Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
Use quick mode when user says "check this PR", "quick review", "sanity check my changes", or for pre-commit checks. Use the full review for PRs with security/architecture impact.
Usage
# Via orchestrate.sh${HOME}/.claude-octopus/plugin/scripts/orchestrate.sh spawn code-reviewer "Review this pull request for security issues"# Via auto-routing (detects review intent)${HOME}/.claude-octopus/plugin/scripts/orchestrate.sh auto "review the authentication implementation"
Capabilities
AI-powered code quality analysis
Security vulnerability detection
Performance optimization suggestions
Architecture and design pattern review
TDD compliance and test-first evidence review
Autonomous code generation risk detection
Best practices enforcement
Persona Reference
This skill wraps the code-reviewer persona defined in:
agents/personas/code-reviewer.md
CLI: codex-review
Model: gpt-5.2-codex
Phases: ink
Example Prompts
"Review this PR for OWASP Top 10 vulnerabilities"
"Analyze the error handling in src/api/"
"Check for memory leaks in the connection pool"
"Review the test coverage for the auth module"
Autonomous Implementation Review
When the review context indicates AI-assisted, Autonomous / Dark Factory, or unclear provenance, raise the rigor bar. Do not treat generated code as trustworthy just because it is polished.
TDD Evidence
Check for concrete signs that the change followed red-green-refactor rather than test-after implementation:
Compare the diff and recent history when available to see whether tests were added before or alongside production changes.
Prefer behavior-defining tests over snapshot-only or mock-heavy tests that merely restate the implementation.
Verify the production code looks like the minimum needed to satisfy the tests, rather than a speculative abstraction with unused options.
If evidence is missing, mark TDD compliance as unknown and do not assume TDD happened.
Autonomous Codegen Risk Patterns
Elevate or add findings when you see patterns common in high-autonomy output:
Option-heavy APIs or abstractions not justified by tests or current requirements
Placeholder logic, TODO/FIXME-driven control flow, or dead branches that appear "future ready"
Mock, fake, or dummy behavior leaking into production paths
Unwired components, unused helpers, or code that exists without an execution path
โ ๏ธ Low line count (if appropriate for the component)
Post Review to PR (v8.44.0)
After generating the review synthesis, check if the current branch has an open PR and offer to post findings as a PR comment.
Step 1: Detect Open PR
# Check if we're on a branch with an open PR
CURRENT_BRANCH=$(git rev-parse --abbrev-ref HEAD 2>/dev/null || echo"")
PR_NUM=""if [[ -n "$CURRENT_BRANCH" && "$CURRENT_BRANCH" != "main" && "$CURRENT_BRANCH" != "master" ]]; thenifcommand -v gh &>/dev/null; then
PR_NUM=$(gh pr list --head"$CURRENT_BRANCH" --json number --jq '.[0].number' 2>/dev/null || echo"")
fifi
Step 2: Post Review Comment
If an open PR exists, post the review findings as a PR comment:
if [[ -n "$PR_NUM" ]]; thenecho"Found open PR #${PR_NUM} on branch ${CURRENT_BRANCH}"# Build the review comment body from synthesis
REVIEW_BODY="## Code Review โ Claude Octopus
${REVIEW_SYNTHESIS}
---
*Review generated by Claude Octopus (/octo:review)*
*Providers: available external providers + ๐ต Claude*"# Post through the outbound credential gate. Never interpolate generated# Markdown directly into a gh shell argument.
REPO_SLUG=$(gh repo view --json nameWithOwner --jq .nameWithOwner)
if ! "${CLAUDE_PLUGIN_ROOT:-${HOME}/.claude-octopus/plugin}/scripts/safe-gh-comment.sh" \
--repo "$REPO_SLUG" pr-comment "$PR_NUM" - <<< "$REVIEW_BODY"; thenecho"GitHub write state is unknown; check for the review comment before retrying:" >&2
gh pr view "$PR_NUM" --repo "$REPO_SLUG" --comments || truereturn 1 2>/dev/null || exit 1
fiecho"Review posted to PR #${PR_NUM}"# Update agent registry if this agent is tracked
REGISTRY="${HOME}/.claude-octopus/plugin/scripts/agent-registry.sh"if [[ -x "$REGISTRY" ]]; then
AGENT_ID=$(git rev-parse --abbrev-ref HEAD 2>/dev/null || echo"")
"$REGISTRY" update "$AGENT_ID" --pr"$PR_NUM" 2>/dev/null || truefifi
If no PR exists: Skip posting, present review in terminal only.
If gh CLI not available: Skip posting, suggest user install GitHub CLI.
When to Auto-Post vs Ask
Auto-post: When invoked as part of /octo:deliver, /octo:factory, or /octo:embrace (automated workflows)
Ask first: When invoked standalone via /octo:review โ use AskUserQuestion:
"PR #N found. Post review findings as a PR comment?"
Options: "Yes, post to PR", "No, terminal only"
