Open Code Review Delegated Review
Let the host agent perform the review while OCR provides deterministic file selection and rule resolution.
The skill itself is a read-only orchestration instruction: preview/rule subcommands emit file lists and rules, diffs come from git on the host, and no LLM endpoint is needed, so the privilege surface is small. The doc warns against placing untrusted summary text in double-quoted shell templates, showing security awareness. Deductions: no explicit data-flow disclosure (e.g., telemetry claims), no user-confirmation or rollback mechanism in the skill, and publisher identity is unverified, so full marks are not justified.
Documentation is internally consistent: workflow steps, modes (workspace/range/commit), mandatory coverage, oversized-background recovery, and CLI version-compatibility degradation (handling 'unknown flag: --format') are all specified with failure feedback. Deductions: static review cannot execute key paths; no committed test evidence targeting the delegate subcommands specifically, and error handling depends on CLI implementation not shown for these paths.
Trigger conditions are clear (host agent performs the review itself; no LLM config needed), with explicit scenario, inputs/outputs, and boundaries (skip requires reason, coverage mandatory). Multi-language and multi-platform support with a Chinese README. Deductions: installation depends on npm and GitHub Release downloads, i.e., overseas services whose reachability from mainland China is not addressed; declared non-fit ranges are limited.
SKILL.md is well structured with version (1.0.0), license (Apache-2.0), gotchas/known limits, and troubleshooting; the repo has LICENSE, SECURITY.md, release-signature verification, and active CI. Deductions: no changelog in the skill file, update path relies on an external docs site, no complete JSON output example, and maintenance ownership is not explicit within the skill itself.
Delegation mode addresses a real pain point (coverage gaps and position drift when host agents review), using deterministic file selection and rule resolution, with directly usable structured output (line-level comments, severity). Deductions: static review cannot verify actual output quality; the README's benchmark claims are not independently verified here, so comparative-benefit evidence rests on author claims.
The repo contains real CI workflows (90% coverage gate, govulncheck, smoke tests asserting the delegate command exists), OpenSSF Gold badge, and an AACR-Bench dataset link — auditable primary material. Deductions: nothing was executed in this review; CI covers the CLI broadly rather than this SKILL.md's key paths, and benchmark results are not independently reproducible from the provided files.
- Static review only; no commands were executed, and the actual behavior/output format of delegate subcommands is not independently verified.
- Installation depends on the npm registry and GitHub Releases, which may be unreachable or slow from mainland-China networks.
- Publisher identity is unverified; use the signature checks in SECURITY.md (gh attestation verify / git tag -v) to verify binaries.
- SKILL.md has no changelog; the CLI and skill update independently — note the --format flag version constraint (v1.9.0+).
- Review-and-fix mode applies High/Critical fixes directly; confirm scope and inspect diffs before use.
What does this skill do, and when should you use it?
This skill enables Open Code Review’s delegation mode. OCR handles deterministic engineering tasks: identifying reviewable files and resolving the rules that apply to them. The host agent performs the actual code review with its own model capabilities and tools. OCR does not need an LLM endpoint configured in this mode, making it suitable when review decisions should remain under the host agent’s control.
Checks whether the ocr CLI is installed; runs ocr delegate preview to obtain the workspace, range, or commit mode, reference metadata, reviewable files, and exclusions; runs ocr delegate rule <path...> to retrieve grouped rules; uses git diff, git show, or direct file reads according to the preview mode; reviews each file using its diff, rule group, and relevant context; and produces structured findings with a path, comment content, optional new-file line numbers, category, and severity.
- A team wants Claude Code or Codex to make the review judgments while OCR keeps file selection deterministic.
- A developer needs to review a branch range using preview-provided merge-base and reference metadata.
- A maintainer wants line-targeted findings for a single commit.
- A team reviewing a large change wants to fetch rules in batches and avoid repeating identical rule content.
- An engineer needs controlled review of tracked, untracked, and excluded workspace files.
What are this skill's strengths and limitations?
- Uses deterministic CLI logic for file filtering and rule resolution.
- Keeps review reasoning, context retrieval, and comment generation with the host agent.
- Supports workspace, branch-range, and single-commit preview modes.
- Groups files sharing the same rule content to reduce repetition.
- Defines structured categories and severity levels for findings.
- Requires the `ocr` CLI and shell access.
- The source does not document a dedicated installation or registration command for this specific skill across clients.
- The skill itself does not perform the LLM review; quality depends on the host agent.
- No independent benchmark, test suite, or platform validation is provided for this delegation skill.
- Untracked workspace files must be read directly rather than obtained through a normal Git diff.
How do you install this skill?
Install the OCR CLI with npm install -g @alibaba-group/open-code-review, or use a GitHub release binary. Make the skill available at skills/open-code-review-delegate/SKILL.md in a host that supports Agent Skills. The source does not document a separate client-specific installation command for this delegation skill.
How do you use this skill?
From the target Git repository, run ocr delegate preview; optionally provide --from <ref> --to <ref>, --commit <hash>, or --exclude <patterns>. Pass the reviewable paths to ocr delegate rule <path1> <path2> .... For range mode, use git diff <merge_base>..<to> -- <path>; for commit mode, use git show <commit> -- <path>; for workspace mode, use git diff HEAD -- <path> or read an untracked file directly. Review each file with the host agent and report findings using path, content, optional line fields, category, and severity. No OCR-side LLM configuration is required.
How does this skill compare with similar options?
Compared with OCR’s mode in which OCR calls an LLM endpoint, delegation mode leaves the actual review to the host agent and requires no OCR-side LLM configuration; OCR remains responsible for file selection and rule resolution.