Pull Request Code Review
Orchestrate a final pull request review and consolidate every actionable finding from specialized reviewers.
The skill requires subagents and passing full skill paths, and it forbids GitHub comments unless explicitly requested, providing some scope control. However, automatically adding the code-reviewed label is an external state change without user confirmation, permission boundaries, data-flow disclosure, or rollback guidance; sensitive-code and credential handling are also unspecified, so points are deducted.
The main flow and output requirements are understandable, but availability of all code-review-* skills, subagents, and GitHub context is assumed rather than defined. There is no handling or diagnostic feedback for missing skills, subagent failures, malformed inputs, duplicate findings, or partial completion. Static review without reproducible tests limits the score.
The target scenario is clear: final review of a pull request with itemized findings. However, trigger conditions, input format, no-applicable-skill behavior, non-fit boundaries, and environment requirements are absent. Chinese-language output and mainland-China reachability are not addressed, limiting semantic and environmental fit.
The YAML metadata is concise and the body specifies finding format, paths, and line numbers. It lacks installation or dependency notes, parameter contracts, examples, FAQs, known limitations, versioning, changelog, and maintenance ownership. Repository-level Apache-2.0 licensing and OpenAI provenance provide governance context but are not documented in the skill itself.
The skill defines an intended deliverable that aggregates every subagent finding with file paths and line numbers, so it could complete the core review task. Yet the required subskills, review coverage, and representative outputs are not verified in the file; unlimited findings and raw Markdown can also make the result unwieldy and still require human review.
The file specifies auditable output fields, but contains no test suite, CI evidence, example results, or third-party reproduction proving orchestration, label conditions, or finding completeness. Only limited static verifiability is supported.
- Adding a GitHub label changes external state; confirm authorization, user intent, and rollback behavior before applying it.
- The skill depends on code-review-* subskills that are neither defined nor verified in this file; missing or failed dependencies may prevent completion without a clear diagnostic protocol.
- “Every single issue” and “unlimited” findings lack deduplication, prioritization, and size controls, risking unwieldy output.
What it does & when to use it
This skill runs a final code review on a pull request. It invokes every code-review-* skill except itself, assigning one subagent to each skill. It must return all findings from all subagents, with a specific file path and line number for every finding. When the reviewing GitHub user owns the pull request, it adds the code-reviewed label. It does not post GitHub comments unless explicitly asked.
Coordinates one subagent per other code-review-* skill; passes each subagent the full skill path; reviews pull request code; collects every finding; returns numbered findings in raw Markdown; attaches a specific file path and line number to each finding; adds the code-reviewed label when the reviewer is the pull request owner.
- A maintainer wants a final review before merging a pull request.
- A team wants to consolidate findings from multiple specialized code-review skills.
- A reviewer needs every issue tied to an exact file and line number.
- A repository wants an automatic code-reviewed label when the pull request owner runs the review.
Pros & cons
- Includes findings from every other code-review-* skill.
- Requires each finding to identify a file path and line number.
- Allows an unlimited number of findings.
- Avoids posting GitHub comments by default.
- It depends on other code-review-* skills, which the source neither enumerates nor explains how to install.
- The source does not document failure handling, review ordering, or an exact trigger syntax.
- The label operation requires GitHub access, but required permissions and authentication are undocumented.
- The output is raw Markdown rather than structured JSON.
How to install
This skill is part of the skill collection in the openai/codex repository. The source does not document a separate installation or copying procedure for this skill. Codex CLI can be installed with npm install -g @openai/codex; then run codex.
How to use
Run codex and ask it to perform a final code review on a specified pull request, for example: “Run a final code review on this pull request and return every finding.” The source does not define a more specific trigger syntax or explain how to configure or provide the other code-review-* skills.