code-review SKILL.md skillA
code-review from icetomoyo/kodax is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add icetomoyo/kodax/code-review@git:20261027.3a32e04Pins git:20261027.3a32e04 in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- icetomoyo/kodax
- Path
packages/agent/src/capabilities/skills/builtin/code-review/SKILL.md- Versions recorded
- 4
- Latest version
- git:20261027.3a32e04, committed Oct 27, 2026
- First version recorded
- May 24, 2026
- Size
- 4,169 bytes
- Repository stars
- 14
- License
- a license file GitHub does not identify
审查代码、diff、提交或当前 git 改动，重点发现 bug、行为回归、边界条件遗漏、安全风险、性能问题和缺失测试。当用户提到 code review、review 这段代码、帮我看看改动有没有问题、审查 PR/提交时使用；不要用于单纯解释代码或直接实现需求。.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Code Review Skill 对 **$ARGUMENTS** 进行代码审查，并优先输出真正会影响正确性、稳定性或可维护性的发现。 ## 范围判定 - 如果提供了 `$ARGUMENTS`，审查对应文件、目录、diff 或提交范围。 - 如果没有提供参数，先用 git status 清点任务相关的已暂存、未暂存与未跟踪文件，分别读取 staged/unstaged diff，并用 Read 检查相关未跟踪文件。一次 git diff 不代表审完全部改动。 - PR/提交范围使用明确基线，只审该范围，不混入当前工作区的无关修改；不在仓库且没有目标时才补齐范围。 - 在下结论前，尽量查看相邻实现、调用方、测试和相关配置，避免脱离上下文的误报。 - review-only 只报告，不编辑实现或暂存文件。测试前查看脚本副作用，沿用宿主授权；不为审查自动运行安装、--fix 或破坏性 Git 命令。 ## 审查重点 - 正确性与回归风险：逻辑错误、边界条件、状态同步、类型假设、兼容性变化。 - 稳定性与安全性：异常处理、输入校验、资源泄漏、敏感信息暴露、权限或注入风险。 - 性能与可维护性：明显的复杂度问题、重复逻辑、难以验证的实现、缺失测试保护。 - 只报告有行动价值的问题。纯风格偏好或可选优化，不要包装成高优先级 finding。 ## 严重级别 - `Critical`: 会导致数据丢失、严重安全问题、崩溃或明显错误结果。 - `High`: 很可能引发实际 bug、行为回归或线上风险。 - `Medium`: 不是立刻出错，但会留下明显缺陷、维护风险或测试空洞。 - `Low`: 小范围问题或局部改进点，仅在确实值得用户处理时报告。 ## 输出要求 - 先给 `## Findings`，并按严重级别从高到低排列。 - 每条 finding 都要包含： - 严重级别和简短标题 - 具体文件和行号 - 为什么这是问题，可能造成什么影响 - 建议的修复方向 - 如果没有发现值得报告的问题，明确写 `No findings.`，并说明实际覆盖和未验证范围；不能暗示未运行的测试已通过。 - 需要时再追加 `## Open Questions` 或 `## Change Summary`，但不要用总体打分或“亮点”冲淡问题。 ## 使用示例 - `/code-review src/auth.ts` - 审查单个文件 - `/code-review packages/coding/src/` - 审查目录 - `/code-review` - 审查当前 git 变更 ## Lean Review Lens …
Read the whole file at its exact version.
How to install
mdr add icetomoyo/kodax/code-review@sha256:6c0a0a36f1337ac1The line at the top of this page pins the label git:20261027.3a32e04, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_ysg4izedf4nw4ffq)
4 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 4 versions of this file, between May 24, 2026 and Oct 27, 2026, about one every 52 days.
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| git:20261027.3a32e04 latest | 2026-10-27 | 3a32e04 | 4,169 B | A | view · diff |
| git:20260625.2845fcd | 2026-06-25 | 2845fcd | 3,741 B | A | view · diff |
| git:20260613.853a0bd | 2026-06-13 | 853a0bd | 2,813 B | A | view · diff |
| git:20260524.88f2faa | 2026-05-24 | 88f2faa | 2,811 B | A | view |
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (4169 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
icetomoyo/kodax · 14 stars · license a license file GitHub does not identify · pushed 2026-11-06 · branch KodaX
API
GET https://markdownregistry.com/api/v1/artifacts/art_ysg4izedf4nw4ffq GET https://markdownregistry.com/api/v1/resolve?ref=icetomoyo/kodax/code-review GET https://markdownregistry.com/api/v1/blob/6c0a0a36f1337ac1609ebc8b474abb40e24821acb02bb297caa076ba470304a0
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.