Agent skill

Cr Code Gate

by LeoYeAI in LeoYeAI/openclaw-master-skills

【Code Review 子 Agent · 门控二】对 git diff 逐项执行代码质量门控检查(运行时异常、性能瓶颈、安全漏洞、权限缺失、破坏性变更等 10 项),按 LOGAF h/m/l 分级输出,h 级清零后方可进入门控三。由 spec-driven-dev 的 codereview 阶段自动调用。

MITAuto-check passedDevelopment

Install Cr Code Gate

skills CLI
$ npx skills add LeoYeAI/openclaw-master-skills --skill cr-code-gate -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install LeoYeAI/openclaw-master-skills cr-code-gate --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/LeoYeAI/openclaw-master-skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/spec-driven-dev/sub-skills/cr-code-gate .claude/skills/cr-code-gate && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
cr-code-gate
GitHub stars
2.2k
Token cost
~1.2k tokens
SKILL.md length
276 words
Files
1
Skills in repo
1,215
Repo updated
First seen
Licence
MIT

At a glance

【Code Review 子 Agent · 门控二】对 git diff 逐项执行代码质量门控检查(运行时异常、性能瓶颈、安全漏洞、权限缺失、破坏性变更等 10 项),按 LOGAF h/m/l 分级输出,h 级清零后方可进入门控三。由 spec-driven-dev 的 codereview 阶段自动调用。

  • Works in 6 steps: 发出启动检查点 → 读取上下文 → 逐项执行门控检查 → …
  • Tasks that involve Spec-driven development
  • SKILL.md covers 调用契约, 执行协议, 门控检查项 and 裁决规则, plus 1 more section
  • Calls git; needs API_KEY

What it does

Cr Code Gate is an agent skill from LeoYeAI/openclaw-master-skills. 【Code Review 子 Agent · 门控二】对 git diff 逐项执行代码质量门控检查(运行时异常、性能瓶颈、安全漏洞、权限缺失、破坏性变更等 10 项),按 LOGAF h/m/l 分级输出,h 级清零后方可进入门控三。由 spec-driven-dev 的 codereview 阶段自动调用。

Its SKILL.md is about 1.2k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in Development, covering Spec-driven development and Code review. It works with Git. The repository describes itself as: 🧠 Curated collection of 1209+ best OpenClaw skills — weekly updated by MyClaw.ai. The licence is MIT.

When your agent uses it

  • Tasks that involve Spec-driven development
  • Tasks that involve Code review

Example prompts

  • “/cr-code-gate”

Requirements

  • A credential in API_KEY

Workflow steps

6 steps, taken from the step headings in SKILL.md.

  1. 发出启动检查点
  2. 读取上下文
  3. 逐项执行门控检查
  4. 输出逐条发现
  5. 返回结构化结果
  6. 发出结束检查点

What it can do on your machine

Read from SKILL.md and the folder at commit e5199b5. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Shell commands in SKILL.md call:

    • git

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md. Its commands use git, which can reach the network depending on how they are called.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names these keys or tokens, usually read from environment variables:

    • API_KEY

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Cr Code Gate loads about 1.2k tokens when it runs. Until then it costs about 43 tokens; SKILL.md has 276 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~43
When it runs · the whole SKILL.md, loaded when a task matches
~1.2k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from LeoYeAI/openclaw-master-skills at commit e5199b5, republished under its MIT licence (© LeoYeAI). 276 words, ~1,164 tokens.

Download SKILL.mdSave it as .claude/skills/cr-code-gate/SKILL.md (or your agent's skills folder).
name
cr-code-gate
description
【Code Review 子 Agent · 门控二】对 git diff 逐项执行代码质量门控检查(运行时异常、性能瓶颈、安全漏洞、权限缺失、破坏性变更等 10 项),按 LOGAF h/m/l 分级输出,h 级清零后方可进入门控三。由 spec-driven-dev 的 code_review 阶段自动调用。
user-invocable
false

cr-code-gate

Code Review 流水线的第二道门控:代码质量静态门控子 Agent。 由 spec-driven-dev 的 code_review 阶段在 cr-commit-check 通过后调用, 对 diff 进行结构性问题扫描,参照 Sentry 工程实践的必检项分类。


调用契约

输入(由 Orchestrator 注入上下文)
字段类型说明
us_idstring用户故事 ID
iter_idstring当前迭代 ID
git_diffstringgit diff main...HEAD 的完整输出
iter_summary_pathstringrequirements/{us_id}/docs/iteration_summary/current_iter.md 路径,用于核查架构变更审批记录
coding_standards_pathstringauxiliary/coding_standards.md 路径

Orchestrator 调用示例(OpenCode Sub-Agent 格式):

invoke_skill: cr-code-gate
with:
  us_id: "US042"
  iter_id: "iter_003"
  git_diff: "<diff output>"
  iter_summary_path: "requirements/US042/docs/iteration_summary/current_iter.md"
  coding_standards_path: "auxiliary/coding_standards.md"
输出(写回 Orchestrator)
json
{
  "agent": "cr-code-gate",
  "verdict": "PASS | WARN | FAIL",
  "h_count": 0,
  "m_count": 0,
  "l_count": 0,
  "findings": [
    {
      "id": "GK-01",
      "logaf": "h",
      "result": "PASS | FAIL | WARN",
      "file": "src/foo.py:42",
      "description": "…",
      "suggestion": "…"
    }
  ]
}

执行协议

Step 0 — 发出启动检查点
[AGENT:cr-code-gate] START  us_id={us_id}  iter_id={iter_id}
Step 1 — 读取上下文
  1. 解析 git_diff,提取所有变更文件和具体行变更。
  2. 读取 current_iter.md,检索是否有架构/Schema 变更的 senior 确认记录(供 GK-08 使用)。
  3. 读取 coding_standards.md,获取项目命名与规范约定(供 GK-10 使用)。
Step 2 — 逐项执行门控检查

对 diff 中每一个变更文件/代码块执行以下 10 项检查:


门控检查项

h 级(任意一项命中 → 整体 FAIL)
GK-01 · 运行时异常
  • 数组 / 切片越界访问(未校验长度)
  • 空指针 / nil 解引用(未做 nil check)
  • 未捕获的异常 / error 被静默丢弃(_ = err)
  • goroutine / async 中 panic 未 recover
GK-02 · 性能瓶颈
  • 无界循环内嵌套 DB 查询(N+1 问题)
  • 算法复杂度 O(n²) 或更高且 n 无上界
  • 大对象(> 1 MB)在请求热路径中进行 JSON 序列化/反序列化
  • 无缓存的重复计算
GK-03 · 安全漏洞
  • SQL / NoSQL 注入(字符串拼接构造查询)
  • XSS(未转义的用户输入直接输出到 HTML)
  • 硬编码密钥、Token、密码(含正则 (api_key|secret|password|token)\s*=\s*['"][^'"]+['"])
  • 不安全的反序列化(pickle.loads、eval、exec 处理用户数据)
  • 路径遍历(../ 未过滤的文件路径拼接)
GK-04 · 权限 / 访问控制缺失
  • 新增 API 端点缺少鉴权装饰器 / 中间件
  • 删除操作未校验资源所有权
  • 管理员接口对普通用户可访问
GK-05 · API 破坏性变更
  • 公开 REST / GraphQL 字段被重命名或删除
  • 必填参数的默认值被移除
  • 响应 Schema 中字段类型变更(如 string → int)
GK-06 · 意外行为修改
  • 变更触及了本次迭代 scope 之外的既有逻辑
  • 全局常量 / 配置默认值被修改
  • 共享工具函数语义变更(影响其他调用方)

m 级(命中 → WARN,记录后可继续)
GK-07 · 测试覆盖不足
  • 新增的业务逻辑没有对应的单元测试
  • 测试用例中存在 if/for 分支,可能掩盖测试本身的缺陷
  • 缺少模拟权限场景的测试(正向 + 越权拒绝)
GK-08 · 重大架构 / Schema 变更未审批
  • 引入新的外部框架或库依赖
  • 数据库字段新增 / 删除 / 类型变更
  • JSON Schema 或 protobuf 定义变更
  • 以上任意情形在 current_iter.md 中无 senior 确认记录

l 级(命中 → INFO,可选修复)
GK-09 · 多余或遗留代码
  • 已注释掉的代码块(连续 3 行以上)
  • 调试语句(print()、console.log()、fmt.Println()、System.out.println())
  • 标注日期超过当前迭代开始日期 30 天的 TODO / FIXME
GK-10 · 命名与规范一致性
  • 变量 / 函数 / 文件 / 指标命名与 coding_standards.md 约定不一致
  • 文件名大小写与现有同目录文件风格不符
  • logger / metric 命名不遵循项目既有前缀约定

Step 3 — 输出逐条发现

每条发现使用统一格式:

[{logaf}] {GK-ID} | 文件: {path}:{line} | 问题: {描述} | 建议: {可操作方案}

示例:

[h] GK-03 | 文件: src/auth/handler.py:47 | 问题: API Key 硬编码在源文件 | 建议: 改为 os.getenv("API_KEY"),在 .env.example 添加占位符
[h] GK-01 | 文件: src/db/query.py:83    | 问题: result[0] 访问前未检查列表长度 | 建议: 改为 result[0] if result else None
[m] GK-07 | 文件: tests/test_auth.py     | 问题: 缺少越权访问的拒绝场景测试 | 建议: 新增 test_access_denied_for_non_owner
[l] GK-09 | 文件: src/utils/parser.py:12 | 问题: 注释掉的旧代码块 | 建议: 删除或移至 CHANGELOG
Step 4 — 返回结构化结果
json
{
  "agent": "cr-code-gate",
  "verdict": "FAIL",
  "h_count": 2,
  "m_count": 1,
  "l_count": 1,
  "findings": [
    {
      "id": "GK-03", "logaf": "h", "result": "FAIL",
      "file": "src/auth/handler.py:47",
      "description": "API Key 硬编码",
      "suggestion": "改为 os.getenv('API_KEY')"
    }
  ]
}
Step 5 — 发出结束检查点
[AGENT:cr-code-gate] DONE  verdict=PASS|WARN|FAIL  h={N}  m={N}  l={N}

裁决规则

裁决条件Orchestrator 行为
PASS所有 h 级检查项均无命中(m/l 可有)继续调用 cr-logaf-review
WARN无 h 级命中,存在 m/l 级发现继续调用 cr-logaf-review,m/l 发现传入汇总报告
FAIL任意 h 级检查项命中终止流水线,阻塞 release,返回修复清单

禁止行为

  • 禁止对 h 级问题降级为 m 或 l,即使代码作者附有解释。
  • 禁止对 diff 之外的既有代码发起检查(只扫描本次变更行)。
  • 禁止在 git_diff 为空时静默通过,应报告 GK-06 INFO(本次无代码变更)。
  • 禁止自动修改任何源文件,只输出建议和修复指引。

© LeoYeAI, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in skills/spec-driven-dev/sub-skills/cr-code-gate of LeoYeAI/openclaw-master-skills.

Open the folder on GitHubat commit e5199b5

Compare with similar skills

Cr Code Gate next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Cr Code Gate compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Cr Code Gate this skillLeoYeAI/openclaw-master-skills2.2k—~1.2kAutomated safety check: PassMIT
Tbdjlevy/strif131—~3.5kAutomated safety check: PassMIT
Code Review ChecklistshareAI-lab/learn-claude-code78k5 repos~1.1kAutomated safety check: PassMIT
Understand Diff AnalysisEgonex-AI/Understand-Anything85k1 repos~1.4kAutomated safety check: PassMIT
Open Code Review CLIalibaba/open-code-review44k—~3.1kAutomated safety check: PassApache-2.0
Open Code Review Delegatealibaba/open-code-review44k—~2kAutomated safety check: PassApache-2.0

Similar skills

  • Tbd

    jlevy/strif

    Git-native issue tracking (beads), coding guidelines, knowledge injection, and spec-driven planning for AI agents.

    131 GitHub stars~3.5k tokensUpdated 4 mo ago
    DevelopmentAuto-check passed
  • Code Review Checklist

    shareAI-lab/learn-claude-code

    Reviews code against a five-part checklist covering security, correctness, performance, maintainability and testing, and reports findings in a fixed format.

    78k GitHub starsUsed in 5 repos~1.1k tokens
    DevelopmentAuto-check passed
  • Understand Diff Analysis

    Egonex-AI/Understand-Anything

    Reads your git changes or a pull request against a prebuilt knowledge graph of the project to explain what changed, which components are affected and what is risky.

    85k GitHub starsUsed in 1 repo~1.4k tokens
    DevelopmentAuto-check passed
  • Open Code Review CLI

    alibaba/open-code-review

    Runs the ocr command-line tool to review Git changes, a commit or a branch comparison with an AI model, returning line-level comments and optionally applying fixes.

    44k GitHub stars~3.1k tokensUpdated 2 days ago
    DevelopmentAuto-check passed
  • Open Code Review Delegate

    alibaba/open-code-review

    Has the host agent do the code review itself while the ocr CLI handles file selection and rule lookup, covering workspace changes, branch ranges or single commits.

    44k GitHub stars~2k tokensUpdated 2 days ago
    DevelopmentAuto-check passed
  • Official

    Fetches a pull request's canonical review state as JSON, validates it, and renders markdown, a text summary and triage target files from it using bundled scripts.

    48k GitHub stars~767 tokensUpdated today
    DevelopmentAuto-check passed

More from LeoYeAI/openclaw-master-skills

All 1,215 skills in this repo
  • DevOps Pipeline Management

    LeoYeAI/openclaw-master-skills

    Manages pipelines on a DevOps quality and efficiency platform through its OpenAPI: list workspaces and templates, create, update, run and cancel pipelines, and read run records.

    2.2k GitHub stars~4.2k tokensUpdated 2 mo ago
    Auto-check: notes
  • Feishu Document Collaboration

    LeoYeAI/openclaw-master-skills

    Patches OpenClaw's Feishu extension so an edited document triggers an isolated agent session that reads the doc and replies inline, turning it into a live chat space.

    2.2k GitHub stars~2k tokensUpdated 2 mo ago
    Auto-check passed
  • Files Memory System

    LeoYeAI/openclaw-master-skills

    Multi-context memory management system for OpenClaw agents with group-isolated storage, global shared memory, workspace organization, and group-specific skills isolation.

    2.2k GitHub stars~3.8k tokensUpdated 2 mo ago
    Auto-check passed
  • GEO-Claw AI Visibility Agent

    LeoYeAI/openclaw-master-skills

    Runs a brand's AI-search visibility work end to end: diagnosing how AI platforms represent it, repositioning it, producing AI-optimized content and monitoring ongoing mentions.

    2.2k GitHub stars~4.7k tokensUpdated 2 mo ago
    Auto-check passed
  • Google Workspace CLI

    LeoYeAI/openclaw-master-skills

    Installs and authenticates the gws CLI, then automates Gmail, Drive, Sheets, Calendar, Docs, Chat and Tasks with ready-made recipes, persona bundles and security audits.

    2.2k GitHub stars~2.6k tokensUpdated 2 mo ago
    Auto-check: notes
  • HealthFit Health Advisors

    LeoYeAI/openclaw-master-skills

    Runs four advisor roles, a fitness coach, nutritionist, data analyst and TCM practitioner, to build a health profile and track workouts, diet and wellness over time.

    2.2k GitHub stars~4.4k tokensUpdated 2 mo ago
    Auto-check passed

Works with

Categories

Questions about Cr Code Gate

What does Cr Code Gate do?

【Code Review 子 Agent · 门控二】对 git diff 逐项执行代码质量门控检查(运行时异常、性能瓶颈、安全漏洞、权限缺失、破坏性变更等 10 项),按 LOGAF h/m/l 分级输出,h 级清零后方可进入门控三。由 spec-driven-dev 的 codereview 阶段自动调用。. Cr Code Gate is an agent skill from LeoYeAI/openclaw-master-skills.

When should I use Cr Code Gate?

Cr Code Gate fits situations like: tasks that involve Spec-driven development; tasks that involve Code review.

How do I install Cr Code Gate in Claude Code?

Run `npx skills add LeoYeAI/openclaw-master-skills --skill cr-code-gate -a claude-code`. Or copy the skill folder (skills/spec-driven-dev/sub-skills/cr-code-gate in LeoYeAI/openclaw-master-skills) into .claude/skills/cr-code-gate in your project. Claude Code loads it when a task matches its description.

How do I install Cr Code Gate in Codex?

Run `npx skills add LeoYeAI/openclaw-master-skills --skill cr-code-gate -a codex`. Or copy the skill folder (skills/spec-driven-dev/sub-skills/cr-code-gate in LeoYeAI/openclaw-master-skills) into .agents/skills/cr-code-gate in your project. Codex loads it when a task matches its description.

Can I use Cr Code Gate in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add LeoYeAI/openclaw-master-skills --skill cr-code-gate -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/cr-code-gate, .gemini/skills/cr-code-gate, .github/skills/cr-code-gate and .opencode/skills/cr-code-gate in your project.

What does Cr Code Gate need to run?

Going by SKILL.md and its folder, Cr Code Gate needs the command-line tools its instructions call (git) and credentials named API_KEY. Our summary lists: A credential in API_KEY.

Does Cr Code Gate access the network?

SKILL.md contains no URLs. Its commands use git, which can reach the network depending on how they are called. This is read from the text; nothing was executed.

Is Cr Code Gate safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Cr Code Gate use?

Cr Code Gate is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Cr Code Gate use?

About 1.2k tokens (SKILL.md is roughly 4.7k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Cr Code Gate?

Skills that share tags, products or a category with Cr Code Gate: Tbd (jlevy/strif, 131 stars), Code Review Checklist (shareAI-lab/learn-claude-code, 78k stars), Understand Diff Analysis (Egonex-AI/Understand-Anything, 85k stars) and Open Code Review CLI (alibaba/open-code-review, 44k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Cr Code Gate?

LeoYeAI (a GitHub user) maintains it in LeoYeAI/openclaw-master-skills, which has 2,158 GitHub stars. The repository holds 1,215 skills in this directory. The repository was last updated on July 20, 2026.

Source: LeoYeAI/openclaw-master-skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.