What does this skill do, and when should you use it?
Review Agent performs a read-only, defect-first review of a specified code change. It reads applicable AGENTS.md instructions, inspects the complete diff and surrounding code, and checks relevant tests and call sites. It supports uncommitted changes, base-branch reviews, commits, and custom review instructions. It reports only concrete findings an author would likely fix and does not alter files or post review comments.
Reads applicable AGENTS.md files; inspects the full diff and enough surrounding code for each changed path; identifies meaningful correctness, security, performance, or maintainability regressions introduced by the change; checks relevant tests and call sites; for base-branch reviews, resolves the comparison reference and uses the merge base; outputs findings ordered by P0–P3 severity with a title, file path, and line number; if no qualifying issue exists, outputs “No findings.” followed by an overall assessment and any material test gaps or residual risks.
- A maintainer wants a read-only review of uncommitted changes before creating a commit.
- A reviewer needs to check whether a particular commit introduced concrete regressions.
- A team is preparing a base-branch merge and needs the review to reflect the changes that would actually merge.
- Another agent needs to delegate an independent review without allowing file edits, commits, branch pushes, or posted comments.
How do you install this skill?
- The skill may read sensitive repository contents, but it does not define credential redaction, minimum read scope, or data-exfiltration safeguards.
- Failure handling and diagnostic feedback are underspecified when the target is unavailable, the comparison reference cannot be resolved, or tests cannot run.
- Chinese-language output, cross-platform differences, and mainland-China environment boundaries are not documented.
- No tests or execution evidence for the skill itself were provided, so completeness still requires human review.
- Shell / CLI
- Local filesystem
Git
The skill is located at codex-rs/skills/src/assets/samples/review-agent/SKILL.md. The README documents installation for the overall Codex CLI and bundled skill collection, for example: npm install -g @openai/codex, followed by running codex. The source does not document a standalone installation or copying procedure for this skill.
tmp="$(mktemp -d)"
git clone --depth 1 https://github.com/openai/codex.git "$tmp"
mkdir -p ~/.claude/skills
cp -R "$tmp/codex-rs/skills/src/assets/samples/review-agent" ~/.claude/skills/
rm -rf "$tmp"Generated from the source repository and skill path; it copies only this skill's folder. If the author's install steps above differ, follow those first. To scope it to one project, replace ~/.claude/skills with that project's .claude/skills.
How do you use this skill?
Once installed, send your agent any of these to trigger it:
- Review the uncommitted changes in this repository and report every actionable finding.
Provide the skill through an Agent Skills-compatible client and specify the review target. For example: “Review the uncommitted changes in this repository and report every actionable finding.” You can also specify a base-branch diff, commit, or custom review instructions. The source does not define a more specific command, parameter format, or output API.
What are this skill's strengths and limitations?
- Inspects the complete diff and continues after finding the first issue.
- Requires tests and call sites to be checked so findings are concrete and actionable.
- Has a clear read-only boundary: it does not modify files, create commits, push branches, or post comments.
- Orders findings by severity and requires a minimal code range overlapping the reviewed diff.
- The skill has no documented standalone installation flow; the README describes the overall Codex CLI collection.
- The source provides no evidence of a test suite, platform coverage, or real review results.
- It depends on access to the target code, diff, relevant context, tests, and call sites.
- The source does not specify detailed handling for targets that are unavailable or cannot be resolved.
How does this skill compare with similar options?
Side by side with related skills; every score comes from the same FSRS standard.
| Skill | FS score | Stars | Last updated | License |
|---|---|---|---|---|
| Review Agent Code Review Skill this page ✓ OpenAI · Official | 52 · Use with care | ★ 129k | 11d ago | Apache-2.0 |
| Session Code Review ✓ Microsoft · Official | 51 · Use with care | ★ 194k | 11d ago | MIT |
| Diff Risk Explainer | 14 · Not recommended | ★ 32k | 12d ago | Apache-2.0 |
| Open Code Review Skill | 58 · Recommended | ★ 47k | 11d ago | Apache-2.0 |
| Open Code Review Delegated Review | 58 · Recommended | ★ 47k | 11d ago | Apache-2.0 |
How did FollowSkills review this skill?
The evidence shows explicit read-only boundaries: do not modify files, create commits, push branches, post comments, or delegate; it also requires reading instructions, the full diff, tests, and call sites. This supports a relatively strong trust score. Points are deducted because user confirmation is not required, and the skill does not disclose possible access to sensitive code or credentials, command execution scope, data flow, failure recovery, or rollback.
The review workflow and merge-base comparison rules are concrete, and it requires continuing through the whole diff and validating call paths. Points are deducted because failure feedback is incomplete for missing targets, unavailable AGENTS.md files, unresolved comparison references, or unexecutable tests; static evidence cannot establish reproducibility, so the score remains at or below 10.
The description matches the capability, covering uncommitted changes, base-branch diffs, commits, and custom review instructions; allow_implicit_invocation=false reduces false triggering. Points are deducted because non-fit cases, input boundaries, machine-readable output, Chinese interaction, and mainland-China environment support are not specified.
The skill has clear steps, decision criteria, severity priorities, and output formatting. Its metadata includes name, display name, short description, and default prompt, while repository context supplies an Apache-2.0 license and official provenance. Points are deducted because the skill lacks installation or dependency notes, versioning, changelog, maintenance ownership, update path, FAQs, and troubleshooting guidance.
The task, review scope, and finding format are clear; severity ordering, file paths, and concise explanations produce directly usable core output. Points are deducted because no representative output or static evidence verifies the claimed completeness, and actual completion of the 'every actionable finding' and test-check requirements cannot be confirmed from files alone; static calibration caps this at 7.
The skill text is auditable primary material, and its rules require code-path and test-based confirmation of findings. Points are deducted because there are no committed skill tests, CI coverage, third-party execution records, or corroborating sources; this review also did not execute anything, so verifiability remains limited.
Open a dimension to read why it scored that way
Evidence confidence：Low — Mostly static review, author material or a limited demo; useful for discovery, not high-risk decisions.
See the full review method →