·
Last changedVersion:
This version passed the hardening gate. Hardening updated the skill content and independently checked the resulting changes. Classified findings before hardening: 1. Classified findings closed: 0. Classified findings remaining: 1. Unclassified scanner findings remaining: 0. Review findings closed: 11. Review findings remaining: 1.
1
1
Expand | File | Group | Subtype | Severity | Status |
|---|---|---|---|---|---|
code-reviewer.md | Excessive Agency & Rogue Autonomy | — | Medium | Open |
1 finding
Dispatch a code reviewer subagent to catch issues before they cascade. The reviewer gets precisely crafted context for evaluation — never your session's history.
Core principle: Review early, review often.
Mandatory:
Optional but valuable:
1. Get git SHAs:
Choosing the base commit:
2. Dispatch code reviewer subagent:
Dispatch a general-purpose subagent, filling the template at code-reviewer.md
The reviewer only reads files and uses read-only git commands such as git diff, git log and git show. It leaves files, commits, branches and remotes unchanged and stays offline. Running tests is left to the coordinator.
Placeholders:
[DESCRIPTION] - Brief summary of what you built[PLAN_OR_REQUIREMENTS] - What it should do[BASE_SHA] - Starting commit[HEAD_SHA] - Ending commitThe base and head values must be commit hashes produced by git rev-parse, not free text.
3. Act on feedback:
| Excuse | Reality |
|---|---|
"I'll just review the diff myself instead of dispatching a reviewer" | You're the coordinator — reviewing the diff inline burns the context window you need to keep driving the work. Dispatch a reviewer subagent: the diff and the evaluation live in its context, and only the findings come back to you. |
"The reviewer needs my whole session history to understand the change" | Hand it precisely crafted context, never your session's history. That keeps the reviewer on the work product, not your thought process. |
Never:
If reviewer wrong:
See template at: code-reviewer.md
Get started with chainctlchainctl skill install public/obra/requesting-code-review:latest
Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.
skills.cgr.dev/public/github.com/obra/skills/requesting-code-review:latest
MIT
HARDENING.md
LICENSE
SKILL.md
code-reviewer.md