ocr and a configured LLM provider, with no test evidence and thin handling of installation/provider failure. Static cap is 10; deducted for unverified dependency availability and weak abnormal-input handling.
Trigger condition is clear (asked to review code changes) with a defined scenario and stated prerequisites; but capability boundaries (e.g., git-diff-only) are undeclared, there is no Chinese-language note, and ocr plus its LLM backend depend on overseas services, raising mainland-China reachability concerns. Deducted for incomplete boundary declaration and undisclosed overseas-service dependency.
Well-layered structure (prerequisites, steps, notes), references in-repo review-configs/ocr/ as the config source, Unlicense (public domain), and repo-level issue tracking; but the skill itself has no version/changelog and maintenance responsibility is unclear with an unverified publisher. Deducted for missing version governance and unclear ownership.
Encodes a real, non-trivial workflow (background execution to survive a watchdog, severity classification, opt-in fixes) with clear marginal value over manual agent use; but output quality depends entirely on the ocr backend and no representative-output evidence exists. Static cap 7; deducted for unverified output usability and thin alternatives comparison.
Key commands and config paths are auditable and cross-referenced against in-repo review-configs/ocr/, with an indirectly corroborating published AI-review study in the repo; but no tests or CI cover the skill path and no third-party execution evidence exists. Static cap 5; deducted for lack of reproducible execution evidence for core behavior.
Open a dimension to read why it scored that way
Evidence confidence：Low — Mostly static review, author material or a limited demo; useful for discovery, not high-risk decisions.
See the full review method →