CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

code-review-ai-ai-review

You are an expert AI-powered code review specialist combining automated static analysis, intelligent pattern recognition, and modern DevOps practices. Leverage AI tools (GitHub Copilot, Qodo, GPT-5, C

Quality

48%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./plugins/AI-Agents-Safe-Coding-Skills-claude/skills/code-review-ai-ai-review/SKILL.md

The canonical home for this skill is code-review-ai-ai-review in administrakt0r/AI-Agents-Safe-Coding-Skills

SKILL.md
Quality
Evals
Security

Quality

Content

38%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a sprawling catalog of AI code-review topics with substantial redundancy and non-executable illustrative code, weakly organized as sections rather than a coherent workflow. Its single pointer to a details file is broken, and no bundle files exist, so progressive disclosure fails in both directions: too much inline, nothing to disclose to.

Suggestions

Cut the explanations of known concepts — the OWASP Top 10 list, SOLID principles, and standard anti-pattern/scalability red-flag lists — replacing them with one-line pointers to the authoritative source or removing them entirely.

Replace pseudocode blocks (ReviewRoutingStrategy, MicroserviceReviewer) with either fully runnable scripts in a scripts/ directory or trimmed concrete examples; the Python orchestrator should define or drop get_pr_diff and to_github_comment.

Fix 'resources/implementation-playbook.md' to point at a real file (e.g. references/implementation-playbook.md) and actually create it, moving the long code examples and tool-specific details there.

DimensionReasoningScore

Conciseness

The ~450-line body extensively explains concepts Claude already knows: an OWASP Top 10 enumeration, SOLID principles, Singleton/God-object anti-patterns, and a list of scalability red flags like N+1 queries. Large illustrative code blocks repeat the same 'prompt an LLM with context, parse JSON' pattern three times. This is noticeably-to-severely verbose with several padded sections, landing between anchors 1 and 2, closer to 2 given the code examples still carry some value.

2 / 5

Actionability

Some genuinely executable guidance exists (the trufflehog jq pipeline, the GitHub Actions YAML, the Python orchestrator), but much of it is pseudocode: the TypeScript 'ReviewRoutingStrategy' calls undefined classes (analyzePRComplexity, AIEngine, QodoEngine), the Go example relies on unimplemented helpers (detectsSharedDatabase, hasBreakingAPIChanges), and the Python orchestrator calls undefined methods (get_pr_diff, to_github_comment). This matches anchor 3: some concrete guidance but incomplete, pseudocode instead of executable code.

3 / 5

Workflow Clarity

The 'Automated Code Review Workflow' section gives a clear numbered triage sequence and a topical flow (static analysis -> AI review -> comment posting), and the CI/CD quality gate is one real checkpoint. However, the overall body reads as a topic catalog rather than one coherent sequence, and there are no validation or error-recovery feedback loops between steps (e.g., what to do when static analysis or the AI response fails to parse). Anchor 3: steps listed but checkpoints mostly missing.

3 / 5

Progressive Disclosure

The only external reference in the body is 'resources/implementation-playbook.md', which does not exist in the bundle (no references/, scripts/, or assets/ directories are present), and the path uses 'resources' rather than the conventional 'references'. Meanwhile, hundreds of lines of reference-grade material (OWASP mappings, model-selection tables, full code examples) are inlined in SKILL.md. This matches anchor 2: content that clearly belongs in separate files is inlined and the reference is broken.

2 / 5

Total

10

/

20

Passed

Description

36%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is a truncated, second-person persona statement that names the domain and tools but never states what the skill concretely does or when to use it. It reads as an identity preamble rather than a capability-and-trigger description, and the mid-word cutoff suggests it was clipped from a longer text.

Suggestions

Rewrite in third person and lead with concrete actions, e.g. 'Runs multi-tool AI code review (CodeQL, Semgrep, SonarQube plus LLM review) on pull requests and diffs to find security vulnerabilities, performance regressions, and maintainability issues.'

Add an explicit trigger clause: 'Use when the user asks to review a PR, pull request, diff, or code for bugs, security issues, or performance problems.'

Fix the truncation at 'GPT-5, C' — the description is cut mid-word, losing whatever outcome statement followed.

DimensionReasoningScore

Specificity

The description names the domain ('AI-powered code review') and tool lists ('GitHub Copilot, Qodo, GPT-5'), but the concrete actions are generic ('combining automated static analysis, intelligent pattern recognition, and modern DevOps practices') and the sentence is truncated mid-word at 'GPT-5, C', cutting off any outcome statement. It sits at anchor 3 (domain plus 1-2 concrete actions) but the rubric's second-person penalty ('You are an expert...') reduces it by 1.

2 / 5

Completeness

The 'what' is only vaguely present (an approach — 'combining automated static analysis... DevOps practices' — rather than what the skill does, and the sentence truncates before stating outcomes), and the 'when' is entirely missing with no 'Use when...' clause, which caps this dimension at 3. This matches anchor 2: a vague 'what' and no 'when'.

2 / 5

Trigger Term Quality

'code review' and 'static analysis' are natural terms users would say, and tool names like SonarQube/Semgrep aid matching, but common phrasings such as 'review my PR', 'pull request review', or 'review this diff' are absent. This matches anchor 3: some relevant keywords but missing common variations or synonyms.

3 / 5

Distinctiveness Conflict Risk

'AI-powered code review' is a recognizable niche, but the broad framing ('pattern recognition', 'modern DevOps practices') overlaps with general code-review, security-review, and CI/CD skills. Somewhat specific but could still overlap with similar skills — anchor 3.

3 / 5

Total

10

/

20

Passed

Validation

87%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

referenced_paths_exist

Referenced path issues: 1 missing

Warning

Total

14

/

16

Passed

Repository

administrakt0r/AI-Agents-Safe-Coding-Skills

Path

plugins/AI-Agents-Safe-Coding-Skills-claude/skills/code-review-ai-ai-review/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.