# Code Review

Use when code has been written and needs validation before committing, or when the user...

- Repository: https://github.com/darrenhinde/OpenAgentsControl (4967 stars)
- Category: Security
- License: MIT
- Last updated: 2026-10-26
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add darrenhinde/OpenAgentsControl --skill code-review -g -a claude-code -y`
Codex: `npx skills add darrenhinde/OpenAgentsControl --skill code-review -g -a codex -y`
Cursor: `npx skills add darrenhinde/OpenAgentsControl --skill code-review -g -a cursor -y`
Gemini CLI: `npx skills add darrenhinde/OpenAgentsControl --skill code-review -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add darrenhinde/OpenAgentsControl`

## Description

Use when code has been written and needs validation before committing, or when the user asks for a code review or security check.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Code Review

## Overview
Review code for security, correctness, and quality. Runs in isolated code-reviewer context with pre-loaded standards.

**Announce at start:** "I'm using the code-review skill to validate [files/feature]."

## The Process

### Step 1: Pre-Load Context (Main Agent)

Load standards BEFORE invoking review:

```bash
Read: .opencode/context/core/standards/code-quality.md
Read: .opencode/context/core/standards/security-patterns.md
```

### Step 2: Invoke Review

```bash
/code-review path/to/file.ts
/code-review src/auth/*.ts
/code-review $(git diff --name-only HEAD~1)
```

### Step 3: Analyze Report

Code-reviewer returns structured findings:

```markdown
## Code Review: Auth Service

### 🔴 CRITICAL (Must Fix)
1. **SQL Injection Risk**, src/db/query.ts:42
   - Problem: Unparameterized query with user input
   - Risk: Database compromise
   - Fix:
     ```diff
     - db.query(`SELECT * FROM users WHERE id = ${userId}`)
     + db.query('SELECT * FROM users WHERE id = ?', [userId])
     ```

### 🟠 HIGH (Correctness)
2. **Missing Error Handling**, src/auth/service.ts:28
   - Problem: Async function without try/catch
   - Risk: Unhandled promise rejection
   - Fix: Wrap in try/catch with proper logging

### 🟡 MEDIUM (Style)
3. **Naming Convention**, src/auth/middleware.ts:15
   - Problem: snake_case instead of camelCase
   - Fix: Rename verify_token → verifyToken

### Summary
Total Issues: 3 (1 Critical, 1 High, 1 Medium)
Recommendation: REQUEST CHANGES
```

### Step 4: Take Action

**If CRITICAL or HIGH issues:**
1. STOP, do not commit
2. Fix issues using suggested diffs
3. Re-run `/code-review` to verify
4. Proceed only when clean

**If only MEDIUM or LOW issues:**
1. Evaluate whether to fix now or later
2. Apply quality improvements
3. Safe to commit

**If no issues:**
1. Commit with confidence
2. Note positive patterns

## Review Checks

The rest: https://github.com/darrenhinde/OpenAgentsControl/blob/HEAD/plugins/claude-code/skills/code-review/SKILL.md