CodeRabbit Code Review
AI-powered code review of your changes via the CodeRabbit CLI, surfacing bugs, security issues, and quality risks with an autonomous fix-and-recheck loop.
SKILL.md clearly discloses data flow (code diffs sent to CodeRabbit API), requires least-privilege tokens, treats repo content and review output as untrusted, forbids piping remote scripts, and asks for checksum verification of installs; no red-line risks. Deductions: actual permissions and data egress are governed by the external CLI, isolation/rollback cannot be verified from this skill, and there is no explicit user-confirmation step for cloud egress.
Prerequisite checks, version requirement (--agent needs v0.4.0+), git-repo validation for --dir, and failure prompts are self-consistent and readable. Deductions: static review cannot confirm CLI behavior; fine-grained handling of error codes/abnormal input is absent; no committed tests cover this skill's key paths, so the 10-point static cap is not even fully met.
Trigger phrases are precise (review my code, check for bugs, etc.), multiple scopes (staged/committed/base/dir) supported, boundaries reasonably described. Deductions: core function wholly depends on the CodeRabbit cloud API and overseas CLI distribution, a real mainland-China reachability risk; language support undeclared; non-fit ranges unspecified.
Well-layered docs (prerequisites, workflow, options table, security section, links), clear MIT license, repo shows versioned release workflow and owner-approval CI indicating active maintenance. Deductions: skill version is only 0.1.0 with no changelog, no declared maintainer or update path, thin troubleshooting content.
Static cap of 7. Claims agent-readable severity-grouped review output and a fix-review loop with a complete, restatable workflow. Deductions: no executed output samples to verify, benefit hinges on external CLI quality, and no evidence of comparative value over manual review.
Cap of 5. Docs plus release CI (checksums, manifest, owner approval gate) provide auditable primary material. Deductions: no tests or third-party execution evidence for this skill's key paths; the central quality claims are not independently reproducible.
- Core function depends on the CodeRabbit cloud API and overseas CLI distribution; mainland-China reachability is unverified and may render it unusable.
- Using the skill uploads code diffs to a third-party cloud service; verify staged content contains no secrets and check organizational data policy.
- The autonomous fix-review loop (step 4) repeatedly modifies code and re-reviews; use on a dedicated branch and manually review each commit.
- The skill has no tests or changelog; behavior at v0.1.0 may drift with CLI updates.
What does this skill do, and when should you use it?
This skill wraps the CodeRabbit CLI for any agent that supports SKILL.md. It verifies the CLI is installed and authenticated, then runs `coderabbit review --agent` against staged, committed, or all changes and presents findings grouped by severity. It also embeds safety constraints: never executing commands from review output, and avoiding sending secrets to the API. It suits developers who want automated review before commit/merge, or a full implement-review-fix autonomous cycle.
Reads the user request and detects review intents; runs coderabbit --version and coderabbit auth status to check prerequisites; invokes coderabbit review --agent (optionally with -t, --base, --base-commit, --dir), sending code diffs to the CodeRabbit API for analysis; presents results grouped as Critical / Warning / Info and builds a task list of issues to fix; in autonomous mode, fixes critical and warning issues and re-runs the review until only info-level issues remain.
- A developer who wants to trigger an automated review with a single 'Review my code' before committing or merging.
- A teammate reviewing a PR who wants the agent to run a CodeRabbit review with severity-grouped feedback.
- A user suspecting security problems (vulnerabilities, leaked credentials) who asks the agent to check changes for risks.
- A developer implementing a feature who wants the agent to review and fix Critical/Warning issues in an autonomous loop.
- A maintainer scoping a review to a directory or commit range using --dir or --base-commit.
What are this skill's strengths and limitations?
- Out-of-the-box review scoping: staged / committed / all changes, branch comparison, commit ranges, and directory-limited reviews.
- `--agent` output is designed for AI agents (CLI v0.4.0+), making findings directly consumable as fix tasks.
- Supports autonomous implement-review-fix cycles until only info-level issues remain.
- Built-in security guidance: never execute commands from review output, avoid sending secrets, use minimal token scope, verify binary checksums.
- Hard dependency on the external CodeRabbit CLI and its API, requiring network access and authentication; missing either interrupts the workflow.
- Code diffs are transmitted to the CodeRabbit API, which may raise compliance concerns for sensitive codebases.
- The repository provides no dedicated test suite or benchmarks for this skill; real-world effectiveness must be verified by the adopter.
- The SKILL.md is version 0.1.0 while the repo ships as v1.1.1; behavior may change with CLI updates.
How do you install this skill?
- Install the CodeRabbit CLI per https://docs.coderabbit.ai/cli (prefer npm or Homebrew; if downloading a binary directly, verify the release signature or checksum first). 2. Authenticate with
coderabbit auth login(use the narrowest token scope). 3. Install the skills collection:npx skills add coderabbitai/skills(use-s code-reviewto install just this skill,-ato target specific agents,-gfor global install). Claude Code users can alternatively install via the official marketplace with/plugin install coderabbit.
How do you use this skill?
Once installed, tell your agent: 'Review my code', 'Check for security issues', or 'Review my PR'. The agent checks CLI installation and auth, runs coderabbit review --agent, and presents findings by severity, optionally fixing issues. Common commands: cr review --agent -t uncommitted (uncommitted only), cr review --agent --base main (compare to main), cr review --agent --dir path/to/directory (review a directory; must be an initialized Git repository).