Agent skill

Code Review

by nodetool-ai in nodetool-ai/nodetool

Review a diff, branch, or PR for correctness, repository standards, and spec coverage.

AGPL-3.0Auto-check passedDevelopment

Install Code Review

skills CLI
$ npx skills add nodetool-ai/nodetool --skill code-review -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install nodetool-ai/nodetool code-review --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/nodetool-ai/nodetool.git skills-src && mkdir -p .claude/skills && cp -r skills-src/.agents/skills/code-review .claude/skills/code-review && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
code-review
GitHub stars
554
Token cost
~1.6k tokens
SKILL.md length
849 words
Files
2 (incl. references)
Skills in repo
130
Repo updated
First seen
Licence
AGPL-3.0

At a glance

Review a diff, branch, or PR for correctness, repository standards, and spec coverage.

  • Works in 7 steps: Pin the fixed point → Map the blast radius → Find the spec → …
  • Tasks that involve Code review
  • SKILL.md covers Process, Severity, What not to flag and Output format
  • Calls git and npm

What it does

Code Review is an agent skill from nodetool-ai/nodetool. Review a diff, branch, or PR for correctness, repository standards, and spec coverage. Report evidence-backed findings.

Its SKILL.md is about 1.6k tokens, which your agent loads only when the skill is triggered. The skill folder holds 2 other files, including reference files (for example `references/review-checklists.md`).

It sits in Development, covering Code review and Test coverage. It works with Git. The repository describes itself as: Agent-first Creative Workspace. The licence is AGPL-3.0.

When your agent uses it

  • Tasks that involve Code review
  • Tasks that involve Test coverage

Example prompts

  • “/code-review”

Workflow steps

7 steps, taken from the step headings in SKILL.md.

  1. Pin the fixed point
  2. Map the blast radius
  3. Find the spec
  4. Find the standards sources
  5. Review the applicable axes
  6. Verify
  7. Report

What it can do on your machine

Read from SKILL.md and the folder at commit f99c652. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Shell commands in SKILL.md call:

    • git
    • npm

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md. Its commands use git and npm, which can reach the network depending on how they are called.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Code Review loads about 1.6k tokens when it runs, and up to ~3.6k if it reads all its reference files. Until then it costs about 33 tokens; SKILL.md has 849 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~33
When it runs · the whole SKILL.md, loaded when a task matches
~1.6k
With references · SKILL.md plus every file in references/, read only if the agent opens them
~3.6k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from nodetool-ai/nodetool at commit f99c652, republished under its AGPL-3.0 licence (© nodetool-ai). 849 words, ~1,594 tokens.

Download SKILL.mdSave it as .claude/skills/code-review/SKILL.md (or your agent's skills folder). This skill also uses 1 other file; get the full folder from GitHub.
name
code-review
description
Review a diff, branch, or PR for correctness, repository standards, and spec coverage. Report evidence-backed findings.

Code Review

Three-axis review of the diff between HEAD and a fixed point:

  • Correctness — does the change work, and does it step on a NodeTool landmine?
  • Standards — does it follow this repo's documented rules?
  • Spec — does it faithfully implement the originating issue or spec?

Review all applicable axes. Use independent subagents when available, permitted, and useful for the diff. For a small diff or a host without delegation, review the axes locally. Keep review read-only unless the user also requested fixes.

Division of labor with the sibling skill: unslop asks whether the change is free of AI-generated filler. Use it when cleanup is requested or a concrete issue needs that guidance.

The rules the Correctness and Standards axes cite live in AGENTS.md, docs/DEVELOPMENT_STANDARDS.md, and the area AGENTS.md files.

Process

1. Pin the fixed point

Whatever the user named is the fixed point — a commit SHA, branch, tag, main, HEAD~5. If they named none, infer from what they asked for:

  • Working tree: git diff + git diff --cached, plus untracked files via git status.
  • Branch or PR: git diff $(git merge-base main HEAD)...HEAD — never git diff main, which picks up drift on main. For a PR, fetch the branch first.

Capture the diff command once, and the commit list via git log <fixed-point>..HEAD --oneline. Confirm the ref resolves (git rev-parse) and the diff is non-empty before going further — a bad ref should fail here, not inside three sub-agents.

2. Map the blast radius

npm run dev:nodetool -- affected --base main --json lists the workspaces to typecheck and test, and says whether a decorator package (loads from dist/) forces npm run build:packages. Don't guess.

3. Find the spec

In order:

  1. Issue references in the commit messages (#123, Closes #45).
  2. A path the user passed as an argument.
  3. A spec file under docs/, specs/, or .scratch/ matching the branch or feature.
  4. Use acceptance criteria already provided in the conversation. If no spec exists, report that limitation and continue Correctness and Standards review. Ask only when a particular behavior cannot be assessed without a missing requirement.
4. Find the standards sources

AGENTS.md, docs/DEVELOPMENT_STANDARDS.md, the AGENTS.md for each area the diff touches, and anything else the repo documents about how code should be written.

On top of those, the Standards axis always carries the smell baseline below, which applies even where a repo documents nothing. Two rules bind it: a documented repo standard always wins, and every smell is a labelled heuristic ("possible Feature Envy"), never a hard violation.

5. Review the applicable axes

For a substantial diff, delegate independent axes with the host's available agent tools. Give each reviewer the diff scope, relevant source paths, requirements, and a read-only task. Do not depend on a particular tool name or agent subtype.

  • Correctness: read changed functions and their callers. Identify an input or state that triggers each claimed failure. Enumerate consumers of shared types.
  • Standards: cite the applicable repository rule. Treat the smell baseline as a heuristic requiring a concrete consequence, not an automatic violation.
  • Spec: identify missing, incorrect, or unrequested behavior against the supplied acceptance criteria. Do not invent a spec when one is unavailable.
Show full SKILL.md (326 more words)Show less
6. Verify

Use existing check results when they apply to the reviewed state. Run targeted checks for unresolved correctness questions. After making code fixes, complete mandatory post-change verification. Do not substitute a full suite or aggregate check merely because the diff is wide. Report actual results and any limits of verification.

7. Report

Verify delegated findings against the source, combine duplicates, and lead with concrete failures ordered by severity. Label each finding's axis and give the location, trigger or cited rule, consequence, and suggested correction. Match length to the findings. If no findings are supported, say so and describe what was checked and what remains unverified.

Read review-checklists.md for the areas the diff touches and for the optional smell baseline.

Severity

TierMeaningBar
BlockerWrong behavior, crash, data loss, security hole, broken buildYou can name the input or state that triggers it
Should-fixViolates a written repo ruleCite the rule
NitEverything else worth a sentenceOnly if you found nothing bigger in that file; never pad

A finding without a failure scenario or a citable rule is not a finding. When unsure whether something is a bug, say so instead of inflating the severity.

What not to flag

  • Anything npm run lint or npm run typecheck already rejects — report their output instead of duplicating it as prose findings.
  • Style preferences with no backing in the repo docs. "I'd have written it differently" is not a finding.
  • Pre-existing problems outside the diff. Mention once at the end if serious; don't mix them into the findings.
  • Slop — comments, dead abstractions, prose filler. One pointer to unslop, not itemized findings.

Output format

Order supported findings by severity and label their axis. For example:

[BLOCKER] packages/kernel/src/actor.ts:142 — `pending` is never cleared on error
When a node throws, `handleError` returns early before `this.pending.delete(id)`,
so the runner waits forever on the next `sync_mode: on_any` join.
Fix: move the delete into a `finally`.

One line of location and claim, the failure scenario, the fix. Close with what you actually ran:

Verified: npm run build --workspace=packages/kernel ✓, npm run test --workspace=packages/kernel ✓ (34 passed)

If nothing is wrong, say so plainly and list what you checked — a clean review is a valid result, not a failure to find something.

© nodetool-ai, AGPL-3.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 1 other file (references) in .agents/skills/code-review of nodetool-ai/nodetool.

  • SKILL.md
  • references/review-checklists.md

Open the folder on GitHubat commit f99c652

Compare with similar skills

Code Review next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Code Review compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Code Review this skillnodetool-ai/nodetool554—~1.6kAutomated safety check: PassAGPL-3.0
Worktrunk Tend CI Guidancemax-sixty/worktrunk8.9k—~6.4kAutomated safety check: PassCustom licence
Code Reviewpolyipseity/obsidian-terminal948—~1.6kAutomated safety check: PassAGPL-3.0
Sendou Code Reviewsendou-ink/sendou.ink297—~5.2kAutomated safety check: PassAGPL-3.0
Code ReviewPrismer-AI/PrismerCloud1.6k—~2.1kAutomated safety check: NotesMIT
Review Codetobihagemann/turbo406—~3.2kAutomated safety check: PassMIT

Similar skills

  • Worktrunk Tend CI Guidance

    max-sixty/worktrunk

    Adds Worktrunk-specific rules to the tend CI workflows: Codecov polling, Rust test commands, labels and review criteria for pull requests handled in CI.

    8.9k GitHub stars~6.4k tokensUpdated yesterday
    DevelopmentAuto-check passed
  • Code Review

    polyipseity/obsidian-terminal

    A skill your agent uses when reviewing PRs, code changes, or conducting code audits in obsidian-terminal.

    948 GitHub stars~1.6k tokensUpdated 4 days ago
    DevelopmentAuto-check passed
  • Sendou Code Review

    sendou-ink/sendou.ink

    Multi-agent code review that checks the current diff from multiple angles (spec compliance, bugs from two lenses, conventions/modernization, abstraction reuse, security, DB query performance, test…

    297 GitHub stars~5.2k tokensUpdated yesterday
    DevelopmentAuto-check passed
  • Code Review

    Prismer-AI/PrismerCloud

    Review a diff against its acceptance criteria in four segments (convention adherence, bug scan, historical-context regressions, test-coverage gaps) as a NON-implementing agent.

    1.6k GitHub stars~2.1k tokensUpdated 7 days ago
    DevelopmentAuto-check: notes
  • Review Code

    tobihagemann/turbo

    Review code for bugs, security vulnerabilities, API misuse, consistency issues, simplicity problems, or test coverage gaps and low-value tests by running internal reviews and a peer review in…

    406 GitHub stars~3.2k tokensUpdated yesterday
    DevelopmentAuto-check passed
  • Official

    Reviews the tests added in a pull request for fix coverage, quality, edge cases and test type, and recommends lighter test types where they would do.

    23k GitHub stars~2.9k tokensUpdated yesterday
    Testing & QAAuto-check passed

More from nodetool-ai/nodetool

All 130 skills in this repo
  • Beat Sync Editing

    nodetool-ai/nodetool

    Cut a NodeTool timeline to music and shape its pacing — detect the beat grid, place cuts on phrases, pick a cut type, build speed ramps with time remap, and give the piece an arc.

    554 GitHub stars~2.6k tokensUpdated today
    Auto-check passed
  • Caption Titles

    nodetool-ai/nodetool

    Add and animate a consistent text layer on an existing NodeTool timeline.

    554 GitHub stars~1.9k tokensUpdated today
    Auto-check passed
  • Color Motion

    nodetool-ai/nodetool

    Choose and animate colour on a NodeTool timeline, including shape and text gradients, colour grades, 3D LUTs, and dither.

    554 GitHub stars~2.3k tokensUpdated today
    Auto-check passed
  • Commercial Beat Sheet

    nodetool-ai/nodetool

    Write a shootable, precisely timed commercial beat sheet and store it as a NodeTool storyboard, with a consistent entity roster behind every shot.

    554 GitHub stars~4.6k tokensUpdated today
    Auto-check passed
  • Elevenlabs Audio Prompting

    nodetool-ai/nodetool

    Direct ElevenLabs speech, dialogue, sound effects and music — the bracketed audio tags v3 acts on and why the voice decides whether a tag lands, stability as the delivery dial, punctuation instead…

    554 GitHub stars~1.9k tokensUpdated today
    Auto-check passed
  • Frame Composition

    nodetool-ai/nodetool

    Stage the frame on a NodeTool timeline — grids, focal placement, safe areas per aspect ratio, depth layers and parallax, camera moves, and where elements enter and leave.

    554 GitHub stars~3.5k tokensUpdated today
    Auto-check passed

Works with

Categories

Questions about Code Review

What does Code Review do?

Review a diff, branch, or PR for correctness, repository standards, and spec coverage. Code Review is an agent skill from nodetool-ai/nodetool. Review a diff, branch, or PR for correctness, repository standards, and spec coverage.

When should I use Code Review?

Code Review fits situations like: tasks that involve Code review; tasks that involve Test coverage.

How do I install Code Review in Claude Code?

Run `npx skills add nodetool-ai/nodetool --skill code-review -a claude-code`. Or copy the skill folder (.agents/skills/code-review in nodetool-ai/nodetool) into .claude/skills/code-review in your project. Claude Code loads it when a task matches its description.

How do I install Code Review in Codex?

Run `npx skills add nodetool-ai/nodetool --skill code-review -a codex`. Or copy the skill folder (.agents/skills/code-review in nodetool-ai/nodetool) into .agents/skills/code-review in your project. Codex loads it when a task matches its description.

Can I use Code Review in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add nodetool-ai/nodetool --skill code-review -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/code-review, .gemini/skills/code-review, .github/skills/code-review and .opencode/skills/code-review in your project.

What does Code Review need to run?

Going by SKILL.md and its folder, Code Review needs the command-line tools its instructions call (git and npm).

Does Code Review access the network?

SKILL.md contains no URLs. Its commands use git and npm, which can reach the network depending on how they are called. This is read from the text; nothing was executed.

Is Code Review safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Code Review use?

Code Review is published under the AGPL-3.0 licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Code Review use?

About 1.6k tokens (SKILL.md is roughly 6.4k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 2k tokens, read only when the agent opens those files.

What are the alternatives to Code Review?

Skills that share tags, products or a category with Code Review: Worktrunk Tend CI Guidance (max-sixty/worktrunk, 8.9k stars), Code Review (polyipseity/obsidian-terminal, 948 stars), Sendou Code Review (sendou-ink/sendou.ink, 297 stars) and Code Review (Prismer-AI/PrismerCloud, 1.6k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Code Review?

nodetool-ai (a GitHub organization) maintains it in nodetool-ai/nodetool, which has 554 GitHub stars. The repository holds 130 skills in this directory. The repository was last updated on October 7, 2026.

Source: nodetool-ai/nodetool on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.