6bnbn/code-review
兼容codex@cursor一键安装技能/codex一键安装技能/纯手动安装/skills/code-review/SKILL.md
Use when the user asks to review a pull request or diff with a structured Codex CLI workflow using parallel review passes and filtered actionable findings.
$ install --global
skillsauthnpx skillsauth add 6bnbn/flowpilot code-reviewInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Error
VirusTotalMulti-engine malware detection
70%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Mar 25, 2026, 6:51 PM46.7s2 files scanned
SKILL.md
- name:
- code-review
- description:
- Use when the user asks to review a pull request or diff with a structured Codex CLI workflow using parallel review passes and filtered actionable findings.
Codex-Native PR Code Review
Use this workflow to review a pull request or diff with gh when available. Keep findings high-signal, actionable, and grounded in the actual change.
Source of truth
eferences/code-review-command.md
Review Workflow
-
Eligibility check
- Confirm the PR is still open and ready for review.
- Skip review if it is clearly out of scope, already handled, or obviously trivial.
-
Collect local guidance
- Identify the relevant AGENTS.md files for the touched paths.
- Treat those files as code-review guidance when applicable.
-
Summarize the change
- Use one fast subagent to summarize the PR and changed areas.
-
Run parallel review passes
- Launch independent review subagents with different lenses:
- conventions and AGENTS.md compliance
- correctness and bug risk
- history and git blame context
- prior PR or discussion context when relevant
- comments or invariants near the changed code
- Launch independent review subagents with different lenses:
-
Confidence-check findings
- Re-check each finding with a separate pass before surfacing it.
- Drop weak or speculative issues.
-
Filter for signal
- Ignore trivial lint, formatting, or typecheck issues that CI should catch separately.
- Ignore pre-existing issues unless the current PR makes them worse.
- Keep only the issues that matter to a senior engineer reviewing this change.
-
Comment or report
- If the user asked for a GitHub comment, use gh to post it.
- Otherwise, present the findings directly in the session.
Comment Format
Use this structure for final findings:
`markdown
Code review
Found 2 issues:
-
Brief description of issue
- Why it matters
- Evidence: file path or URL with full commit SHA when linking to GitHub
-
Brief description of issue
- Why it matters
- Evidence: file path or URL with full commit SHA when linking to GitHub `
If no issues remain after filtering:
`markdown
Code review
No actionable issues found. Checked for correctness, local guidance, and regression risk. `
Review Rules
- Use gh for GitHub operations when available.
- Prefer concrete evidence over speculation.
- Keep comments brief and free of signatures or emojis.
- Cite paths or links precisely when pointing to code.
Related Skills
6bnbn/writing-skills
testing
VerifiedTrustedCommunity
Use when creating, editing, or validating Cursor custom skills, especially when deciding where they should live, how they should be named, and how to describe when they apply.
128SKILL.mdUpdated May 2, 2026
6bnbn/writing-plans
development
VerifiedTrustedCommunity
Use when the user wants a written implementation plan in Cursor before editing code, especially for multi-step tasks or changes touching several files.
128SKILL.mdUpdated May 2, 2026
6bnbn/verification-before-completion
development
VerifiedTrustedCommunity
Use before claiming work is complete, fixed, or passing in Cursor. Requires fresh verification evidence such as tests, builds, lint output, or direct reproduction checks.
128SKILL.mdUpdated May 2, 2026
6bnbn/using-superpowers
testing
VerifiedTrustedCommunity
Use when starting a task in Cursor and deciding whether to apply one of the companion skills in this pack before exploring, planning, editing, or reviewing.
128SKILL.mdUpdated May 2, 2026