This skill should be used when the user asks to "review code", "do a code review", "review my branch", "review MR !1234", "review PR
Orchestrate comprehensive code reviews by coordinating multiple review skills and subagents in parallel, then consolidate findings into actionable reports.
This skill manages the complete code review workflow:
Current Status: ๐ Debug mode is ENABLED
This skill includes debug outputs (marked with ๐) to help track execution progress:
[Step X/6][Checkpoint N]To disable debug mode: Remove all lines marked with ๐ from this skill file.
Trigger this skill when users request code review with phrases like:
DEBUG MODE ENABLED: This skill includes debug outputs to track execution progress.
๐ DEBUG [Step 1/6]: Starting - Determine Review Scope
Identify what code to review based on user input:
Review Sources:
feature/auth) - review all changes in branchfeature/auth vs dev) - IMPORTANT: Find merge base and diff from merge base to branch A's HEADRequired Information:
For Full Project Review: When user asks to "review entire project" or "review all code":
๐ DEBUG [Step 2/6]: Establishing working directory
IMPORTANT: Working directory name MUST include date and sequence number to avoid conflicts.
Directory Naming Convention: {review_name}-{YYYYMMDD}-{sequence}
Generate unique working directory:
# Get current date
DATE=$(date +%Y%m%d)
# Base directory name
BASE_DIR="{review_name}-${DATE}"
# Find existing directories with same base
EXISTING=$(ls -d reviews/${BASE_DIR}-* 2>/dev/null | wc -l)
# Calculate next sequence number
SEQUENCE=$((EXISTING + 1))
# Final directory name
WORKING_DIR="${BASE_DIR}-${SEQUENCE}"
Examples:
First review on 2026-01-30: mr557-aihub-refactor-20260130-1
Second review on same day: mr557-aihub-refactor-20260130-2
First review next day: mr557-aihub-refactor-20260131-1
Full path: {project_root}/reviews/{review_name}-{YYYYMMDD}-{sequence}
Implementation:
# Example implementation
project_root="/home/user/myapp"
review_name="auth-feature"
date=$(date +%Y%m%d)
# Check for existing reviews today
existing_dirs=$(find "$project_root/reviews" -maxdepth 1 -name "${review_name}-${date}-*" | wc -l)
sequence=$((existing_dirs + 1))
working_dir="$project_root/reviews/${review_name}-${date}-${sequence}"
mkdir -p "$working_dir"
Ask user for confirmation with generated directory name (optional, can be auto-generated)
Directory Structure:
reviews/{review_name}-{YYYYMMDD}-{sequence}/
โโโ code-context.json # All review metadata
โโโ diff.patch # Git diff output
โโโ commits.json # Commit history
โโโ branch-info.json # Branch details
โโโ DEBUG-SESSION.md # Debug session log (always uppercase)
โโโ {review_name}-{YYYYMMDD}-{sequence}-comprehensive-summary.md # Final report
โโโ reports/ # Individual skill reports
โโโ skill1-report.md
โโโ skill2-report.md
โโโ ...
IMPORTANT File Naming Conventions:
{review_name}-{YYYYMMDD}-{sequence} (date + sequence for uniqueness){review_name}-{YYYYMMDD}-{sequence}-comprehensive-summary.md (include date+sequence)DEBUG-SESSION.md (always uppercase, fixed name){skill-name}-report.md (use skill's short name)๐ DEBUG [Step 3/6]: Collecting code context and metadata
Collect comprehensive review information and save to working directory:
Use scripts/collect-review-data.sh to automate data collection.
Save as code-context.json:
{
"review_type": "branch_comparison|branch|mr|pr",
"source_branch": "feature/auth",
"target_branch": "dev",
"merge_base": "abc123",
"mr_number": "!1234",
"pr_number": "567",
"repository": "git@gitlab.com:group/project.git",
"project_path": "/path/to/project",
"working_directory": "/path/to/reviews/auth-feature-20260130-1",
"review_date": "2026-01-30",
"review_sequence": 1,
"timestamp": "2026-01-30T14:30:22Z"
}
Save as diff.patch:
git diff merge_base...source_branch for branch comparisongit diff dev...feature/auth format (three dots) for correct merge baseSave as commits.json:
{
"commits": [
{
"hash": "def456",
"author": "John Doe",
"date": "2025-01-28T09:00:00Z",
"message": "Add login form",
"files_changed": ["src/auth/login.js"]
}
]
}
Save as branch-info.json:
{
"source_branch": {
"name": "feature/auth",
"head_commit": "def456",
"is_merged": false
},
"target_branch": {
"name": "dev",
"head_commit": "abc123"
}
}
For Full Project Review (non-Git or multi-project):
{
"review_type": "full_project",
"review_name": "full-project-review",
"working_directory": "/path/to/reviews/full-project-review-20260130-1",
"review_date": "2026-01-30",
"review_sequence": 1,
"projects": [
{
"name": "frontend",
"path": "/path/to/frontend",
"tech_stack": ["Nuxt.js", "Vue 2"],
"language": "javascript"
},
{
"name": "backend",
"path": "/path/to/backend",
"tech_stack": ["Spring Boot", "MyBatis"],
"language": "java"
}
]
}
Critical for Branch Comparison: When comparing branch A vs branch B:
git merge-base A Bgit diff merge_base...AConfirm with User: After collecting code context, present to user using AskUserQuestion tool:
๐ DEBUG [Checkpoint 1]: Display collected information and request confirmation
IMPORTANT: Use AskUserQuestion tool for user confirmation, not text prompts.
Example AskUserQuestion call:
AskUserQuestion(
questions=[
{
"question": "ไปฃ็ ๅฎกๆฅไฟกๆฏๅทฒๆถ้๏ผๆฏๅฆ็ปง็ปญ๏ผ",
"header": "็กฎ่ฎคๅฎกๆฅ",
"options": [
{
"label": "็ปง็ปญๅฎกๆฅ",
"description": "ๅผๅงๆง่กไปฃ็ ๅฎกๆฅ๏ผๅฏๅจๅนถ่กๅญไปฃ็"
},
{
"label": "ๅๆถ",
"description": "ๅๆถๆฌๆฌกๅฎกๆฅ๏ผ้ๅบๆ่ฝ"
}
],
"multiSelect": false
}
]
)
Information to present in question description:
Review Type: Full project review
Projects: 2 projects (frontend, backend)
Frontend:
- Path: /projects/bupt/eduiot-lab
- LOC: ~13,800
- Tech Stack: Nuxt.js, Vue 2, Element UI
Backend:
- Path: /projects/bupt/space-server
- LOC: ~7,000
- Tech Stack: Spring Boot, MyBatis, MySQL
Working Directory: /projects/bupt/reviews/full-project-review-20260130-1
๐ DEBUG: Wait for user confirmation via AskUserQuestion before proceeding
DO NOT proceed to Step 4 without user confirmation.
๐ DEBUG [Step 4/6]: Discovering available review skills
๐ DEBUG: Check system-reminder for available skills list
Identify which code review skills are available in the current environment.
Check available skills: Look for skills with these patterns in their description:
Common review skills:
code-review:code-review - General code reviewcode-review-orchestrator - Orchestrates parallel reviews (this skill)pr-review-toolkit:review-pr - Comprehensive PR review with multi-dimensional analysispr-review-toolkit:silent-failure-hunter - Silent failure and error handling detectionpr-review-toolkit:code-simplifier - Code simplification and clarity analysispr-review-toolkit:comment-analyzer - Comment accuracy and completeness reviewpr-review-toolkit:pr-test-analyzer - Test coverage and quality analysis for PRspr-review-toolkit:type-design-analyzer - Type design and encapsulation reviewsuperpowers:code-reviewer - Post-development review against plansuperpowers:receiving-code-review - Receiving and implementing code review feedbackcode-documentation:code-reviewer - Elite code review expertsecurity-scanning:security-auditor - Security vulnerability scansecurity-scanning:threat-modeling-expert - Threat modeling and security analysiscomprehensive-review:code-reviewer - Deep code analysis and architecture reviewcomprehensive-review:architect-review - Architecture and design pattern reviewcomprehensive-review:security-auditor - Comprehensive security auditcode-review-ai:code-review - AI-powered code reviewcodebase-cleanup:code-reviewer - Codebase cleanup and optimization reviewfeature-dev:code-reviewer - Feature development code reviewfeature-dev:code-explorer - Code exploration and understandingSkill Discovery Process:
Present options to user using AskUserQuestion tool:
๐ DEBUG [Checkpoint 2]: Display discovered skills and request selection
IMPORTANT: Use AskUserQuestion tool for skill selection, not text prompts.
Example AskUserQuestion call:
# Dynamically build options based on available skills
skill_options = [
{"label": "code-review:code-review", "description": "้็จไปฃ็ ่ดจ้ๅฎกๆฅ"},
{"label": "pr-review-toolkit:review-pr", "description": "ๅ
จ้ข็PR/MRๅฎกๆฅ"},
{"label": "security-scanning:security-auditor", "description": "ๅฎๅ
จๆผๆดๆซๆ"},
# ... add more discovered skills
]
AskUserQuestion(
questions=[
{
"question": f"ๅ็ฐ {len(skill_options)} ไธชๅฎกๆฅๆ่ฝใ่ฏท้ๆฉ่ฆไฝฟ็จ็ๆ่ฝ๏ผ",
"header": "้ๆฉๅฎกๆฅๆ่ฝ",
"options": skill_options + [
{
"label": "ไฝฟ็จๆๆๆ่ฝ",
"description": "ไฝฟ็จๆๆๅ็ฐ็ๆ่ฝ่ฟ่กๅ
จๆนไฝๅฎกๆฅ"
},
{
"label": "ๆจ่็ปๅ",
"description": "ไฝฟ็จๆจ่็ๆ่ฝ็ปๅ๏ผ้็จๅฎกๆฅ + ๅฎๅ
จๅฎกๆฅ + PRๅฎกๆฅ๏ผ"
}
],
"multiSelect": True
}
]
)
Information to include in question:
Found {count} review skills:
1. skill-name - Brief description
2. skill-name - Brief description
...
Projects to review:
- Project details...
Recommended: Use 2-4 different skills for comprehensive coverage
๐ DEBUG: Show user's skill selection: [skill1, skill2, ...]
Ask user to select which skills to use using AskUserQuestion. DO NOT proceed to Step 5 without user skill selection.
๐ DEBUG [Step 5/6]: Launching parallel subagents with review skills
๐ DEBUG: Show selected skills and subagent configuration before launch
Use Task tool with run_in_background=true to launch multiple subagents in parallel.
CRITICAL: Each subagent MUST use a DIFFERENT review skill via the Skill tool.
Example parallel launch:
๐ DEBUG [Checkpoint 3]: Display subagent launch configuration
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
๐ Launching Parallel Subagents
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
Subagent 1: code-review:code-review
- Review scope: Frontend (Nuxt.js)
- Output: reports/code-review-report.md
Subagent 2: security-scanning:security-auditor
- Review scope: Both projects
- Output: reports/security-report.md
Subagent 3: pr-review-toolkit:review-pr
- Review scope: All files
- Output: reports/pr-review-report.md
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
๐ DEBUG: Track subagent status
Agent 1 (code-review): โณ Starting...
Agent 2 (security): โณ Starting...
Agent 3 (pr-review): โณ Starting...
Provide each subagent with:
code-context.jsondiff.patch (for git reviews) OR project paths (for full project review)reports/{skill-name}-report.mdSubagent Prompt Template:
You are reviewing code as part of a comprehensive code review.
**Your assigned skill**: {skill_name}
**Task**:
1. Use the Skill tool to invoke: {skill_name}
2. Provide the skill with:
- Review scope: {scope_description}
- Code location: {code_path}
- Any additional context from code-context.json
3. Generate a comprehensive report following that skill's workflow
4. Save your report to: {output_path}
**IMPORTANT**:
- You MUST use the Skill tool to invoke {skill_name}
- Do NOT review code manually - let the skill guide you
- The skill will provide the specific review methodology
- Follow the skill's workflow exactly
Example Task tool calls:
Task 1:
subagent_type: general-purpose
description: Review using code-review:code-review
run_in_background: true
prompt: |
You are reviewing the frontend code using the code-review:code-review skill.
Project path: /projects/bupt/eduiot-lab
Output: /projects/bupt/reviews/full-project-review/reports/code-review-report.md
Use the Skill tool to invoke code-review:code-review
Task 2:
subagent_type: general-purpose
description: Review using security-scanning:security-auditor
run_in_background: true
prompt: |
You are reviewing both frontend and backend for security issues.
Frontend: /projects/bupt/eduiot-lab
Backend: /projects/bupt/space-server
Output: /projects/bupt/reviews/full-project-review/reports/security-report.md
Use the Skill tool to invoke security-scanning:security-auditor
Task 3:
subagent_type: general-purpose
description: Review using pr-review-toolkit:review-pr
run_in_background: true
prompt: |
You are reviewing code quality using pr-review-toolkit:review-pr skill.
Review all files in both projects.
Output: /projects/bupt/reviews/full-project-review/reports/pr-review-report.md
Use the Skill tool to invoke pr-review-toolkit:review-pr
File Writing Strategy:
reports/ directory exists before launching subagentsWait for all subagents to complete using TaskOutput tool before proceeding to Step 6.
๐ DEBUG: Show subagent completion status
Agent 1 (code-review): โ
Complete
Agent 2 (security): โ
Complete
Agent 3 (pr-review): โ
Complete
All reports generated successfully!
๐ DEBUG [Step 6/6]: Generating consolidated summary from all reports
๐ DEBUG [Checkpoint 4]: Display report collection status
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
๐ Collecting Reports from Subagents
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
Found 3 reports in reports/ directory:
โ code-review-report.md (32 issues found)
โ security-report.md (19 issues found)
โ pr-review-report.md (25 issues found)
Total issues to consolidate: 76 issues
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
๐ DEBUG: Show categorization progress
Categorizing issues by severity...
- Critical: 3 issues
- High: 13 issues
- Medium: 31 issues
- Low: 29 issues
Read all individual reports from reports/ directory.
Analyze findings and categorize by severity:
Create {review_name}-{YYYYMMDD}-{sequence}-comprehensive-summary.md:
IMPORTANT File Naming Convention:
{review_name}-{YYYYMMDD}-{sequence}-comprehensive-summary.md (include date+sequence)DEBUG-SESSION.md (always uppercase, fixed name)Structure:
# Code Review Comprehensive Summary: {review_name}
## ๐ค Review Skills Used
This review used multiple AI skills, each analyzing from different perspectives:
| Skill Name | Focus Area | Key Contributions |
|------------|------------|-------------------|
| code-review:code-review | ไปฃ็ ่ดจ้ไธๆไฝณๅฎ่ทต | ไปฃ็ ่ง่ใๆฝๅจbugใๅฏ็ปดๆคๆง |
| security-scanning:security-auditor | ๅฎๅ
จๆผๆดๅฎก่ฎก | OWASP Top 10ใๆณจๅ
ฅๆปๅปใ่ฎค่ฏๆๆ |
| pr-review-toolkit:review-pr | ๅ
จ้ขPRๅฎกๆฅ | ๅ่ฝๅฎๆดๆงใๆต่ฏ่ฆ็ใๆๆกฃ |
**Total Issues Found**: X issues (after deduplication)
## Overview
- Review Type: Branch comparison (feature/auth vs dev)
- Commits: 5 commits
- Files changed: 12 files
- Review Skills: 3 skills used in parallel
- Date: 2025-01-28
## Findings Summary
- Critical: 2 issues
- High: 5 issues
- Medium: 8 issues
- Low: 3 issues
## ๐ด Critical Issues
### 1. SQL Injection Risk in auth/login.js
- **Location**: `src/auth/login.js:45`
- **Severity**: Critical
- **Found by**: code-review:code-review, security-scanning:security-auditor
- **Issue**: User input directly concatenated into SQL query
- **Recommendation**: Use parameterized queries
- **Code snippet**:
```javascript
// Current (unsafe)
const query = `SELECT * FROM users WHERE name = '${username}'`
// Suggested (safe)
const query = 'SELECT * FROM users WHERE name = ?'
db.query(query, [username])
src/auth/check.js:12src/api/client.js:78src/utils/helpers.js:3Issues Found: X Focus: ไปฃ็ ่ดจ้ไธๆไฝณๅฎ่ทต Key Findings:
Issues Found: Y Focus: ๅฎๅ จๆผๆดๅฎก่ฎก Key Findings:
Issues Found: Z Focus: ๅ จ้ขPRๅฎกๆฅ Key Findings:
Individual skill reports:
### Step 7: Interactive Issue Resolution
**After generating summary, present actionable next steps:**
Found 18 issues. Which issues would you like to fix?
Options:
Enter your choice:
**If user chooses to fix issues:**
- Use appropriate development skills (e.g., `feature-dev:feature-dev`)
- Create implementation plan for fixes
- Apply fixes with user confirmation
- Verify fixes don't introduce new issues
## Additional Resources
### Scripts
- **`scripts/collect-review-data.sh`** - Automates collection of diff, commits, branch info
- **`scripts/find-merge-base.sh`** - Finds merge base for branch comparison
- **`scripts/launch-subagents.sh`** - Launches parallel review subagents
### References
- **`references/subagent-coordination.md`** - Detailed guide on coordinating multiple subagents
- **`references/report-formatting.md`** - Report structure and formatting standards
- **`references/issue-categories.md`** - Issue classification and severity guidelines
### Examples
- **`examples/review-session-output/`** - Complete example of a review session
- **`examples/code-context-example.json`** - Sample code context file
- **`examples/summary-example.md`** - Sample consolidated summary
## Best Practices
### Branch Comparison
**Always use three-dot diff** (`git diff A...B`) for branch comparison:
- `git diff dev...feature/auth` - Changes since branches diverged
- NOT `git diff dev feature/auth` - Changes between branch heads (wrong)
**Example:**
```bash
# Find merge base
MERGE_BASE=$(git merge-base dev feature/auth)
# Diff from merge base to feature branch
git diff $MERGE_BASE...feature/auth > diff.patch
When reviewing entire projects or multiple independent projects:
1. Discover Project Structure
ls and find to understand directory layout2. Collect Project Metadata
# Example: Frontend project
cd /projects/bupt/eduiot-lab
find . -name "*.vue" -o -name "*.js" | wc -l # Count files
cat package.json # Identify framework
# Example: Backend project
cd /projects/bupt/space-server
find . -name "*.java" | wc -l # Count files
cat pom.xml # Identify framework
3. Use Appropriate Review Skills
4. Coordinate Subagent Communication
Launch subagents in parallel using Task tool with run_in_background=true:
subagent_type: general-purpose
run_in_background: true
prompt: |
Review the code in /path/to/diff.patch
Use the code-review:code-review skill
Output report to /path/to/reports/code-review-report.md
Wait for completion using TaskOutput tool before generating summary.
Read all reports before generating summary:
Categorize issues using severity guidelines in references/issue-categories.md.
Ask before making changes:
Problem: Commands like cd space-server fail with "No such file or directory"
Root Cause: Skill assumes git workflow, but user has independent projects
Solutions:
cd - use full paths in commandsExample:
# WRONG
cd space-server && git log
# RIGHT
cd /projects/bupt/space-server && git log
# OR
git -C /projects/bupt/space-server log
Problem: Empty diff.patch file
Solutions:
git log --oneline A..B to verify commits existProblem: Subagent crashes or times out
Solutions:
Problem: Report files not created in reports/ directory
Root Cause: Subagents may not have write permissions or Write tool access
Solutions:
reports/ directory before launching subagentsPattern:
# Main agent
mkdir -p reports/
# Launch subagent with fallback instruction
Task(prompt: |
1. Perform review using {skill}
2. Try to save report to: reports/{skill}-report.md
3. If Write tool fails, output full report as markdown text
4. Include "REPORT_START" and "REPORT_END" markers
)
# Main agent collects output
TaskOutput(task_id, block=true)
Read output file, extract report between markers
Save using Write tool
Problem: No review skills found or presented to user
Solutions:
Problem: Multiple skills report same issue
Solutions:
git diff A..B): Diff between A and B tipsgit diff A...B): Diff from merge base to B (correct for review)