Skills

Local Review

Code review the current PR (or branch diff against main) for bugs, security, and...

Install

npx skills add windmill-labs/windmill --skill local-review -g -a claude-code -y
Repository
windmill-labs/windmill18.4k
Category
Security
Updated
3d ago
License
See repository
Context cost
Lightabout 950 tokens
Runs scripts
No, instructions only

What it does

Code review the current PR (or branch diff against main) for bugs, security, and AGENTS.md compliance. MUST use when asked to review code.

Local Code Review

Run the same review locally that the GitHub auto-review actions run on PRs (Claude / Codex / Pi). The review policy lives in REVIEW.md.

Why a subagent: the review MUST run in a fresh context, not inline in the current session. If the user has been iterating on the diff, the main session has absorbed their reasoning and rationalizations, so it anchors and misses things CI catches. A subagent starts cold, like CI does.

Steps

  1. Determine the PR scope (cheap, do this in the main session):

    • If an argument is provided, treat it as a PR number or branch.
    • Otherwise, detect from the current branch vs main.
    • Confirm the PR/branch exists (gh pr view <n> or git rev-parse <branch>).
  2. Delegate the review to a fresh-context subagent with a self-contained prompt. The prompt MUST include:

    • The PR number or branch name to review.

    • The instruction to read REVIEW.md first for the policy, then AGENTS.md files in directories touched by the diff.

    • The exact output format (see below).

    • Whether --comment was requested (so the subagent emits inline-comment payloads if needed).

    • Any "Additional reviewer instructions" the user provided.

    • Claude Code: use the Agent tool with subagent_type: branch-diff-reviewer (read-only tools, purpose-built for this). If unavailable, fall back to general-purpose.

    • Codex / Pi: if the CLI exposes a fresh-session subagent mechanism, use it. Otherwise tell the user to run the skill in a fresh CLI session and stop, running inline in the current session defeats the purpose.

  3. Receive the findings from the subagent and relay them to the user verbatim. Do not re-summarize, re-judge, or filter, the whole point of fresh context is to surface what the main session would dismiss.

Read the whole SKILL.md on GitHub

More in Security