What does this skill do, and when should you use it?
This skill wires the CodeRabbit command-line tool into an agent workflow. It runs `coderabbit review --agent` in the foreground to get structured findings (file, line, severity, suggestion), maps CodeRabbit's Critical/Warning/Info levels onto a unified High/Medium/Low severity scheme, and applies fixes for High and Medium findings when the user explicitly asks. It also supports an optional autonomous loop: implement, review, fix, re-verify. Prerequisites are an installed and authenticated CodeRabbit CLI, and code diffs are sent to the CodeRabbit cloud API.
- Runs
coderabbit review --agent --base <branch>to produce structured findings - Supports scope flags --type all|committed|uncommitted, --dir, --base-commit, --light, plus
coderabbit review findingsfor prior results - Maps Critical/Warning/Info to High/Medium/Low and reports them
- Applies fixes for High and Medium findings only when the user requested fixing
- Runs an implement→review→fix→re-verify autonomous loop until only Info-level issues remain
- Reads the repo-root .coderabbit.yaml config (template shipped at review-configs/coderabbit/ in this repo)
- A developer who wants a local CodeRabbit review of uncommitted changes with a structured, severity-ranked report before committing
- A team that wants an agent to implement a feature, run an AI review, fix by severity, and re-verify automatically
- Maintainers of multi-language projects who want one strict shared review config (assertive profile, lint suppression guardrails)
- A developer reviewing only one directory or one commit range to avoid full-repo noise
- Sensitive or compliance-bound projects that cannot send code diffs to the CodeRabbit cloud API (files with secrets must not be reviewed)
- Environments without the CodeRabbit CLI installed and authenticated — a hard prerequisite
- Users who want review with zero chance of file modifications: the skill only fixes on explicit request, but a 'review and fix' request rewrites files directly
How do you install this skill?
- Using this skill uploads code diffs to the third-party CodeRabbit cloud service; manually confirm before reviewing files containing secrets or proprietary code.
- The skill depends on external coderabbit CLI authentication (OAuth or API key); mainland-China network reachability is unverified.
- This was a static review; no commands were executed, and no tests or CI evidence cover the skill's key paths.
- The skill has no version number or changelog; CLI flag behavior may change after upgrades — check `coderabbit --version` before use.
- The publisher is unverified in the FollowSkills enterprise registry; identity is unknown.
- Shell / CLI
- Network access
- Local filesystem
CodeRabbit CLI (coderabbit)CodeRabbit account/API key
The skill lives at skills/coderabbit-review/ in the vibetools repo. The README provides skills/install.sh to install all skills (LLxprt Code / Gemini CLI SKILL.md format) at once:
Generic (script install)
git clone https://github.com/acoliver/vibetools.git
skills/install.sh # install to the platform's user skills dir
skills/install.sh /path/to/project # or into a specific projectPrerequisites
coderabbit --version # verify the CodeRabbit CLI is installed
coderabbit auth login # interactive OAuth flow
coderabbit auth status # verify authentication
cp review-configs/coderabbit/.coderabbit.yaml your-project/.coderabbit.yaml # optional: review config templateHow do you use this skill?
Once installed, send your agent any of these to trigger it:
- Review my current uncommitted changes with CodeRabbit and list the findings by severity
- Review and fix: run a CodeRabbit review against main and resolve all high and medium issues
- Review only changes in the src/api directory and report the CodeRabbit findings
- Implement user logout, then run CodeRabbit review and fix issues in a loop until no high-severity ones remain
Triggered when the user asks to review code changes with CodeRabbit. Core flow:
# Full review (default, against a base branch)
coderabbit review --agent --base main --type all# Committed-only / uncommitted-only changes
coderabbit review --agent --type committed
coderabbit review --agent --type uncommitted
# Against a specific commit, or one directory only
coderabbit review --agent --base-commit <hash>
coderabbit review --agent --dir path/to/module
# Retrieve previous findings
coderabbit review findings
From the --agent structured output, classify Critical→High, Warning→Medium, Info→Low and report. If the user asked only to "review", ask before changing anything; if they asked to "review and fix", apply safe High/Medium fixes directly. In autonomous mode: implement → review → build a task list → fix → re-review → repeat until clean or only Info-level findings remain.
What are this skill's strengths and limitations?
- Structured --agent output (file, line, severity, suggestion) is directly consumable by agents
- Unified High/Medium/Low severity scheme consistent with the repo's other review workflows
- Explicit fix-safety rules: only High/Medium fixed, no code changes without an explicit request
- Concrete security guidance: never review files with secrets, treat review output as untrusted, minimum-scope tokens
- Ships a polished .coderabbit.yaml template (assertive profile + lint guardrails)
- Hard dependency on the CodeRabbit CLI and cloud API — diffs must leave the machine, creating an exfiltration surface
- The install script targets LLxprt Code / Gemini CLI-style skill directories; other platforms like Claude Code need a manual SKILL.md copy
- No evidence in the source of tests, platform-compatibility validation, or fix success rates
- Low/Info findings need case-by-case human evaluation; the skill does not auto-handle them
How does this skill compare with similar options?
Side by side with related skills; every score comes from the same FSRS standard.
| Skill | FS score | Stars | Last updated | License |
|---|---|---|---|---|
| CodeRabbit Review Skill this page | 53 · Use with care | ★ 35 | 2mo ago | Unlicense |
| Open Code Review | 50 · Use with care | ★ 35 | 2mo ago | Unlicense |
| BlockWatch | 67 · Recommended | ★ 29 | 11d ago | MIT |
| Move Code Quality Checker | 54 · Use with care | ★ 23 | 1y ago | MIT |
| CodeRabbit Autofix | 53 · Use with care | ★ 193 | 10d ago | MIT |
Its sibling skill in the same repo, open-code-review, uses the OpenCodeReview (ocr) route: ocr runs in the background, whereas the CodeRabbit CLI runs in the foreground with streamed output. The repo's own study (research/ai-code-review-study/) concludes the two tools are complementary rather than substitutes — matched reviews found different validated defects.
How did FollowSkills review this skill?
The skill clearly discloses its data flow: the CLI sends code diffs to the CodeRabbit API, and warns against reviewing secret-bearing files, treats review output as untrusted, mandates minimum-scope tokens, and forbids echoing tokens; fixes apply only on user request, with confirmation required before edits for review-only requests. Deductions: sending diffs to a third-party cloud service is a real external effect with no local/isolated mode or automated secret detection; rollback and source attribution (unverified publisher) are incomplete.
Steps are clear, the flag table is complete, and there are self-check paths (`coderabbit --version`, `auth status`). Deductions: this is a static review with no tests or committed execution evidence covering key paths; no guidance on failure feedback or degradation when the API is unreachable, authentication fails, or the `--agent` output format changes.
Description matches the body, trigger conditions are explicit (asked to review code changes with CodeRabbit), and the config template and install prerequisites are documented. Deductions: non-fit boundaries are undeclared (non-git repos, no diffs), and the core function depends entirely on the overseas CodeRabbit cloud service with no statement on mainland-China reachability or Chinese-language output.
Well-structured docs (prerequisites, staged steps, security notes, autonomous workflow), referencing the in-repo `review-configs/coderabbit/` config source; the repo is Unlicense public domain. Deductions: the skill itself has no version/changelog, no sample outputs or FAQ, and maintenance responsibility/update path are only indirectly visible at repo level.
The core task (run review, classify High/Medium/Low, fix on request) is complete, including an autonomous implement-review-fix loop, with clear marginal value via structured `--agent` output for agent consumption. Deductions: no representative output samples; fixes limited to High/Medium and dependent on CodeRabbit service quality; static review cannot verify output usability.
Commands, flags, and config paths are auditable from source and corroborated by the README. Deductions: no test suite or CI workflow covering the skill's key paths, no third-party execution evidence, and conclusions cannot be independently reproduced.
Open a dimension to read why it scored that way
Evidence confidence：Low — Mostly static review, author material or a limited demo; useful for discovery, not high-risk decisions.
See the full review method →