Official agent skill

Branch Review

by microsoft in microsoft/bocpy

Multi-perspective code review for a branch before merging. An agent skill from microsoft/bocpy.

OfficialMITAuto-check passedDevelopment

Install Branch Review

skills CLI
$ npx skills add microsoft/bocpy --skill branch-review -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install microsoft/bocpy branch-review --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/microsoft/bocpy.git skills-src && mkdir -p .claude/skills && cp -r skills-src/.github/skills/branch-review .claude/skills/branch-review && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
branch-review
GitHub stars
201
Token cost
~3.2k tokens
SKILL.md length
1,552 words
Files
1
Skills in repo
9
Repo updated
First seen
Licence
MIT

At a glance

Multi-perspective code review for a branch before merging. An agent skill from microsoft/bocpy.

  • Works in 8 steps: Gather the Diff → Build the Context Block → Spawn Three Constructive Reviewer Lens… → …
  • : reviewing a branch
  • SKILL.md covers When to Use, Severity Levels, Persistence and Restart and Procedure, plus 1 more section
  • Calls git

What it does

Branch Review is an agent skill from microsoft/bocpy, published by the product's own GitHub organization. Multi-perspective code review for a branch before merging. Use when: reviewing a branch, preparing a PR, pre-merge review, auditing a feature branch, or when /branch-review is invoked. Spawns three constructive reviewer subagents (correctness, security, usability), then runs an adversarial gap analysis to find what they missed, and synthesizes all findings into a unified review report. All intermediate artifacts are persisted to .copilot/ so the process can be restarted from any step.

Its SKILL.md is about 3.2k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in Development, covering UX design and Subagents. The repository describes itself as: Behavior-Oriented Concurrency in Python. The licence is MIT.

When your agent uses it

  • : reviewing a branch
  • Pre-merge review
  • Auditing a feature branch
  • /branch-review is invoked

Example prompts

  • “/branch-review”

Workflow steps

8 steps, taken from the step headings in SKILL.md.

  1. Gather the Diff
  2. Build the Context Block
  3. Spawn Three Constructive Reviewer Lens Subagents
  4. Adversarial Gap Analysis
  5. Deduplicate and Synthesize
  6. Present the Report
  7. Apply Fixes
  8. Check Exit or Re-review

What it can do on your machine

Read from SKILL.md and the folder at commit c8f3ceb. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Shell commands in SKILL.md call:

    • git

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md. Its commands use git, which can reach the network depending on how they are called.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Branch Review loads about 3.2k tokens when it runs. Until then it costs about 126 tokens; SKILL.md has 1,552 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~126
When it runs · the whole SKILL.md, loaded when a task matches
~3.2k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from microsoft/bocpy at commit c8f3ceb, republished under its MIT licence (© microsoft). 1,552 words, ~3,191 tokens.

Download SKILL.mdSave it as .claude/skills/branch-review/SKILL.md (or your agent's skills folder).
name
branch-review
description
Multi-perspective code review for a branch before merging. Use when: reviewing a branch, preparing a PR, pre-merge review, auditing a feature branch, or when /branch-review is invoked. Spawns three constructive reviewer subagents (correctness, security, usability), then runs an adversarial gap analysis to find what they missed, and synthesizes all findings into a unified review report. All intermediate artifacts are persisted to .copilot/ so the process can be restarted from any step.
argument-hint
Branch name or merge target (e.g. 'main' or 'feature/foo -> main')

Branch Review

Perform a thorough multi-perspective code review of a branch before it is merged. Four independent reviewers examine the diff from competing viewpoints, and their findings are synthesized into one actionable report.

When to Use

  • A feature branch is ready to merge and needs review
  • Preparing a pull request
  • Final quality gate before integration

Severity Levels

Findings use the same severity scale as the review-loop skill:

SeverityMeaning
criticalCorrectness bug, security vulnerability, or data loss risk. Must fix.
highLikely bug, race condition, or significant design flaw. Should fix.
mediumCode smell, unclear logic, missing edge case, or maintainability concern. Recommended fix.
lowStyle nit, naming suggestion, minor improvement. Fix at discretion.

Persistence and Restart

Every intermediate artifact produced by this skill is written to disk under .copilot/reviews/<slug>/, where <slug> is a short kebab-case name derived from the branch under review (e.g. work-stealing-scheduler for a branch named feature/work-stealing-scheduler). This makes the process fully resumable: if any step fails, is interrupted, or produces an unsatisfactory result, you can re-run only the affected step using the on-disk artifacts from prior steps as input.

Directory layout
.copilot/reviews/<slug>/
├── 00-context.md                       # Step 2 output (shared context block)
├── 00-diff.patch                       # Step 1 raw diff
├── 00-changed-files.txt                # Step 1 file list
├── 10-review-correctness-lens.md       # Step 3 outputs (one per lens)
├── 10-review-security-lens.md
├── 10-review-usability-lens.md
├── 20-adversarial.md                   # Step 4 output
├── 30-synthesis.md                     # Step 5 output (deduped findings)
├── 40-report.md                        # Step 6 output (final unified report)
├── 50-fixes-iter1.md                   # Step 7 notes (per fix pass, optional)
├── 50-fixes-iter2.md
└── ...

Numeric prefixes preserve chronological order. The <slug> directory is created at step 1 and reused for the whole run. If the same branch is re-reviewed after fixes (step 8 loop-back), append a generation suffix (e.g. <slug>-r2/) rather than overwriting the prior review.

Restart contract

At the start of every step, check whether the corresponding output file already exists. If it does:

  • Either reuse it (skip re-running the step), or
  • Explicitly overwrite it (re-run the step from scratch).

Ask the user which to do if the choice is non-obvious. Never silently discard an existing artifact.

When the user asks to "restart from step N", load all artifacts numbered below N into context and re-run from step N onward.

Procedure

1. Gather the Diff

Determine the branch and its merge target (default: main) and derive the slug. Create .copilot/reviews/<slug>/ if it does not already exist.

Collect the diff using one of these methods, in order of preference:

  1. git diff <merge-target>...<branch> -- . ':!*.lock' — full diff against the merge base. Save to 00-diff.patch.
  2. get_changed_files — if the working tree has uncommitted changes that are part of the review.

Also collect the list of changed files and save to 00-changed-files.txt:

git diff --name-only <merge-target>...<branch>

Read the full current content of every changed file so reviewers have both the diff and the surrounding context.

2. Build the Context Block

Assemble a context block that every reviewer will receive and write it to .copilot/reviews/<slug>/00-context.md. This file must be self-contained: any subagent reading it should have everything it needs without further file lookups (beyond the diff/changed-files artifacts referenced by path). Include:

  • Branch and merge target — branch name, base, commit range.
  • Diff — the full unified diff (or a reference to 00-diff.patch if large, with key hunks inlined).
  • Changed files — list from 00-changed-files.txt plus full current content of each modified file (or excerpts with line ranges if very large).
  • Related tests — content of test files that cover the changed code, if identifiable.
  • Project conventions — brief summary of relevant conventions from copilot-instructions.md (style, commenting, error handling, etc.).
  • Prior audits — pointers to any prior review artifacts the user has flagged as already-covered (so reviewers know what is in/out of scope).

Keep the context block identical across all four reviewers to ensure a fair comparison.

3. Spawn Three Constructive Reviewer Lens Subagents

Launch three subagents in parallel, each using a named lens agent operating in review mode. Each receives the context block (by path) and must return findings in the severity-tagged format defined above.

#AgentFocus
1correctness-lensLogic errors, broken invariants, test gaps
2security-lensInjection, overflows, trust boundary violations
3usability-lensNaming, complexity, conventions, maintainability

Each subagent prompt must include:

  • A directive to read .copilot/reviews/<slug>/00-context.md as its context

  • An instruction to operate in review mode

  • A directive to write the resulting findings to .copilot/reviews/<slug>/10-review-<lens>.md and return a brief confirmation plus the file path

  • These instructions:

    Review the diff and changed files from the perspective described above. For each issue found, report it in this exact format:

    [SEVERITY] Short title

    • Location: file path and line number(s)
    • Problem: what is wrong and why it matters
    • Suggestion: concrete fix or remediation

    where SEVERITY is one of: critical, high, medium, low.

    If you find no issues from your perspective, state that explicitly. Do NOT fabricate issues. Only report genuine problems. Order findings by severity (critical first).

After the subagents return, verify all three 10-review-*.md files exist before continuing.

4. Adversarial Gap Analysis

After the three constructive reviewers return, spawn a fresh adversarial-lens subagent operating in review mode. This step runs sequentially — the adversarial reviewer receives the existing findings so it can focus on what the others missed.

The adversarial subagent prompt must include:

  • A directive to read .copilot/reviews/<slug>/00-context.md and all three .copilot/reviews/<slug>/10-review-*.md files

  • A directive to write its findings to .copilot/reviews/<slug>/20-adversarial.md

  • These instructions:

    You are the adversarial reviewer. The findings in the 10-review-*.md files were produced by three constructive reviewers (correctness, security, usability). Your job is to find what they missed.

    Focus on:

    • Code sections covered by NO existing finding (overlooked areas)
    • Issue categories not represented in the existing findings
    • Cross-component interactions no single lens would catch
    • Unchecked assumptions and untested preconditions
    • Silent divergences with no test coverage
    • Fragile coupling where changing one thing silently breaks another

    For each issue found, report it in this exact format:

    [SEVERITY] Short title

    • Location: file path and line number(s)
    • Problem: what is wrong and why it matters
    • Suggestion: concrete fix or remediation

    where SEVERITY is one of: critical, high, medium, low.

    If the existing findings are comprehensive and you find no gaps, the file must contain exactly: "No additional issues found." Do NOT duplicate issues already reported. Only report NEW problems. Order findings by severity (critical first).

Show full SKILL.md (592 more words)Show less
5. Deduplicate and Synthesize

Read all four reviewer outputs (10-review-*.md and 20-adversarial.md) and write a synthesized findings list to .copilot/reviews/<slug>/30-synthesis.md:

  1. Merge duplicates. If multiple reviewers flag the same issue, keep the most detailed version and note which perspectives flagged it (higher confidence).
  2. Resolve conflicts. If reviewers disagree (e.g., correctness wants inlining but maintainability wants extraction), note both sides and flag the trade-off for the user.
  3. Verify critical/high findings. Before presenting critical or high findings, attempt to verify them — trace the code path, run relevant tests, or construct a minimal reproduction. Mark any finding you cannot verify as [unverified].

Each synthesized finding should retain its severity tag and a "Flagged by" attribution listing the contributing lenses.

6. Present the Report

Assemble the final report at .copilot/reviews/<slug>/40-report.md and present it to the user. The report must contain these sections, in order:

  1. Summary — one-paragraph overview: number of findings by severity, overall assessment (e.g., "ready to merge with minor fixes" or "has blocking issues").

  2. Positive observations — bullet list of things the reviewers agreed were done well (design choices, test quality, documentation, etc.). Keep it brief but genuine — this provides signal about what to preserve during remediation.

  3. Findings — Critical / High — a Markdown table with columns: #, Severity, Title, Location, Flagged by, Status. Below the table, expand each row with the full problem description and suggested fix.

  4. Findings — Medium — same table + expansion format.

  5. Findings — Low — same table + expansion format.

  6. Trade-offs — any unresolved disagreements between reviewers, with both sides stated.

  7. Remediation plan — a numbered, ordered list of concrete steps to address the findings. Group related fixes into a single step where sensible. Each step should name the finding(s) it addresses and briefly describe what to do. Order by priority: blocking issues first, then medium, then low.

  8. Action prompt — ask the user which findings to address. Options:

    • Fix all (follow the remediation plan)
    • Select specific findings by number
    • Dismiss specific findings
    • Ask for clarification
7. Apply Fixes

For each approved finding:

  1. Implement the fix (or the user's alternative if provided).
  2. Confirm each fix briefly as it is applied.
  3. Run relevant tests after each fix to verify no regressions.

Record a short summary of the pass to .copilot/reviews/<slug>/50-fixes-iter<i>.md (incrementing i for each re-review pass) noting which findings were addressed, which were deferred, and any test results. This makes it possible to resume mid-remediation if the session is interrupted.

If a fix is ambiguous or touches architecture, ask the user for guidance and record the decision in the same 50-fixes-iter<i>.md file.

8. Check Exit or Re-review

After all approved fixes are applied:

All approved fixes have been applied and tests pass. Should I run another review pass on the updated diff, or is the branch ready to merge?

  • If the user wants another pass → create a new generation directory (e.g. <slug>-r2/) and go to step 1 with the updated diff. The prior review's artifacts remain on disk for reference.
  • If the user is satisfied → exit.

Guidelines

  • Fresh context per pass. Each review pass spawns new subagents with no memory of prior passes, preventing anchoring bias.
  • Do not auto-fix without approval. Always present findings and wait for the user to decide.
  • Scope to the diff. Reviewers should focus on changed code. Pre-existing issues in unchanged code are out of scope unless the change makes them worse.
  • Keep it bounded. If a re-review returns only low-severity findings, suggest exiting the loop.
  • Test after fixing. Run the test suite (or at minimum the relevant subset) after applying fixes to catch regressions early.

© microsoft, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in .github/skills/branch-review of microsoft/bocpy.

Open the folder on GitHubat commit c8f3ceb

Compare with similar skills

Branch Review next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Branch Review compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Branch Review this skillmicrosoft/bocpy201—~3.2kAutomated safety check: PassMIT
GitHub Review Iterationprisma/orm48k—~2.2kAutomated safety check: PassApache-2.0
Cherry Studio PR ReviewCherryHQ/cherry-studio52k—~3.9kAutomated safety check: PassAGPL-3.0
Jevgrepdzhng/jevgrep2.5k—~741Automated safety check: PassMIT
PR Cyclejaemk/cached2.1k—~4.8kAutomated safety check: NotesMIT
Inference Format Optimizera2ui-project/a2ui17k—~985Automated safety check: PassApache-2.0

Similar skills

  • Official

    Runs a loop on a GitHub pull request: fetch review state, triage comments into actions, implement them and resolve threads, repeating until nothing actionable is left.

    48k GitHub stars~2.2k tokensUpdated today
    DevelopmentAuto-check passed
  • Cherry Studio PR Review

    CherryHQ/cherry-studio

    Reviews Cherry Studio branches, pull requests, commits, files and docs against the project's own architecture, naming, API-boundary and UI rules, report-only by default.

    52k GitHub stars~3.9k tokensUpdated today
    DevelopmentAuto-check passed
  • Jevgrep

    dzhng/jevgrep

    A skill your agent uses for questions about how, why, or where behavior works in a repository, including questions that name a function or setting.

    2.5k GitHub stars~741 tokensUpdated 7 days ago
    DevelopmentAuto-check passed
  • PR Cycle

    jaemk/cached

    PR review-and-update cycle — the orchestrator that takes a PR from review to resolved.

    2.1k GitHub stars~4.8k tokensUpdated 8 days ago
    DevelopmentAuto-check: notes
  • Iterative benchmarking, evaluation, and algorithmic optimization of alternative A2UI inference formats (such as Express, Atom, and Elemental).

    17k GitHub stars~985 tokensUpdated today
    DevelopmentAuto-check passed
  • PR Review

    jaemk/self_update

    Targeted, read-only review of a PR or checked-out branch. An agent skill from jaemk/self_update.

    961 GitHub stars~1.5k tokensUpdated 1 mo ago
    DevelopmentAuto-check: notes

More from microsoft/bocpy

All 9 skills in this repo
  • Official

    Write a C extension whose custom types can live inside a bocpy Cown and travel between worker sub-interpreters.

    201 GitHub stars~5.1k tokensUpdated 11 days ago
    Auto-check passed
  • Official

    Follow bocpy commenting and documentation conventions. An agent skill from microsoft/bocpy.

    201 GitHub stars~3.3k tokensUpdated 11 days ago
    Auto-check passed
  • Finalize PR

    microsoft/bocpy

    Official

    Finalize a feature branch for merge. An agent skill from microsoft/bocpy.

    201 GitHub stars~3.5k tokensUpdated 11 days ago
    Auto-check passed
  • Multi Perspective Plan

    microsoft/bocpy

    Official

    Multi-perspective planning with rebuttal rounds and adversarial review loop.

    201 GitHub stars~2.8k tokensUpdated 11 days ago
    Auto-check passed
  • Testing Message Queue

    microsoft/bocpy

    Official

    Write tests for the bocpy message queue — the lock-free tag-based MPSC ring buffer.

    201 GitHub stars~2.3k tokensUpdated 11 days ago
    Auto-check passed
  • Thinking In Boc

    microsoft/bocpy

    Official

    Think in Behavior-Oriented Concurrency, not threads-and-locks.

    201 GitHub stars~2.6k tokensUpdated 11 days ago
    Auto-check passed

Categories

Questions about Branch Review

What does Branch Review do?

Multi-perspective code review for a branch before merging. An agent skill from microsoft/bocpy. Branch Review is an agent skill from microsoft/bocpy, published by the product's own GitHub organization. Multi-perspective code review for a branch before merging.

When should I use Branch Review?

Branch Review fits situations like: : reviewing a branch; pre-merge review; auditing a feature branch; /branch-review is invoked.

How do I install Branch Review in Claude Code?

Run `npx skills add microsoft/bocpy --skill branch-review -a claude-code`. Or copy the skill folder (.github/skills/branch-review in microsoft/bocpy) into .claude/skills/branch-review in your project. Claude Code loads it when a task matches its description.

How do I install Branch Review in Codex?

Run `npx skills add microsoft/bocpy --skill branch-review -a codex`. Or copy the skill folder (.github/skills/branch-review in microsoft/bocpy) into .agents/skills/branch-review in your project. Codex loads it when a task matches its description.

Can I use Branch Review in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add microsoft/bocpy --skill branch-review -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/branch-review, .gemini/skills/branch-review, .github/skills/branch-review and .opencode/skills/branch-review in your project.

What does Branch Review need to run?

Going by SKILL.md and its folder, Branch Review needs the command-line tools its instructions call (git).

Does Branch Review access the network?

SKILL.md contains no URLs. Its commands use git, which can reach the network depending on how they are called. This is read from the text; nothing was executed.

Is Branch Review safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Branch Review use?

Branch Review is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Branch Review use?

About 3.2k tokens (SKILL.md is roughly 13k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Branch Review?

Skills that share tags, products or a category with Branch Review: GitHub Review Iteration (prisma/orm, 48k stars), Cherry Studio PR Review (CherryHQ/cherry-studio, 52k stars), Jevgrep (dzhng/jevgrep, 2.5k stars) and PR Cycle (jaemk/cached, 2.1k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Branch Review?

microsoft (a GitHub organization, an official publisher) maintains it in microsoft/bocpy, which has 201 GitHub stars. The repository holds 9 skills in this directory. The repository was last updated on September 28, 2026.

Source: microsoft/bocpy on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.