gsd-code-review
Systematically reviews code changes from recent phases for security and quality.
Install
mkdir -p .claude/skills/gsd-code-review && curl -L -o skill.zip "https://agentskills.codes/api/skills/download/13063" && unzip -o skill.zip -d .claude/skills/gsd-code-review && rm skill.zipInstalls to .claude/skills/gsd-code-review
Activation
This is the description your AI agent reads to decide when to run this skill — the better it matches your request, the more reliably it fires.
Review source files changed during a phase for bugs, security issues, and code quality problemsKey capabilities
- →Review source files for bugs
- →Identify security issues in code
- →Check code quality problems
- →Analyze code at specified depth levels
- →Generate a REVIEW.md artifact with findings
- →Auto-apply fixes found in the review
How it works
This skill parses arguments and delegates to a workflow that spawns a gsd-code-reviewer agent to analyze code. It produces a REVIEW.md artifact with severity-classified findings.
Inputs & outputs
When to use gsd-code-review
- →Audit code after a task
- →Find security issues in PRs
- →Verify quality of changes
About this skill
<codex_skill_adapter>
A. Skill Invocation
- This skill is invoked by mentioning
$gsd-code-review. - Treat all user text after
$gsd-code-reviewas{{GSD_ARGS}}. - If no arguments are present, treat
{{GSD_ARGS}}as empty.
B. AskUserQuestion → request_user_input Mapping
GSD workflows use AskUserQuestion (Claude Code syntax). Translate to Codex request_user_input:
Parameter mapping:
header→headerquestion→question- Options formatted as
"Label" — description→{label: "Label", description: "description"} - Generate
idfrom header: lowercase, replace spaces with underscores
Batched calls:
AskUserQuestion([q1, q2])→ singlerequest_user_inputwith multiple entries inquestions[]
Multi-select workaround:
- Codex has no
multiSelect. Use sequential single-selects, or present a numbered freeform list asking the user to enter comma-separated numbers.
Execute mode fallback:
- When
request_user_inputis rejected or unavailable, you MUST stop and present the questions as a plain-text numbered list, then wait for the user's reply. Do NOT pick a default and continue (#3018). - You may only proceed without a user answer when one of these is true:
(a) the invocation included an explicit non-interactive flag (
--autoor--all), (b) the user has explicitly approved a specific default for this question, or (c) the workflow's documented contract says defaults are safe (e.g. autonomous lifecycle paths). - Do NOT write workflow artifacts (CONTEXT.md, DISCUSSION-LOG.md, PLAN.md, checkpoint files) until the user has answered the plain-text questions or one of (a)-(c) above applies. Surfacing the questions and waiting is the correct response — silently defaulting and writing artifacts is the #3018 failure mode.
C. Task() → spawn_agent Mapping
GSD workflows use Task(...) (Claude Code syntax). Translate to Codex collaboration tools:
Direct mapping:
Task(subagent_type="X", prompt="Y")→spawn_agent(agent_type="X", message="Y")Task(model="...")→ omit.spawn_agenthas no inlinemodelparameter; GSD embeds the resolved per-agent model directly into each agent's.tomlat install time somodel_overridesfrom.planning/config.jsonand~/.gsd/defaults.jsonare honored automatically by Codex's agent router.fork_context: falseby default — GSD agents load their own context via<files_to_read>blocksTask(isolation="worktree")/Agent(isolation="worktree")→ no direct Codex mapping. Codexspawn_agentdoes not create or bind a git worktree automatically. Workflows that require this isolation must fail closed or use an explicit manual worktree protocol before spawning (#3360).
Spawn restriction:
- Codex restricts
spawn_agentto cases where the user has explicitly requested sub-agents. When automatic spawning is not permitted, do the work inline in the current agent rather than attempting to force a spawn.
Parallel fan-out:
- Spawn multiple agents → collect agent IDs →
wait(ids)for all to complete
Result parsing:
- Look for structured markers in agent output:
CHECKPOINT,PLAN COMPLETE,SUMMARY, etc. close_agent(id)after collecting results from each agent </codex_skill_adapter>
Spawns the gsd-code-reviewer agent to analyze code at the specified depth level. Produces REVIEW.md artifact in the phase directory with severity-classified findings.
Arguments:
- Phase number (required) — which phase's changes to review (e.g., "2" or "02")
--depth=quick|standard|deep(optional) — review depth level, overrides workflow.code_review_depth config- quick: Pattern-matching only (~2 min)
- standard: Per-file analysis with language-specific checks (~5-15 min, default)
- deep: Cross-file analysis including import graphs and call chains (~15-30 min)
--files file1,file2,...(optional) — explicit comma-separated file list, skips SUMMARY/git scoping (highest precedence for scoping)--fix(optional) — after review completes (or if REVIEW.md already exists), auto-apply fixes found. Spawns gsd-code-fixer agent. Accepts sub-flags:--all— include Info findings in fix scope (default: Critical + Warning only)--auto— enable fix + re-review iteration loop, capped at 3 iterations
Output: {padded_phase}-REVIEW.md in phase directory + inline summary of findings </objective>
<execution_context> @/Users/lmarques/Dev/efx-mux/.codex/get-shit-done/workflows/code-review.md </execution_context>
<context> Phase: {{GSD_ARGS}} (first positional argument is phase number)Optional flags parsed from {{GSD_ARGS}}:
--depth=VALUE— Depth override (quick|standard|deep). If provided, overrides workflow.code_review_depth config.--files=file1,file2,...— Explicit file list override. Has highest precedence for file scoping per D-08. When provided, workflow skips SUMMARY.md extraction and git diff fallback entirely.
Context files (AGENTS.md, SUMMARY.md, phase state) are resolved inside the workflow via gsd-sdk query init.phase-op and delegated to agent via <files_to_read> blocks.
</context>
Execute end-to-end.
The workflow (not this command) enforces these gates:
- Phase validation (before config gate)
- Config gate check (workflow.code_review)
- File scoping (--files override > SUMMARY.md > git diff fallback)
- Empty scope check (skip if no files)
- Agent spawning (gsd-code-reviewer)
- Result presentation (inline summary + next steps)
When not to use it
- →When `request_user_input` is rejected or unavailable and user interaction is not desired
Limitations
- →Codex `spawn_agent` does not create or bind a git worktree automatically
- →The skill does not proceed without user answers if `request_user_input` is rejected, unless specific auto-flags are present
- →The skill is a thin dispatch layer and the workflow enforces gates like phase validation and config checks
How it compares
This workflow automates code review and can apply fixes based on configurable depth levels, unlike a manual review process.
Compared to similar skills
gsd-code-review side by side with the closest alternatives in the catalog.
| Skill | Installs | Updated | Safety | Difficulty |
|---|---|---|---|---|
| gsd-code-review (this skill) | 0 | 3mo | No flags | Intermediate |
| find-bugs | 5 | 7mo | No flags | Intermediate |
| tech-debt-analyzer | 5 | 9mo | Review | Intermediate |
| static-analysis | 5 | 6mo | No flags | Advanced |
Try saying
Example prompts that trigger this skill in your AI assistant.
More by electroheadfx
View all by electroheadfx →You might also like
find-bugs
davila7
Find bugs, security vulnerabilities, and code quality issues in local branch changes. Use when asked to review changes, find bugs, security review, or audit code on the current branch.
tech-debt-analyzer
ailabs-393
This skill should be used when analyzing technical debt in a codebase, documenting code quality issues, creating technical debt registers, or assessing code maintainability. Use this for identifying code smells, architectural issues, dependency problems, missing documentation, security vulnerabilities, and creating comprehensive technical debt documentation.
static-analysis
gmh5225
Expertise in LLVM-based static analysis including dataflow analysis, pointer analysis, taint tracking, and program verification. Use this skill when implementing security scanners, bug finders, code quality tools, or performing program analysis research.
agent-code-analyzer
ruvnet
Agent skill for code-analyzer - invoke with $agent-code-analyzer
codex-code-review
tyrchen
Perform comprehensive code reviews using OpenAI Codex CLI. This skill should be used when users request code reviews, want to analyze diffs/PRs, need security audits, performance analysis, or want automated code quality feedback. Supports reviewing staged changes, specific files, entire directories, or git diffs.
review-code
catlog22
Multi-dimensional code review with structured reports. Analyzes correctness, readability, performance, security, testing, and architecture. Triggers on "review code", "code review", "审查代码", "代码审查".