bjornmelin/autoreview
skills/autoreview/SKILL.md
Run a Codex-only structured code review closeout for local, branch, or commit diffs. Use when the user asks for autoreview, Codex review, structured closeout review, final review before commit/ship, or review after non-trivial code edits.
$ install --global
skillsauthnpx skillsauth add bjornmelin/dev-skills autoreviewInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: May 28, 2026, 3:45 AM128.0s4 files scanned
SKILL.md
- name:
- autoreview
- description:
- Run a Codex-only structured code review closeout for local, branch, or commit diffs. Use when the user asks for autoreview, Codex review, structured closeout review, final review before commit/ship, or review after non-trivial code edits.
Auto Review
Run the bundled Codex structured review helper as a closeout check. Treat the result as advisory: verify every finding against the real code before changing files, and reject speculative or over-broad findings.
Contract
- Use only the bundled helper; do not run nested review commands.
- The helper uses
codex execinstead ofcodex reviewso it can enforce structured JSON output and deterministic pass/fail behavior. - Review the intended diff target, not a clean checkout by accident.
- Keep going until the final helper run reports no accepted/actionable findings.
- If a review-triggered fix changes code, rerun focused tests and rerun the helper.
- Report security findings only for concrete, actionable risks introduced or exposed by the change.
- Do not push just to review. Push only when the user requested push, ship, or PR update.
Pick Target
Dirty local work:
skills/autoreview/scripts/autoreview --mode local
Branch work:
skills/autoreview/scripts/autoreview --mode branch --base origin/main
Committed single change:
skills/autoreview/scripts/autoreview --mode commit --commit HEAD
Use --mode local only when the patch is actually unstaged, staged, or
untracked in the current checkout. For committed, pushed, or PR work, review the
commit or branch diff instead.
Options
--model <model>: pass a Codex model override; omit it to inherit the configured Codex model.--reasoning-effort low|medium|high|xhigh: pass Codex model reasoning effort; omit it to inherit the configured/model default.--web-search: opt into Codex web search for dependency/API/security research; default is off to match Codex review behavior.--prompt/--prompt-file: add task-specific review instructions.--dataset <file>: include extra evidence in the review bundle.--parallel-tests "<command>": run focused tests while Codex reviews the frozen bundle.--output <file>/--json-output <file>: persist human or structured output.--dry-run: print target selection without invoking Codex.
Format first if formatting can change line locations. If tests or review cause edits, rerun the affected tests and rerun autoreview until the helper exits cleanly.
Helper Behavior
The helper:
- chooses dirty local changes first in
--mode auto - otherwise uses
origin/mainfor non-main branch review - uses
codex execwith read-only sandboxing and structured JSON output - inherits current Codex model selection by default; keep Codex config on the latest best-fit review model and use
--modelonly for deliberate overrides - writes only to stdout unless
--outputor--json-outputis set - prints
review still running: codex elapsed=<seconds>s pid=<pid>while waiting - prints
autoreview clean: no accepted/actionable findings reportedon a clean result - exits nonzero when accepted/actionable findings are present
Final Report
Include:
- review command used
- tests/proof run
- findings accepted/rejected, briefly why
- the clean result from the final helper run, or why a remaining finding was consciously rejected
Related Skills
bjornmelin/repo-modernizer
development
VerifiedTrustedCommunity
Repo/monorepo modernization: dependency upgrades, security fixes, deprecation cleanup, framework migrations, dependency-native refactors, and verified hard-cut simplification.
2SKILL.mdUpdated Jun 11, 2026
bjornmelin/web-waapi
development
VerifiedTrustedCommunity
Use this skill for Browser Web Animations API: Element.animate(), Animation, KeyframeEffect, playback control, generated keyframes, cancel/finish, commitStyles, and cleanup. Trigger on Element.animate, WAAPI, Web Animations API, KeyframeEffect, Animation object, commitStyles. Do not use for near-miss tasks outside these boundaries; route to adjacent motion or platform skills when they own the implementation.
2SKILL.mdUpdated Jun 11, 2026
bjornmelin/web-three-r3f
tools
VerifiedTrustedCommunity
Use this skill for Three.js, React Three Fiber, Drei, Canvas/createRoot lifecycle, loaders, GLTF, useFrame, disposal, SSR/client boundaries, DPR, and browser proof. Trigger on Three.js, THREE, @react-three/fiber, @react-three/drei, R3F Canvas, useFrame, GLTF, WebGLRenderer. Do not use for near-miss tasks outside these boundaries; route to adjacent motion or platform skills when they own the implementation.
2SKILL.mdUpdated Jun 11, 2026
bjornmelin/web-tailwind-motion
development
VerifiedTrustedCommunity
Use this skill for Tailwind CSS v4 transition, animation, duration, easing, motion-safe/motion-reduce, @theme motion tokens, and static class safety. Trigger on Tailwind animation, transition-all, motion-safe, motion-reduce, @theme, animate-, duration-. Do not use for near-miss tasks outside these boundaries; route to adjacent motion or platform skills when they own the implementation.
2SKILL.mdUpdated Jun 11, 2026