Free MIT workflow

A code review agent skill should be a gate, not a compliment generator

“Review this code” often produces a tidy paragraph with no proof that the agent read every changed file, checked the repository state or ran the relevant tests. A useful pre-merge workflow needs a defined scope, severity rules and a ship/no-ship verdict tied to evidence.

What the Code Review Gate does

The free Code Review Gate starts by identifying changed files from Git. It requires the agent to read the complete files rather than relying only on a narrow diff. It then checks three separate categories:

• Security: exposed secrets, injection paths, unsafe deserialisation, permissive CORS and missing authorisation.
• Correctness: unhandled I/O, missing awaits, race conditions, type mismatches and boundary errors.
• Quality: unreachable code, excessive nesting, abandoned debug statements and risky complexity.

The output separates critical findings, warnings and suggestions. That matters because formatting preferences should not block a release, while exposed credentials or missing access control should.

Install it for Codex

npx skills add skyestrela/ai-agent-skill-preview \
  --skill code-review-gate --agent codex --global --yes --copy

The current skills CLI detects four installable workflows in the repository. A clean isolated installation has been verified to copy Code Review Gate into ~/.agents/skills/code-review-gate/. You can inspect the source first on GitHub or skills.sh.

When to invoke it

• before merging a pull request;
• before committing directly to a protected main branch;
• after an automated refactor touches several modules;
• before a deployment that changes authentication, payments or data handling;
• when a reviewer needs a structured first pass before human review.

What it deliberately does not do

The workflow does not certify security or compliance. It does not replace tests, static analysis or a responsible human reviewer. It also forbids automatic “fixes” for security findings: those are flagged for review because a mechanical patch can easily change policy or runtime behaviour.

Large changes need narrower review slices. If a change exceeds roughly 500 lines, the workflow asks for a smaller scope rather than pretending that a shallow scan is comprehensive.

A practical review output

The gate returns a verdict—approve, request changes or needs discussion—followed by checklists with file and line references. It also records how many files and findings were reviewed. If the verdict is approve, it may suggest a conventional commit message. The point is not ceremony; the point is making the evidence auditable.

Verdict: REQUEST CHANGES

Critical
- Remove hardcoded service token — examples/unsafe-user-route.js:2
- Replace concatenated SQL — examples/unsafe-user-route.js:6
- Add authorisation before returning records — examples/unsafe-user-route.js:4

Verification
- Files reviewed: 1
- Critical findings: 3

This is an explicitly labelled worked example against an intentionally unsafe fixture—not a customer claim. Read the complete fixture report and its limitations.

What the paid pack adds

Code review is one gate in a larger engineering path. The complete download adds separate workflows for reproducing and diagnosing failures, enforcing red-green-refactor, reviewing security exposure, scaffolding validated APIs, repairing migration drift, checking deployments, planning reversible refactors, shipping pull requests and writing incident post-mortems.

• ten editable SKILL.md workflows;
• plain files with no executable installer or platform lock-in;
• quickstart, manifest, changelog and single-user commercial licence;
• one £19 payment, immediate Stripe-gated download and 30-day refund policy.