skill

OpenSource-SKILL

a OpenSource Code Review Skill for everyone

priyank766/OpenSource-SKILLcommunitylistedunreviewed

Set up

Skills are installed by placing their folder where your agent loads skills.

Download ZIP from GitHub Open the repository

The download comes from github.com/priyank766/OpenSource-SKILL itself, not from our server, so what you get is exactly what its author published.

Install instructions come from the README

Skills do not use an MCP config. Follow the steps in the README below.

README

synced Oct 27, 2026

npx skills add priyank766/OpenSource-SKILL

Website · Skills · Install · Scoring · Contributing

Eight agent skills that do the slow part of reviewing a pull request — the careful reading — and hand you the two or three findings that earn a comment.

Reviewing well takes two things that are hard to do quickly: reading the change carefully enough to find what actually breaks, and then deciding which findings are worth the author's time. The first is slow. The second is the part that gets skipped when the first ran long.

The reading. ~80% of every skill is detection procedure — reading order, four passes over the diff, blast-radius sweeps across the whole repo, and a reproduction before anything is claimed.
The filter. A weighted 10-point score. Anything below the skill's floor never reaches you, related findings merge into one comment, and the whole review is capped at five.
The wording. Concrete claim, minimal patch, one line of why — so you can approve or dismiss each one at a glance.

The skills

Skill	Use it when	Floor
pr-review	Any PR. The general procedure the others extend.	8.0
security-review	Auth, crypto, input parsing, deserialization, subprocess, paths, secrets, SSRF	7.5
dependency-review	New or bumped dependencies, lockfile diffs, CI workflow or base-image changes	7.5
api-compat-review	Public signatures, exported types, defaults, config keys, CLI flags, wire formats	7.5
test-review	The diff is mostly tests, fixtures changed, or CI is flaky	8.0
performance-review	I/O in loops, new queries, caching, allocations, hot paths	8.0
docs-review	README, docstrings, tutorials — or code that silently invalidated them	8.5
contributor-experience-review	A first-time contributor's PR, or one you have to decline	8.5

Floor is the minimum score a finding must reach to be worth posting. It drops to 7.5 where a miss is asymmetric and cannot be un-shipped, and rises to 8.5 where noise is expensive and the stakes are low — there you cut harder, not softer.

Install

Every skill is self-contained: SKILL.md plus its own references/. Installing one copies nothing it does not need.

# all eight, to every agent the CLI detects
npx skills add priyank766/OpenSource-SKILL

# just one
npx skills add priyank766/OpenSource-SKILL --skill security-review

# pick the agent
npx skills add priyank766/OpenSource-SKILL -a claude-code -g -y
npx skills add priyank766/OpenSource-SKILL -a codex -g -y

Claude Code also takes it as a plugin:

/plugin marketplace add priyank766/OpenSource-SKILL
/plugin install opensource-review-suite

Codex reads ~/.codex/skills/ globally and .agents/skills/ per project — -a codex handles both; -g picks global.

git clone https://github.com/priyank766/OpenSource-SKILL
cd OpenSource-SKILL

./scripts/install.sh --list                    # what's available
./scripts/install.sh security-review           # one skill
./scripts/install.sh                           # interactive picker
./scripts/install.sh --all --agent codex       # choose the target

Windows: .\scripts\install.ps1 -All -Agent codex, same flags.

`--agent`	Installs to
`claude`, `cowork` (default)	`~/.claude/skills/`
`codex`	`~/.codex/skills/`
`cursor`	`~/.cursor/skills/`
`gemini`	`~/.gemini/skills/`
`antigravity`	`~/.gemini/antigravity/skills/`
`opencode`	`~/.config/opencode/skills/`
`copilot`	`~/.copilot/skills/`
`generic`	`./.agent/skills/`

Or skip the script — cp -r skills/security-review ~/wherever/. It is Markdown.

Once installed you do not name the skill; the descriptions carry explicit trigger conditions.

Review PR #482 in this repo.
Security pass on the auth changes in this branch.
This PR bumps 40 packages — anything I should worry about?

Scoring

score = 0.30·correctness + 0.30·impact + 0.20·urgency + 0.20·empathy

Score	Band	Action
9.0 – 10	Subtle bug, race, leak, edge-case crash, security flaw	Must post, with a patch
8.0 – 8.9	Type safety, test isolation, structural polish	Post as a suggestion
6.0 – 7.9	Cosmetic refactor, micro-optimization, preference	Do not post on the PR
below 6.0	Generic lint, praise, hallucination	Reject silently

Three separate 7.5 nits about the same pattern do not add up to a 9.0. They add up to one 8.5 about the pattern, posted at the first occurrence.

Full rubric in shared/QUALITY-FILTER.md; a walkthrough of what a review looks like end to end in examples/how-it-works.md.

Layout

skills/<name>/SKILL.md        the skill: frontmatter + procedure
skills/<name>/references/     vendored shared docs, so each skill stands alone
shared/DETECTION-PLAYBOOK.md  how to find the defect — the main phase
shared/QUALITY-FILTER.md      the 10-point rubric
shared/REVIEW-VOICE.md        the tone contract
scripts/                      installers, sync-shared.py, validate.py

shared/ is the single source of truth; sync-shared.py copies it into each skill and CI fails if a copy drifts. Skills must be self-contained because installers copy only the contents of skills/<name>/.

Contributing

New skills, sharper detection technique, and corrections to any command that does not run are all welcome — see CONTRIBUTING.md. The bar for a new skill: it must name a defect class the existing eight would miss, and be mostly detection procedure rather than advice.

If it saved you a review, a star is the only signal this project runs on.