.claude/skills/code-review/SKILL.md
Review code for quality, maintainability, and correctness. Use when reviewing pull requests, evaluating code changes, or providing feedback on implementations. Focuses on API design, patterns, and actionable feedback.
npx skillsauth add prefecthq/fastmcp reviewing-codeInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
Code review maintains a healthy codebase while helping contributors succeed. The burden of proof is on the PR to demonstrate it adds value. Your job is to help it get there through actionable feedback.
Critical: A perfectly written PR that adds unwanted functionality must still be rejected. The code must advance the codebase in the intended direction. When rejecting, provide clear guidance on how to align with project goals.
Be friendly and welcoming while maintaining high standards. Call out what works well. When code needs improvement, be specific about why and how to fix it.
Even perfect code for unwanted features should be rejected.
When a PR adapts code to a new version of a dependency (e.g., removing a parameter that was dropped upstream, using a new API):
pyproject.toml must match. If the change breaks compatibility with the previously-pinned minimum version, the minimum version must be bumped. Otherwise users on the old version get a regression.uv.lock) changes should be scoped to the PR's purpose. A PR fixing a ty compatibility issue should not also include unrelated dependency version bumps (anthropic, google-auth, etc.) from running uv sync --upgrade. These create noise and make the diff harder to review.Identify confusing patterns or non-idiomatic code:
Provide actionable feedback, not generic observations.
Think about the API from a user's perspective. Is it intuitive? What's the learning curve?
Before approving, ask:
If something needs work, your review should help it get there through specific, actionable feedback. If it's solving the wrong problem, say so clearly.
Good comments:
| Instead of | Write |
|------------|-------|
| "Add more tests" | "The handle_timeout method needs tests for the edge case where timeout=0" |
| "This API is confusing" | "The parameter name data is ambiguous - consider message_content to match the MCP specification" |
| "This could be better" | "This approach works but creates a circular dependency. Consider moving the validation to utils/validators.py" |
Before approving, verify:
development
Maintainer-only workflow for handling GitHub Secret Scanning alerts on OpenClaw. Use when Codex needs to triage, redact, clean up, and resolve secret leakage found in issue comments, issue bodies, PR comments, or other GitHub content.
development
Maintainer workflow for OpenClaw releases, prereleases, changelog release notes, and publish validation. Use when Codex needs to prepare or verify stable or beta release steps, align version naming, assemble release notes, check release auth requirements, or validate publish-time commands and artifacts.
development
Run, watch, debug, and extend OpenClaw QA testing with qa-lab and qa-channel. Use when Codex needs to execute the repo-backed QA suite, inspect live QA artifacts, debug failing scenarios, add new QA scenarios, or explain the OpenClaw QA workflow. Prefer the live OpenAI lane with regular openai/gpt-5.4 in fast mode; do not use gpt-5.4-pro or gpt-5.4-mini unless the user explicitly overrides that policy.
development
End-to-end Parallels smoke, upgrade, and rerun workflow for OpenClaw across macOS, Windows, and Linux guests. Use when Codex needs to run, rerun, debug, or interpret VM-based install, onboarding, gateway smoke tests, latest-release-to-main upgrade checks, fresh snapshot retests, or optional Discord roundtrip verification under Parallels.