Open Code Review Skill
Review Git changes with OCR, produce precise line-level findings, and apply fixes when explicitly requested.
Data flow is clearly disclosed: SKILL.md explicitly states code diffs are sent to the user-configured LLM (Anthropic/OpenAI-compatible), requires user consent before applying fixes, never invents API keys, and asks before upgrading/installing. Repo has SECURITY.md (signing, vulnerability response) and govulncheck in CI. Deductions: silent global npm install with postinstall binary download, code/context sent to third-party LLMs by default with no minimization/redaction options, no rollback guidance; permission/confirmation mechanisms incomplete so not full marks.
High internal consistency: argument semantics, timeout model, concurrency, output mode, degraded path for mispositioned comments (start_line/end_line=0) are all handled; failures route to Troubleshooting instead of blind retries. Real CI exists (unit tests, 90% coverage gate, smoke tests) but covers the Go CLI, not the SKILL.md orchestration. Static review cannot execute; key paths not reproduced; cap below 10 with 1 point off because the skill-layer orchestration (e.g. --background context extraction) has no test evidence.
Triggers are clear (review code/PR/staged changes/commit/branch diff), --preview dry-run exists, boundaries reasonably stated, default Chinese output suits FollowSkills users. Deductions: core function entirely depends on overseas Anthropic/OpenAI-compatible APIs with mainland-China reachability risk not disclosed in the skill itself (delegate mode exists in README but is absent from SKILL.md); non-fit scope (non-Git repos) only partially covered.
Good layering: frontmatter metadata, Workflow, Gotchas, Validation, Troubleshooting, References; version 1.0.0, Apache-2.0, author and homepage declared. Deductions: signs of drift between SKILL.md and repo README (hardcoded claude-opus-4-6 example, pinned v1.10.0 threshold), no changelog or known-limitations list, maintenance ownership only at org level.
Target output (line-level structured comments with severity/category) is fully specified and directly presentable; comparative benefit backed by README benchmark data (precision/F1, ~1/9 tokens). Deductions: static review cannot verify actual output quality; the benchmark targets the CLI not this skill orchestration; value claims not independently reproduced, capped at 7.
Multiple auditable materials exist: LICENSE, SECURITY.md, govulncheck + 90% coverage CI, action contract tests, OpenSSF Gold badge, public Hugging Face benchmark dataset. However these cover the CLI and repo governance; SKILL.md-specific instructions (--audience agent behavior, rule. precedence) are only corroborated by documentation, not execution, so capped at 5.
- This is a static source review; no commands were executed and actual runtime quality is not reproduction-verified.
- The skill sends code diffs and business context to a user-configured third-party LLM; verify compliance before reviewing sensitive or proprietary code and check for redaction options.
- Installation involves a global npm install with a postinstall binary download; verify checksums (GitHub Artifact Attestations and sha256sum are provided).
- Core function depends on Anthropic/OpenAI-compatible APIs; mainland-China network reachability must be confirmed independently; the delegate mode in the README may be an alternative but is not referenced by the skill itself.
- SKILL.md contains hardcoded examples (claude-opus-4-6, v1.10.0 version threshold); defer to the latest official documentation before use.
What does this skill do, and when should you use it?
Open Code Review is an Agent Skill that invokes Alibaba’s Open Code Review CLI, `ocr`, for AI-assisted code review. It reviews workspace changes, individual commits, or diffs between branches and returns structured, line-level comments. The CLI must be installed and connected to an Anthropic- or OpenAI-compatible LLM before the first review. Findings are classified by priority, and fixes may be applied when the user explicitly requests them.
Checks whether ocr is installed and whether LLM connectivity works; derives concise business context from the review target; runs ocr review --audience agent; supports workspace, commit, branch-range, preview, and custom-rule reviews; reads file paths, line ranges, comments, and optional fix suggestions from the output; reports findings by priority and handles high- and medium-priority fixes when authorized.
- A developer wants to inspect staged, unstaged, and untracked changes before committing.
- A team wants to compare a feature branch with `main` before merging.
- A maintainer needs focused feedback on one specific commit.
- A security or quality owner wants project-specific rules applied to selected file types.
- An automation workflow needs concise, machine-oriented review output for a Git change set.
What are this skill's strengths and limitations?
- Covers workspace changes, commits, and branch comparisons.
- Produces line-level review comments with optional fix suggestions.
- Supports business context, custom rules, and agent-oriented output.
- Can identify bugs, security vulnerabilities, performance issues, and code-quality concerns.
- Requires the `ocr` CLI and a configured, reachable LLM.
- Large diffs may hit per-request token limits, and diffs over 50 changed lines add a planning phase and latency.
- The provided SKILL.md does not document its own test suite or platform validation results.
- Automatic fixing requires explicit user intent, and complex fixes may still need manual work.
How do you install this skill?
Install the OCR CLI with npm install -g @alibaba-group/open-code-review. Install the skill in a project with npx skills add alibaba/open-code-review --skill open-code-review. Before the first review, run ocr llm test and configure an Anthropic- or OpenAI-compatible endpoint through environment variables or ocr config; never hardcode API keys.
How do you use this skill?
With the skill installed, ask an Agent to “review my changes,” “review commit abc123,” or “review this branch against main.” The corresponding commands are ocr review --audience agent, ocr review --audience agent --commit abc123, and ocr review --audience agent --from main --to feature-branch. Add business context with --background, or use ocr review --preview to preview the file scope. Ask explicitly for “review and fix” if code changes are wanted.
How does this skill compare with similar options?
The README positions Open Code Review against general-purpose agents such as Claude Code with Skills. Its distinguishing approach is a deterministic-pipeline and Agent hybrid, intended to reduce incomplete coverage and position drift while favoring precision over recall.