An Agent skill built on open-code-review (OCR): the CLI guarantees deterministic engineering (6-gate file filtering, path-precise rule matching, fact-checking, line-number relocation), the Agent owns triage, verification and reporting. 6 compact rule packs (233 lines) replace 23,972 lines of natural-language rules — ~100× smaller, sharper on purpose.
Quickstart · What it does · Usage · Docs · 中文
- It praises the diff, then misses the proto field-number reuse that will panic prod.
- It flags 40 style nits ESLint already owns — and skips the singleton field overwrite that corrupts concurrent requests.
- It reviews "the code" but never checks whether the PR actually implements the PRD.
This skill fixes that with a split brain: deterministic where possible, agentic where it matters.
🔴 Critical | internal/payment/handler.go:42
现象：金额字段直接从请求参数赋值，未校验正负
风险：攻击者可构造负数金额导致资金逆流
修复：添加 if amount <= 0 { return ErrInvalidAmount } 校验
Every finding ships with file:line, evidence, and a copy-pasteable fix. Coverage is accounted to the file — nothing is silently skipped. (Reports are emitted in Chinese by default — 现象/风险/修复 = symptom / risk / fix.)
| You say | It runs | You get |
|---|---|---|
/agentic-code-review (workspace dirty) |
ocr review — 6-gate filtering → rule match → LLM review → fact-check → line relocation |
Graded report (🔴/🟡/🟢) + coverage tally |
/agentic-code-review --from release --to feat/x |
Branch-range review on merge base | Same, scoped to the PR |
| "对照 PRD 审查这个分支" | Dual-axis: Standards axis (OCR pipeline) ∥ Spec axis (requirement fidelity) | Two partitioned verdicts — clean code that builds the wrong thing can't hide behind a green lint |
| "审查这个 proto 变更的向下兼容性" | Protobuf wire-compat rules + baseline checkpoint | Field-number / reserved / enum contract verdict; asks for the old .proto instead of guessing |
| "Queue 一致性专项检查" | queue-check.py — 7 deterministic checks, zero LLM tokens |
Topic→Worker derivation, case-sensitive filenames, TYPE_DELAY/ttl matrix, cross-repo diff |
| "审查这份上线文档" | 6 REL-OPS release-doc checks (Agent-native) | Missing sections, monitoring-metric table gaps, rollback holes |
The dual engine, honestly: OCR owns everything a machine can prove; the Agent owns everything that needs judgment. When the LLM isn't configured, it degrades to delegate mode — same deterministic filtering, the Agent reviews instead. It never fabricates credentials to look fully-powered.
Rule baseline that knows its place: 12 Fowler smells compile into every path rule — as judgement calls (🟢~🟡), never hard violations, and your repo's documented conventions override the baseline.
Works with your harness: Claude Code ✅ · any Agent-Skill-compatible agent ✅ · bare ocr CLI without the skill ✅
1. Install the skill
npx skills add anthonyhann/agentic-code-review2. Install the OCR CLI (deterministic engine, one script, idempotent)
bash scripts/setup-ocr.sh3. Review
/agentic-code-review
For AI Agents — paste this to your agent:
Install the skill at https://github.com/anthonyhann/agentic-code-review, run its
scripts/setup-ocr.sh, then review my current workspace changes.
LLM configuration is optional: with it you get mode A (full OCR pipeline); without it, mode B (delegate) — the Agent self-reviews with deterministic file/rule selection.
agentic-code-review/
├── SKILL.md # Single source of truth (the Agent's entry point) ⭐
├── team-rules/ # 6 compact rule packs (proto/go/php/vue/web + Fowler baseline)
├── rule.json # Compiled rules — 10 path rules (node scripts/build-rules.mjs)
├── scripts/ # build-rules / setup-ocr / queue-check (zero-LLM) / report / eval wrapper
├── rules/release-docs/ # 6 REL-OPS release/ops documentation checks
├── evals/ # skill-up eval config + 4 cases
├── legacy-rules/ # v1.x archive (34 files, 23,972 lines — reference only, never auto-loaded)
├── USAGE.md # Human usage tips
└── test-prompts.json # Scenario expectations
| When you say… | It triggers |
|---|---|
/agentic-code-review or /cr |
Full three-phase review of workspace changes |
/cr -c abc123 / /cr --from A --to B |
Single commit / branch range |
/cr internal/logic/ |
Full scan of a path (no diff needed) |
| "只检查安全问题" | Dimension-filtered findings, no extra token burn |
| "继续上次中断的审查" | ocr session list + --resume |
| "对比两个仓库的 queue 配置" | Cross-repo deterministic diff |
| "review 这份上线文档" | REL-OPS-001→006 checklist output |
Rule maintenance: edit team-rules/<lang>.md → node scripts/build-rules.mjs → verify with ocr rules check --rule rule.json <file>. Never edit rule.json directly.
- You want it to write code. This skill reviews and advises; it won't touch your files without explicit authorization.
- Your stack isn't PHP/Go/Vue/JS. Rules are path-matched per language; Java/Python/etc. get only the generic OCR pass — fork
team-rules/and write your own. - You need benchmark-grade guarantees. Deterministic checks (Queue, proto baseline) are exact; LLM-judged findings still require human sign-off — that's a feature (fact-check protocol), not a bug.
- A single command answers your question. Don't spin up a review pipeline to
grep.
Privacy: everything runs locally; the only outbound traffic is the LLM endpoint you configure. No telemetry, nothing to turn off.
These rules were distilled from real production incident postmortems — queue messages that never got consumed because of a filename's case on Linux, singleton fields overwritten mid-request, proto field numbers recycled into panics. Every rule exists because something once broke without it. I use it on my own changes before every merge; it's MIT, so make it yours.
⭐ If it catches one incident before prod, that's the whole pitch — a star tells me to keep distilling.
- Scored by skill-eval-optimizer over 19 optimization rounds: 61.2 → 93.1 / 100 (+31.9) — the largest measured gain in a production fleet of 49 agent skills (342 scored records, 2026-04 → 2026-10)
- The queue-consistency rules were rebuilt from real incident postmortems — they now catch the exact failure classes that once shipped to prod
- Run on the author's own changes before every merge — the v2 rewrite exists because v1's 23,972 lines of rules were too heavy for daily use
- 2026-10 v2.1.0 — dual-axis Standards/Spec review (requirement fidelity: missing / partial / scope creep / suspected-wrong) + 12-smell Fowler baseline compiled into
rule.json. - 2026-09 v2.0.0 — rebuilt on OCR hybrid drive: rules distilled from ~24k lines of natural language into 6 compact packs.
MIT © 2026 anthonyhann — open-code-review © Alibaba (Apache-2.0) does the deterministic heavy lifting.