home/common/ai/resources/codex/gsd/skills/gsd-code-review/SKILL.md
Review source files changed during a phase for bugs, security issues, and code quality problems
npx skillsauth add kamushadenes/nix gsd-code-reviewInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
<codex_skill_adapter>
$gsd-code-review.$gsd-code-review as {{GSD_ARGS}}.{{GSD_ARGS}} as empty.GSD workflows use AskUserQuestion (Claude Code syntax). Translate to Codex request_user_input:
Parameter mapping:
header → headerquestion → question"Label" — description → {label: "Label", description: "description"}id from header: lowercase, replace spaces with underscoresBatched calls:
AskUserQuestion([q1, q2]) → single request_user_input with multiple entries in questions[]Multi-select workaround:
multiSelect. Use sequential single-selects, or present a numbered freeform list asking the user to enter comma-separated numbers.Execute mode fallback:
request_user_input is rejected or unavailable, you MUST stop and present the questions as a plain-text numbered list, then wait for the user's reply. Do NOT pick a default and continue (#3018).--auto or --all),
(b) the user has explicitly approved a specific default for this question, or
(c) the workflow's documented contract says defaults are safe (e.g. autonomous lifecycle paths).GSD workflows use Task(...) (Claude Code syntax). Translate to Codex collaboration tools:
Direct mapping:
Task(subagent_type="X", prompt="Y") → spawn_agent(agent_type="X", message="Y")Task(model="...") → omit. spawn_agent has no inline model parameter;
GSD embeds the resolved per-agent model directly into each agent's .toml
at install time so model_overrides from .planning/config.json and
~/.gsd/defaults.json are honored automatically by Codex's agent router.fork_context: false by default — GSD agents load their own context via <files_to_read> blocksTask(isolation="worktree") / Agent(isolation="worktree") → no direct Codex mapping.
Codex spawn_agent does not create or bind a git worktree automatically.
Workflows that require this isolation must fail closed or use an explicit
manual worktree protocol before spawning (#3360).Spawn restriction:
spawn_agent to cases where the user has explicitly
requested sub-agents. When automatic spawning is not permitted, do the
work inline in the current agent rather than attempting to force a spawn.Parallel fan-out:
wait(ids) for all to completeResult parsing:
CHECKPOINT, PLAN COMPLETE, SUMMARY, etc.close_agent(id) after collecting results from each agent
</codex_skill_adapter>Spawns the gsd-code-reviewer agent to analyze code at the specified depth level. Produces REVIEW.md artifact in the phase directory with severity-classified findings.
Arguments:
--depth=quick|standard|deep (optional) — review depth level, overrides workflow.code_review_depth config
--files file1,file2,... (optional) — explicit comma-separated file list, skips SUMMARY/git scoping (highest precedence for scoping)--fix (optional) — after review completes (or if REVIEW.md already exists), auto-apply fixes found. Spawns gsd-code-fixer agent. Accepts sub-flags:
--all — include Info findings in fix scope (default: Critical + Warning only)--auto — enable fix + re-review iteration loop, capped at 3 iterationsOutput: {padded_phase}-REVIEW.md in phase directory + inline summary of findings </objective>
<execution_context> @$HOME/.codex/get-shit-done/workflows/code-review.md </execution_context>
<context> Phase: {{GSD_ARGS}} (first positional argument is phase number)Optional flags parsed from {{GSD_ARGS}}:
--depth=VALUE — Depth override (quick|standard|deep). If provided, overrides workflow.code_review_depth config.--files=file1,file2,... — Explicit file list override. Has highest precedence for file scoping per D-08. When provided, workflow skips SUMMARY.md extraction and git diff fallback entirely.Context files (AGENTS.md, SUMMARY.md, phase state) are resolved inside the workflow via gsd-sdk query init.phase-op and delegated to agent via <files_to_read> blocks.
</context>
Execute end-to-end.
The workflow (not this command) enforces these gates:
data-ai
Show MemPalace status — room counts, storage usage, and palace health.
tools
Search your MemPalace — semantic search across all mined memories, projects, and conversations.
tools
Mine a project or conversation into your MemPalace — extract and store memories for later retrieval.
development
Initialize a new MemPalace — guided setup for your AI memory palace with ChromaDB backend.