Skills review-agent

📦

review-agent

Name: review-agent
Author: openai

Content revision r1 Safe ⚙️ External commands

Review Code Changes for Actionable Defects

Code changes can introduce defects that broad summaries or style checks miss. This skill performs a read-only review and reports concrete findings by priority.

Supports: Claude Codex Code(CC)

🥉 78 Bronze

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "review-agent" from https://skillstore.io/skills/review-agent.md and its manifest at https://skillstore.io/api/skills/review-agent/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/review-agent.md Signed manifest GET /api/skills/review-agent/manifest Signed lockfile GET /api/skills/review-agent/lockfile

Test it

Using "review-agent". Review the current uncommitted authentication changes.

Expected outcome:

P1: Preserve token expiry validation in the refresh path. The changed branch accepts expired refresh tokens when cached metadata is missing.
Overall assessment: The authentication change has one urgent correctness and security defect. Add coverage for expired tokens without cached metadata.

Using "review-agent". Review commit 4f28c91 for actionable defects.

Expected outcome:

No findings. The reviewed change preserves existing behavior, and the relevant tests cover the modified paths.

Using "review-agent". Review the feature branch against its base branch.

Expected outcome:

P2: Restore pagination after filtered results. The new filter resets the cursor but does not request the next page.
Overall assessment: The branch has one user-visible pagination regression. Add a test that combines filtering with multiple result pages.

Security Audit

Safe

v1 • 8/17/2026 Open versioned report

One static finding is confirmed because the skill directs the agent to run read-only Git commands. Seven findings are false positives caused by Markdown backticks around filenames, labels, and example text.

Files scanned

Lines analyzed

Review items

False positives ignored

Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

SKILL.md:24

Ruby/shell backtick execution

`git merge-base HEAD <comparison-ref>`, then inspect `git diff <merge-base-sha>`. If the local

The skill explicitly directs the agent to run git merge-base and git diff. These are intended read-only external commands.

Risk Factors

⚙️ External commands (8)

SKILL.md:14 SKILL.md:24 SKILL.md:43 SKILL.md:50 SKILL.md:51 SKILL.md:52 SKILL.md:53 SKILL.md:55

Audited by: codex

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/review-agent/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/review-agent/security.svg)](https://skillstore.io/skills/review-agent?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/review-agent?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/review-agent/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/review-agent.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

openai. (2026). review-agent security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/review-agent/audits/1

BibTeX citation

@techreport{openai-review-agent-2026,
  author = {openai},
  title = {review-agent security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/review-agent/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "review-agent security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "openai"
date-released: "2026-08-17"
url: "https://skillstore.io/skills/review-agent/audits/1"
identifiers:
  - type: other
    value: "skillstore:review-agent:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Check Work Before Commit

Review local changes for regressions before creating a commit or requesting peer review.

Assess a Branch Difference

Compare a feature branch with its merge base and identify defects that would enter the target branch.

Support Release Validation

Review a selected commit for release blockers, urgent defects, and material test gaps.

Try These Prompts

Review Local Changes

Review my uncommitted changes. Report only concrete defects introduced by the diff, ordered by priority.

Review a Commit

Review commit [commit SHA]. Check surrounding code, tests, and call sites. Cite the smallest relevant changed lines.

Review Against a Base Branch

Review the changes that would merge into [base branch]. Use the merge base and report actionable regressions with priority labels.

Run a Targeted Security Review

Review [target] for security and correctness regressions. Trace affected call paths, verify tests, and explain each demonstrated failure scenario.

Best Practices

Specify the exact commit, branch, or uncommitted change set to review.
Provide relevant acceptance criteria when intentional behavior changes may resemble regressions.
Keep tests and repository history available so the agent can verify findings.

Avoid

Do not ask the skill to fix code or create commits because its workflow is read-only.
Do not request style feedback when no meaningful correctness or maintainability impact exists.
Do not treat the review as a substitute for tests, runtime validation, or human approval.

Frequently Asked Questions

What changes can this skill review?

It can review uncommitted changes, a selected commit, a base-branch difference, or another clearly defined target.

Does the skill edit my repository?

No. It is instructed not to modify files, create commits, push branches, or post review comments.

How are findings prioritized?

Findings use P0 for critical blockers, P1 for urgent defects, P2 for ordinary defects, and P3 for low-impact issues.

Will it report style issues?

It excludes style concerns unless they create a meaningful maintainability problem or obscure the code.

What happens when no defects are found?

The skill states that no findings were found and adds a brief assessment of remaining test gaps or risks.

Does a clean review prove the change is correct?

No. Results depend on available context and cannot guarantee detection of every defect or runtime condition.

Developer Details

Author

openai

License

MIT

Skillstore revision

Version notice

The author did not declare a version.

Repository

https://github.com/openai/codex/tree/e38290846c11424567c9c8226f2be8a2886c5929/codex-rs/skills/src/assets/samples/review-agent

Ref

bc37f12c64ad89ca965c1e90d44012af0469ec4e

Maintenance freshness

8/17/2026

Usage

0 downloads · 0 views

File structure

📁 agents/

📄 openai.yaml

📄 SKILL.md