A Code Review Skill That Keeps Agents Honest

Where this fits

Your coding agent finishes a feature branch: diff is clean, tests pass, but the real question is whether the implementation matches the approved requirements within the exact Git boundary — or quietly added new behavior. The code-reviewer skill from TestAny-io runs a structured, read-only implementation review against approved PRD/design and Git scope, and returns a verdict that separates code correctness from deployment approval. The skill's details and usage notes are cataloged at https://www.openagentskill.com/skills/testany-io-code-reviewer.

Why agents benefit

• Stays read-only by default: it inspects, diagnoses, and reports; it never pushes, triggers CI, creates PRs, merges, or deploys without explicit user authorization.
• Judges against approved scope, not vibes: PRD, contracts, HLD/LLD, and guardrails define the boundary; author notes, self-test passes, and old reviewer comments do not authorize new requirements.
• Enforces severity discipline: P0/P1 must be closed with evidence to pass, while P2 never blocks — reducing both rubber-stamp approvals and endless nitpick loops.
• Maintains one Review Record: scope lock, candidate, coverage, and evidence are kept in a single record and reused across rounds, so delta re-reviews don't re-report stale history.
• Honors language policy: output follows the user's language while machine fields and IDs stay English, which fits mixed-language teams.

Practical scenarios

First full review of an implementation candidate

Your agent has produced the complete implementation for a user story. Feed in the approved design and the exact base/candidate SHAs; the skill checks whether the whole candidate matches the approved scope and reports P0/P1 findings with evidence.

Delta re-review after fixes

The team resolved the blocking issues from round one. Instead of re-reviewing everything, the skill binds to the same Review Record and checks only the new Git delta and whether blocking items are closed with necessary evidence.

Guarding against scope creep

An agent starts suggesting a new API or a refactor mid-review. The skill's boundary rules reject that as out of scope — it reports defects, it does not expand architecture — keeping the output a review, not a redesign proposal.

Add it to your agent workflow

Install the skill:

npx skills add TestAny-io/testany-agent-skills --skill code-reviewer

Then invoke it once the implementation candidate is formed, passing the approved requirements, design docs, exact Git boundary, and output language:

When the candidate is ready, run the code-reviewer skill.
Provide: approved PRD/design, exact base SHA, candidate SHA, and output_language.
Read-only mode; do not push, build, or deploy.

Compare before adopting

Before adopting, compare with alternatives on quality signals, maintenance freshness, and workflow fit. Does the skill keep a review record with evidence traceability, or is it a generic "look for bugs" prompt? Is the repo actively maintained — check recent commits to TestAny-io/testany-agent-skills, now at 81 stars. Does it match your Git boundary conventions and your need for first-review and delta modes? And can you live with its explicit exclusions: no API/HLD/LLD/test/runbook review and no deployment approval?

Why it is worth tracking

The skill's value comes from discipline: scope locking, a single Review Record, and severity gates that stop at P0/P1. Those are concrete behaviors you can observe on real review runs, not just promises. The OpenAgentSkill listing tracks its repo metadata and community signals, but the real test is whether the skill keeps agent-produced PRs honest in your workflow. Re-evaluate it when your review process changes or when the project extends the modes it currently excludes.