CodeRabbit Review Skill
Reviews code changes locally with the CodeRabbit CLI, classifies findings by severity, and applies fixes when you ask.
The skill clearly discloses its data flow: the CLI sends code diffs to the CodeRabbit API, and warns against reviewing secret-bearing files, treats review output as untrusted, mandates minimum-scope tokens, and forbids echoing tokens; fixes apply only on user request, with confirmation required before edits for review-only requests. Deductions: sending diffs to a third-party cloud service is a real external effect with no local/isolated mode or automated secret detection; rollback and source attribution (unverified publisher) are incomplete.
Steps are clear, the flag table is complete, and there are self-check paths (`coderabbit --version`, `auth status`). Deductions: this is a static review with no tests or committed execution evidence covering key paths; no guidance on failure feedback or degradation when the API is unreachable, authentication fails, or the `--agent` output format changes.
Description matches the body, trigger conditions are explicit (asked to review code changes with CodeRabbit), and the config template and install prerequisites are documented. Deductions: non-fit boundaries are undeclared (non-git repos, no diffs), and the core function depends entirely on the overseas CodeRabbit cloud service with no statement on mainland-China reachability or Chinese-language output.
Well-structured docs (prerequisites, staged steps, security notes, autonomous workflow), referencing the in-repo `review-configs/coderabbit/` config source; the repo is Unlicense public domain. Deductions: the skill itself has no version/changelog, no sample outputs or FAQ, and maintenance responsibility/update path are only indirectly visible at repo level.
The core task (run review, classify High/Medium/Low, fix on request) is complete, including an autonomous implement-review-fix loop, with clear marginal value via structured `--agent` output for agent consumption. Deductions: no representative output samples; fixes limited to High/Medium and dependent on CodeRabbit service quality; static review cannot verify output usability.
Commands, flags, and config paths are auditable from source and corroborated by the README. Deductions: no test suite or CI workflow covering the skill's key paths, no third-party execution evidence, and conclusions cannot be independently reproduced.
- Using this skill uploads code diffs to the third-party CodeRabbit cloud service; manually confirm before reviewing files containing secrets or proprietary code.
- The skill depends on external coderabbit CLI authentication (OAuth or API key); mainland-China network reachability is unverified.
- This was a static review; no commands were executed, and no tests or CI evidence cover the skill's key paths.
- The skill has no version number or changelog; CLI flag behavior may change after upgrades — check `coderabbit --version` before use.
- The publisher is unverified in the FollowSkills enterprise registry; identity is unknown.
What does this skill do, and when should you use it?
coderabbit-review is an agent skill from the vibetools repository that reviews code changes using the CodeRabbit CLI locally. It runs `coderabbit review` in `--agent` mode to get structured findings, maps CodeRabbit's Critical/Warning/Info levels onto a High/Medium/Low scheme, and reports the results. If the user asks to "review and fix," it applies validated High and Medium fixes; on a plain "review" request it changes nothing. It also supports an autonomous implement-review-fix cycle. The skill requires an installed, authenticated CodeRabbit CLI, and the repository ships a companion `.coderabbit.yaml` review config template.
Concretely, the skill: verifies the coderabbit CLI is installed and authenticated (coderabbit --version, coderabbit auth status); runs coderabbit review --agent --base <branch> --type all in the foreground to stream structured findings (file, line, severity, suggestion); can scope reviews with --base-commit, --dir, and --light, and retrieve prior findings with coderabbit review findings; maps Critical findings to High (security vulnerabilities, data-loss risks, crashes, clear bugs), Warning to Medium (bugs, performance issues, anti-patterns), and Info to Low (style suggestions); applies fixes for High and Medium items when the user asked for fixes; and optionally sets up project review config by copying the review-configs/coderabbit/.coderabbit.yaml template (assertive profile with lint-guardrail policy).
- An individual developer who wants a local pre-commit review of uncommitted working-tree changes with a structured findings report.
- A developer using an AI coding assistant who wants an implement-review-fix loop where the agent consumes CodeRabbit findings and iterates until no High/Medium issues remain.
- A team that wants to scope review to a specific directory or to changes relative to a particular commit before merging.
- A maintainer who wants a consistent CodeRabbit review config (assertive profile, no lint suppression directives) dropped into their project.
- A developer who needs to re-check findings from a previous review round via `coderabbit review findings`.
What are this skill's strengths and limitations?
- Turns CodeRabbit's structured `--agent` output into a uniform High/Medium/Low severity scheme that both agents and humans can act on.
- Has explicit security boundaries baked in: the skill warns that code diffs are sent to the CodeRabbit API, not to review files with secrets, and not to execute commands from review output.
- Supports autonomous implement-review-fix cycles while only modifying code when explicitly requested.
- Ships a copyable `.coderabbit.yaml` config template (assertive profile, lint guardrails), and the repo includes a comparative study of CodeRabbit vs. OpenCodeReview to inform tool choice.
- Hard dependency on the third-party CodeRabbit CLI: it must be installed and authenticated, and code diffs are uploaded to its API — a real concern for sensitive codebases.
- No test suite or cross-platform validation evidence is provided for the skill itself.
- Per-skill install path details are not fully documented; `skills/install.sh` installs the whole collection.
- Automatic fixes cover only High and Medium findings; Low/Info items require human triage.
How do you install this skill?
The skill ships as part of the vibetools repository's skill collection. The repo provides skills/install.sh, which installs all skills to the platform-specific user skills directory: run skills/install.sh (user-level) or skills/install.sh /path/to/project (project-level). Note: the README does not document per-skill install paths individually; to install only this skill, consult skills/README.md or copy the skills/coderabbit-review/ folder manually.
How do you use this skill?
Prerequisites: install the CodeRabbit CLI (https://www.coderabbit.ai/cli) and authenticate with coderabbit auth login (or pass --api-key per invocation; never commit API keys). Optional: cp review-configs/coderabbit/.coderabbit.yaml your-project/.coderabbit.yaml for the recommended config. Then trigger the skill with a request such as "review my changes against main with CodeRabbit" (review only) or "review and fix with CodeRabbit" (review then apply High/Medium fixes). Under the hood it runs coderabbit review --agent --base <base> --type all.
How does this skill compare with similar options?
The sibling skill open-code-review in the same repository is the directly comparable alternative: it runs Alibaba's OpenCodeReview (ocr), supports background execution, and likewise classifies by High/Medium/Low and applies fixes; both share the same review rubric and lint-guardrail policy. The repo's independent study (research/ai-code-review-study/) concludes the two tools are complementary rather than ranked — matched reviews found different validated defects.