GS

gsd-code-review

Systematically reviews code changes from recent phases for security and quality.

Install

mkdir -p .claude/skills/gsd-code-review && curl -L -o skill.zip "https://agentskills.codes/api/skills/download/13063" && unzip -o skill.zip -d .claude/skills/gsd-code-review && rm skill.zip

Installs to .claude/skills/gsd-code-review

Activation

This is the description your AI agent reads to decide when to run this skill — the better it matches your request, the more reliably it fires.

Review source files changed during a phase for bugs, security issues, and code quality problems
95 charsno explicit “when” trigger
Intermediate

Key capabilities

  • Review source files for bugs
  • Identify security issues in code
  • Check code quality problems
  • Analyze code at specified depth levels
  • Generate a REVIEW.md artifact with findings
  • Auto-apply fixes found in the review

How it works

This skill parses arguments and delegates to a workflow that spawns a gsd-code-reviewer agent to analyze code. It produces a REVIEW.md artifact with severity-classified findings.

Inputs & outputs

You give it
Phase number (e.g., '2'), optional depth ('quick', 'standard', 'deep'), optional file list ('file1,file2,...'), and optional fix flag ('--fix')
You get back
A {padded_phase}-REVIEW.md file in the phase directory and an inline summary of findings

When to use gsd-code-review

  • Audit code after a task
  • Find security issues in PRs
  • Verify quality of changes

About this skill

<codex_skill_adapter>

A. Skill Invocation

  • This skill is invoked by mentioning $gsd-code-review.
  • Treat all user text after $gsd-code-review as {{GSD_ARGS}}.
  • If no arguments are present, treat {{GSD_ARGS}} as empty.

B. AskUserQuestion → request_user_input Mapping

GSD workflows use AskUserQuestion (Claude Code syntax). Translate to Codex request_user_input:

Parameter mapping:

  • headerheader
  • questionquestion
  • Options formatted as "Label" — description{label: "Label", description: "description"}
  • Generate id from header: lowercase, replace spaces with underscores

Batched calls:

  • AskUserQuestion([q1, q2]) → single request_user_input with multiple entries in questions[]

Multi-select workaround:

  • Codex has no multiSelect. Use sequential single-selects, or present a numbered freeform list asking the user to enter comma-separated numbers.

Execute mode fallback:

  • When request_user_input is rejected or unavailable, you MUST stop and present the questions as a plain-text numbered list, then wait for the user's reply. Do NOT pick a default and continue (#3018).
  • You may only proceed without a user answer when one of these is true: (a) the invocation included an explicit non-interactive flag (--auto or --all), (b) the user has explicitly approved a specific default for this question, or (c) the workflow's documented contract says defaults are safe (e.g. autonomous lifecycle paths).
  • Do NOT write workflow artifacts (CONTEXT.md, DISCUSSION-LOG.md, PLAN.md, checkpoint files) until the user has answered the plain-text questions or one of (a)-(c) above applies. Surfacing the questions and waiting is the correct response — silently defaulting and writing artifacts is the #3018 failure mode.

C. Task() → spawn_agent Mapping

GSD workflows use Task(...) (Claude Code syntax). Translate to Codex collaboration tools:

Direct mapping:

  • Task(subagent_type="X", prompt="Y")spawn_agent(agent_type="X", message="Y")
  • Task(model="...") → omit. spawn_agent has no inline model parameter; GSD embeds the resolved per-agent model directly into each agent's .toml at install time so model_overrides from .planning/config.json and ~/.gsd/defaults.json are honored automatically by Codex's agent router.
  • fork_context: false by default — GSD agents load their own context via <files_to_read> blocks
  • Task(isolation="worktree") / Agent(isolation="worktree") → no direct Codex mapping. Codex spawn_agent does not create or bind a git worktree automatically. Workflows that require this isolation must fail closed or use an explicit manual worktree protocol before spawning (#3360).

Spawn restriction:

  • Codex restricts spawn_agent to cases where the user has explicitly requested sub-agents. When automatic spawning is not permitted, do the work inline in the current agent rather than attempting to force a spawn.

Parallel fan-out:

  • Spawn multiple agents → collect agent IDs → wait(ids) for all to complete

Result parsing:

  • Look for structured markers in agent output: CHECKPOINT, PLAN COMPLETE, SUMMARY, etc.
  • close_agent(id) after collecting results from each agent </codex_skill_adapter>
<objective> Review source files changed during a phase for bugs, security vulnerabilities, and code quality problems.

Spawns the gsd-code-reviewer agent to analyze code at the specified depth level. Produces REVIEW.md artifact in the phase directory with severity-classified findings.

Arguments:

  • Phase number (required) — which phase's changes to review (e.g., "2" or "02")
  • --depth=quick|standard|deep (optional) — review depth level, overrides workflow.code_review_depth config
    • quick: Pattern-matching only (~2 min)
    • standard: Per-file analysis with language-specific checks (~5-15 min, default)
    • deep: Cross-file analysis including import graphs and call chains (~15-30 min)
  • --files file1,file2,... (optional) — explicit comma-separated file list, skips SUMMARY/git scoping (highest precedence for scoping)
  • --fix (optional) — after review completes (or if REVIEW.md already exists), auto-apply fixes found. Spawns gsd-code-fixer agent. Accepts sub-flags:
    • --all — include Info findings in fix scope (default: Critical + Warning only)
    • --auto — enable fix + re-review iteration loop, capped at 3 iterations

Output: {padded_phase}-REVIEW.md in phase directory + inline summary of findings </objective>

<execution_context> @/Users/lmarques/Dev/efx-mux/.codex/get-shit-done/workflows/code-review.md </execution_context>

<context> Phase: {{GSD_ARGS}} (first positional argument is phase number)

Optional flags parsed from {{GSD_ARGS}}:

  • --depth=VALUE — Depth override (quick|standard|deep). If provided, overrides workflow.code_review_depth config.
  • --files=file1,file2,... — Explicit file list override. Has highest precedence for file scoping per D-08. When provided, workflow skips SUMMARY.md extraction and git diff fallback entirely.

Context files (AGENTS.md, SUMMARY.md, phase state) are resolved inside the workflow via gsd-sdk query init.phase-op and delegated to agent via <files_to_read> blocks. </context>

<process> This command is a thin dispatch layer. It parses arguments and delegates to the workflow.

Execute end-to-end.

The workflow (not this command) enforces these gates:

  • Phase validation (before config gate)
  • Config gate check (workflow.code_review)
  • File scoping (--files override > SUMMARY.md > git diff fallback)
  • Empty scope check (skip if no files)
  • Agent spawning (gsd-code-reviewer)
  • Result presentation (inline summary + next steps)
</process>

When not to use it

  • When `request_user_input` is rejected or unavailable and user interaction is not desired

Limitations

  • Codex `spawn_agent` does not create or bind a git worktree automatically
  • The skill does not proceed without user answers if `request_user_input` is rejected, unless specific auto-flags are present
  • The skill is a thin dispatch layer and the workflow enforces gates like phase validation and config checks

How it compares

This workflow automates code review and can apply fixes based on configurable depth levels, unlike a manual review process.

Compared to similar skills

gsd-code-review side by side with the closest alternatives in the catalog.

SkillInstallsUpdatedSafetyDifficulty
gsd-code-review (this skill)03moNo flagsIntermediate
find-bugs57moNo flagsIntermediate
tech-debt-analyzer59moReviewIntermediate
static-analysis56moNo flagsAdvanced

Try saying

Example prompts that trigger this skill in your AI assistant.

You might also like

find-bugs

davila7

Find bugs, security vulnerabilities, and code quality issues in local branch changes. Use when asked to review changes, find bugs, security review, or audit code on the current branch.

529

tech-debt-analyzer

ailabs-393

This skill should be used when analyzing technical debt in a codebase, documenting code quality issues, creating technical debt registers, or assessing code maintainability. Use this for identifying code smells, architectural issues, dependency problems, missing documentation, security vulnerabilities, and creating comprehensive technical debt documentation.

522

static-analysis

gmh5225

Expertise in LLVM-based static analysis including dataflow analysis, pointer analysis, taint tracking, and program verification. Use this skill when implementing security scanners, bug finders, code quality tools, or performing program analysis research.

518

agent-code-analyzer

ruvnet

Agent skill for code-analyzer - invoke with $agent-code-analyzer

317

codex-code-review

tyrchen

Perform comprehensive code reviews using OpenAI Codex CLI. This skill should be used when users request code reviews, want to analyze diffs/PRs, need security audits, performance analysis, or want automated code quality feedback. Supports reviewing staged changes, specific files, entire directories, or git diffs.

16

review-code

catlog22

Multi-dimensional code review with structured reports. Analyzes correctness, readability, performance, security, testing, and architecture. Triggers on "review code", "code review", "审查代码", "代码审查".

22

Search skills

Search the agent skills registry