Code Reviewer
An AI-powered code review skill that analyses diffs and produces actionable,
structured feedback — categorised by severity and type.
When to use this skill
- Automated first-pass review on every PR before human reviewers are assigned
- Security scanning for common vulnerability patterns (injection, secrets in code, SSRF)
- Style and convention enforcement without maintaining a linter config
Inputs
{
"diff": "<unified-diff string or GitHub PR URL>",
"language": "rust",
"rules": ["security", "performance", "style", "correctness"],
"severity_threshold": "warning"
}
| Field |
Required |
Description |
diff |
✓ |
Unified diff text or GitHub PR URL |
language |
✗ |
Hint for syntax-aware analysis (auto-detected) |
rules |
✗ |
Subset of review categories to run |
severity_threshold |
✗ |
Minimum severity to include: info/warning/error |
Review categories
| Category |
Examples |
security |
SQL injection, hardcoded secrets, SSRF, path traversal |
correctness |
Off-by-one, unchecked unwrap, wrong type conversions |
performance |
N+1 queries, unnecessary clones, blocking async calls |
style |
Naming conventions, dead code, missing docs |
Output format
{
"summary": "3 issues found (1 error, 2 warnings)",
"issues": [
{
"file": "src/handlers/auth.rs",
"line": 42,
"severity": "error",
"category": "security",
"message": "JWT secret read from environment without fallback validation",
"suggestion": "Validate that JWT_SECRET is non-empty at startup and reject empty strings."
},
{
"file": "src/db/query.rs",
"line": 88,
"severity": "warning",
"category": "performance",
"message": "N+1 query pattern detected inside loop",
"suggestion": "Batch the query outside the loop using an IN clause."
}
],
"score": 74,
"approved": false
}
CI integration (GitHub Actions)
- name: AI Code Review
uses: agentverse/run-skill@v1
with:
skill: agentverse-ci/code-reviewer
inputs: |
diff: ${{ github.event.pull_request.url }}
rules: [security, correctness]
severity_threshold: warning
env:
AGENTVERSE_TOKEN: ${{ secrets.AGENTVERSE_TOKEN }}
Notes
- The skill does not auto-approve PRs; it only produces feedback.
- Set
severity_threshold: error to surface only blocking issues.
- Combine with
api-smoke-tester for full pre-merge validation.
1---2name: code-reviewer3description: Reviews a pull request or diff and produces structured feedback on correctness, security, performance, and style.4license: MIT5---67# Code Reviewer89An AI-powered code review skill that analyses diffs and produces actionable,10structured feedback — categorised by severity and type.1112## When to use this skill1314- Automated first-pass review on every PR before human reviewers are assigned15- Security scanning for common vulnerability patterns (injection, secrets in code, SSRF)16- Style and convention enforcement without maintaining a linter config1718## Inputs1920```json21{22 "diff": "<unified-diff string or GitHub PR URL>",23 "language": "rust",24 "rules": ["security", "performance", "style", "correctness"],25 "severity_threshold": "warning"26}27```2829| Field | Required | Description |30|----------------------|----------|------------------------------------------------------|31| `diff` | ✓ | Unified diff text or GitHub PR URL |32| `language` | ✗ | Hint for syntax-aware analysis (auto-detected) |33| `rules` | ✗ | Subset of review categories to run |34| `severity_threshold` | ✗ | Minimum severity to include: `info`/`warning`/`error`|3536## Review categories3738| Category | Examples |39|-----------------|-------------------------------------------------------|40| `security` | SQL injection, hardcoded secrets, SSRF, path traversal|41| `correctness` | Off-by-one, unchecked unwrap, wrong type conversions |42| `performance` | N+1 queries, unnecessary clones, blocking async calls |43| `style` | Naming conventions, dead code, missing docs |4445## Output format4647```json48{49 "summary": "3 issues found (1 error, 2 warnings)",50 "issues": [51 {52 "file": "src/handlers/auth.rs",53 "line": 42,54 "severity": "error",55 "category": "security",56 "message": "JWT secret read from environment without fallback validation",57 "suggestion": "Validate that JWT_SECRET is non-empty at startup and reject empty strings."58 },59 {60 "file": "src/db/query.rs",61 "line": 88,62 "severity": "warning",63 "category": "performance",64 "message": "N+1 query pattern detected inside loop",65 "suggestion": "Batch the query outside the loop using an IN clause."66 }67 ],68 "score": 74,69 "approved": false70}71```7273## CI integration (GitHub Actions)7475```yaml76- name: AI Code Review77 uses: agentverse/run-skill@v178 with:79 skill: agentverse-ci/code-reviewer80 inputs: |81 diff: ${{ github.event.pull_request.url }}82 rules: [security, correctness]83 severity_threshold: warning84 env:85 AGENTVERSE_TOKEN: ${{ secrets.AGENTVERSE_TOKEN }}86```8788## Notes8990- The skill does **not** auto-approve PRs; it only produces feedback.91- Set `severity_threshold: error` to surface only blocking issues.92- Combine with `api-smoke-tester` for full pre-merge validation.93
loonghao