Open Code Review Skill
Review Git changes with OCR, produce precise line-level findings, and apply fixes when explicitly requested.
The skill reads Git changes and sends code to a configured LLM, and it may modify code when the user explicitly requests fixes. It forbids invented or hardcoded credentials and requires confirmation before fixes, making the basic permission boundary visible. Points are deducted because full data flow, sensitive-code disclosure, third-party endpoint trust boundaries, rollback, and installer review requirements are not explicit.
Prerequisite checks, command mappings, output fields, handling of mispositioned comments, and post-run validation are documented, including stderr inspection. Points are deducted because execution depends on the CLI, LLM configuration, and versioned external components; the environment-variable examples may not align with the newer Provider configuration shown in the repository README. No key-path reproduction was executed, and static calibration caps this at 10.
Invocation scenarios are clear and cover workspace, commit, branch, and PR-style reviews, with defined classification, fixing, and mispositioned-comment handling. Points are deducted because non-fit cases, LLM quality boundaries, privacy constraints, and network reachability are underspecified; the core workflow depends on npm/GitHub and an external LLM, with no mainland-China availability guidance.
The skill has clear prerequisites, a staged workflow, parameter guidance, examples, output format, gotchas, custom-rule documentation, Apache-2.0 licensing, and a version field. Repository context also shows CI, security reporting, and update information. Points are deducted because the relationship between the skill version and package version is unclear, and ownership, changelog, dependency pinning, and troubleshooting coverage are incomplete.
The stated task is actionable code review with line-level, priority-classified comments; command mappings, JSON output, and the opt-in fix workflow are directly useful. Points are deducted because results depend on an external LLM and correctness, completeness, and marginal benefit over manual or alternative review are not verified in the skill. Static calibration caps this at 7.
The skill supplies concrete commands, output fields, validation checks, and documentation references; repository context includes CI, a coverage threshold, and vulnerability scanning. Points are deducted because these materials do not independently reproduce the selected skill's key paths, while quality and performance claims mainly remain project documentation claims. Static calibration caps this at 5.
- Standard mode sends code and business context to the user-configured LLM endpoint; confirm residency, logging, redaction, and provider policies first.
- The legacy OCR_LLM_* examples may not match the current Provider configuration flow; verify the actual CLI version and configuration keys.
- Installation may fetch latest artifacts or execute remote scripts; pin versions, review scripts, and verify checksums or signatures.
- Apply automatic fixes only with explicit authorization, preferably in a recoverable branch or workspace where the diff can be reviewed.
- Reachability and regional compliance for npm, GitHub release sources, and external LLMs are not documented; validate them for mainland-China environments.
What it does & when to use it
Open Code Review is an Agent Skill that invokes Alibaba’s Open Code Review CLI, `ocr`, for AI-assisted code review. It reviews workspace changes, individual commits, or diffs between branches and returns structured, line-level comments. The CLI must be installed and connected to an Anthropic- or OpenAI-compatible LLM before the first review. Findings are classified by priority, and fixes may be applied when the user explicitly requests them.
Checks whether ocr is installed and whether LLM connectivity works; derives concise business context from the review target; runs ocr review --audience agent; supports workspace, commit, branch-range, preview, and custom-rule reviews; reads file paths, line ranges, comments, and optional fix suggestions from the output; reports findings by priority and handles high- and medium-priority fixes when authorized.
- A developer wants to inspect staged, unstaged, and untracked changes before committing.
- A team wants to compare a feature branch with `main` before merging.
- A maintainer needs focused feedback on one specific commit.
- A security or quality owner wants project-specific rules applied to selected file types.
- An automation workflow needs concise, machine-oriented review output for a Git change set.
Pros & cons
- Covers workspace changes, commits, and branch comparisons.
- Produces line-level review comments with optional fix suggestions.
- Supports business context, custom rules, and agent-oriented output.
- Can identify bugs, security vulnerabilities, performance issues, and code-quality concerns.
- Requires the `ocr` CLI and a configured, reachable LLM.
- Large diffs may hit per-request token limits, and diffs over 50 changed lines add a planning phase and latency.
- The provided SKILL.md does not document its own test suite or platform validation results.
- Automatic fixing requires explicit user intent, and complex fixes may still need manual work.
How to install
Install the OCR CLI with npm install -g @alibaba-group/open-code-review. Install the skill in a project with npx skills add alibaba/open-code-review --skill open-code-review. Before the first review, run ocr llm test and configure an Anthropic- or OpenAI-compatible endpoint through environment variables or ocr config; never hardcode API keys.
How to use
With the skill installed, ask an Agent to “review my changes,” “review commit abc123,” or “review this branch against main.” The corresponding commands are ocr review --audience agent, ocr review --audience agent --commit abc123, and ocr review --audience agent --from main --to feature-branch. Add business context with --background, or use ocr review --preview to preview the file scope. Ask explicitly for “review and fix” if code changes are wanted.
Compared to similar skills
The README positions Open Code Review against general-purpose agents such as Claude Code with Skills. Its distinguishing approach is a deterministic-pipeline and Agent hybrid, intended to reduce incomplete coverage and position drift while favoring precision over recall.