New: 97,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Agent Code Review

by werf in werf/trdl

Adversarial verification layer for reviewing agent-generated or otherwise untrusted implementations.

Apache-2.0Auto-check passedDevelopment

Install Agent Code Review

skills CLI
$ npx skills add werf/trdl --skill agent-code-review -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install werf/trdl agent-code-review --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/werf/trdl.git skills-src && mkdir -p .claude/skills && cp -r skills-src/.agents/skills/agent-code-review .claude/skills/agent-code-review && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
agent-code-review
GitHub stars
308
Token cost
~1.1k tokens
SKILL.md length
623 words
Files
1
Skills in repo
1
Repo updated
First seen
Licence
Apache-2.0

At a glance

Adversarial verification layer for reviewing agent-generated or otherwise untrusted implementations.

  • The author of a diff
  • SKILL.md covers Recover the contract first, Test the tests, Check-gaming and Inspection depth, plus 2 more sections
  • Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md
  • Test suite is an agent

What it does

Agent Code Review is an agent skill from werf/trdl. Adversarial verification layer for reviewing agent-generated or otherwise untrusted implementations. Use when the author of a diff, patch, commit, or test suite is an agent, when a change touches tests or verification infrastructure, or when invoked as /agent-code-review. Adds test falsifiability checks and check-gaming detection on top of ordinary review; does not replace it.

Its SKILL.md is about 1.1k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in Development, covering Code review and Test generation. The repository describes itself as: The universal solution for delivering your software updates securely from a trusted The Update Framework (TUF) repository. The licence is Apache-2.0.

When your agent uses it

  • The author of a diff
  • Test suite is an agent
  • A change touches tests
  • Verification infrastructure

Example prompts

  • “/agent-code-review”

What it can do on your machine

Read from SKILL.md and the folder at commit 7e06b0c. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    No scripts in the folder and no shell commands in SKILL.md.

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Agent Code Review loads about 1.1k tokens when it runs. Until then it costs about 99 tokens; SKILL.md has 623 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~99
When it runs · the whole SKILL.md, loaded when a task matches
~1.1k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from werf/trdl at commit 7e06b0c, republished under its Apache-2.0 licence (© werf). 623 words, ~1,133 tokens.

Download SKILL.mdSave it as .claude/skills/agent-code-review/SKILL.md (or your agent's skills folder).
name
agent-code-review
description
Adversarial verification layer for reviewing agent-generated or otherwise untrusted implementations. Use when the author of a diff, patch, commit, or test suite is an agent, when a change touches tests or verification infrastructure, or when invoked as /agent-code-review. Adds test falsifiability checks and check-gaming detection on top of ordinary review; does not replace it.

Agent Code Review

Treat the change as an untrusted implementation candidate. Readable code, passing tests, high coverage, and the author's confidence are not evidence of correctness. Coverage percentage is not evidence by itself.

Do not ask only:

Does this code look correct?

Also ask:

What evidence would fail if this implementation were wrong?

Recover the contract first

Identify intended behavior, acceptance criteria, and behavior that must remain unchanged. If the intended behavior is unclear, that is the first finding.

Do not invent a stronger contract than the task provides. A finding against a requirement the task never stated is noise.

Test the tests

Invoke the test-the-tests skill for this step: verify each test that carries weight by actually mutating the implementation (invert a condition, remove validation, suppress an error, skip a side effect, revert to the prior behavior) and confirming the test fails. A suite that cannot detect a plausible fault is weak even when it passes — passing and high coverage are not evidence by themselves.

Check-gaming

Flag changes that:

  • weaken or delete assertions;
  • update golden files without explaining the behavioral change;
  • skip, quarantine, or filter tests;
  • lower quality thresholds;
  • add test-only branches or detect CI/test environments;
  • hardcode fixture-specific answers;
  • rely entirely on mocks for critical behavior;
  • modify verification scripts together with the implementation;
  • present logs or reports without proving they belong to the reviewed commit.

Unexplained changes to tests or verification infrastructure are high risk by default.

Inspection depth

Direct inspection of the implementation is mandatory regardless of green checks when the change touches auth, secrets, crypto, billing, data deletion, migrations, concurrency, release or supply-chain logic, public APIs, persistent formats, or anything hard to roll back.

For low-risk mechanical changes with strong evidence, targeted inspection is enough. No line-by-line narration in either case.

Show full SKILL.md (329 more words)Show less

Know this review's limits when you are the author

If you wrote the diff you are now reviewing, this pass is necessary but not sufficient. Self-review — even done adversarially, even by mutating your own tests — inherits your own design assumptions; it reliably catches localized bugs and weak tests, but is a poor substitute for a second opinion on whether the overall approach or architecture is sound. An independently-invoked reviewer with no memory of your rationale (a fresh subagent, or an external tool/model such as Codex) will more reliably surface issues you can't see because you already believe your own premises.

For anything more than a mechanical or low-risk change, escalate to an independently invoked reviewer before merging — don't treat your own adversarial pass as the final word. Say so explicitly in your findings when you are the diff's author and no second reviewer has looked yet, so the person deciding whether to merge knows that gap exists.

When that review comes back and you disagree, separate the finding from the fix it proposes: a correct finding often ships with a remedy that does not work, and verifying the mechanism tells you which half to reject. Say which one you are rejecting and show the evidence.

Two failure modes on your side. "It does not reduce the headline risk" is not sufficient grounds to decline a cheap fix that closes a silent-failure path — measure the cost, and if it is small, take it. And if a reviewer raises the same finding a second time, re-examine whether the fix is feasible instead of restating your position; the second request is evidence your explanation did not land, not that it needs repeating.

Output

Report only actionable findings. Each one: where the problem is visible, what fails and under which conditions, and the smallest concrete correction or missing proof. Style preferences are not defects.

Passing checks are claims. The review's job is to establish whether those checks are capable of disproving the implementation.

© werf, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in .agents/skills/agent-code-review of werf/trdl.

Open the folder on GitHubat commit 7e06b0c

Compare with similar skills

Agent Code Review next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Agent Code Review compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Agent Code Review this skillwerf/trdl308—~1.1kAutomated safety check: PassApache-2.0
Code Quality ReviewStudentWeis/ropy193—~2.2kAutomated safety check: PassMIT
Create Agent Templateharness/harness-skills115—~2.2kAutomated safety check: PassApache-2.0
Conducty Shiprobertbarclayy/conducty176—~1.9kAutomated safety check: PassMIT
Code Reviewluongnv89/skills131—~2.4kAutomated safety check: PassMIT
Devnpc-live/clawfirm156—~642Automated safety check: PassNone

Similar skills

  • Code Quality Review

    StudentWeis/ropy

    Review a code change, diff, pull request, module, or test suite for code quality, comment and documentation quality, and test quality.

    193 GitHub stars~2.2k tokensUpdated 28 days ago
    DevelopmentAuto-check passed

  • Create Agent Template

    harness/harness-skills

    Generate Harness Agent Template files for AI-powered automation agents.

    115 GitHub stars~2.2k tokensUpdated today
    DevelopmentAuto-check passed

  • Conducty Ship

    robertbarclayy/conducty

    Pre-merge / pre-deploy gate. An agent skill from robertbarclayy/conducty.

    176 GitHub stars~1.9k tokensUpdated 3 mo ago
    DevelopmentAuto-check passed

  • Code Review

    luongnv89/skills

    Review or improve code — one skill, four modes: bug/security review (default), performance, clean-code audit, slop cleanup.

    131 GitHub stars~2.4k tokensUpdated today
    DevelopmentAuto-check passed

  • Dev

    npc-live/clawfirm

    Software development workflow dispatcher. An agent skill from npc-live/clawfirm.

    156 GitHub stars~642 tokensUpdated 3 mo ago
    DevelopmentAuto-check passed

  • Iterative Plan Review

    testdouble/han

    Sharpens and stress-tests an existing plan file through multiple codebase-grounded review passes, editing it in place and recording every finding and iteration in cross-referenced companion files.

    279 GitHub stars~10k tokensUpdated 6 days ago
    Testing & QAAuto-check passed

Categories

Questions about Agent Code Review

What does Agent Code Review do?

Adversarial verification layer for reviewing agent-generated or otherwise untrusted implementations. Agent Code Review is an agent skill from werf/trdl. Adversarial verification layer for reviewing agent-generated or otherwise untrusted implementations.

When should I use Agent Code Review?

Agent Code Review fits situations like: the author of a diff; test suite is an agent; A change touches tests; verification infrastructure.

How do I install Agent Code Review in Claude Code?

Run `npx skills add werf/trdl --skill agent-code-review -a claude-code`. Or copy the skill folder (.agents/skills/agent-code-review in werf/trdl) into .claude/skills/agent-code-review in your project. Claude Code loads it when a task matches its description.

How do I install Agent Code Review in Codex?

Run `npx skills add werf/trdl --skill agent-code-review -a codex`. Or copy the skill folder (.agents/skills/agent-code-review in werf/trdl) into .agents/skills/agent-code-review in your project. Codex loads it when a task matches its description.

Can I use Agent Code Review in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add werf/trdl --skill agent-code-review -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/agent-code-review, .gemini/skills/agent-code-review, .github/skills/agent-code-review and .opencode/skills/agent-code-review in your project.

What does Agent Code Review need to run?

SKILL.md names no scripts, command-line tools or credentials: Agent Code Review is instructions for the agent only.

Does Agent Code Review access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Agent Code Review safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Agent Code Review use?

Agent Code Review is published under the Apache-2.0 licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Agent Code Review use?

About 1.1k tokens (SKILL.md is roughly 4.5k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Agent Code Review?

Skills that share tags, products or a category with Agent Code Review: Code Quality Review (StudentWeis/ropy, 193 stars), Create Agent Template (harness/harness-skills, 115 stars), Conducty Ship (robertbarclayy/conducty, 176 stars) and Code Review (luongnv89/skills, 131 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Agent Code Review?

werf (a GitHub organization) maintains it in werf/trdl, which has 308 GitHub stars. The repository was last updated on September 28, 2026.

Source: werf/trdl on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.