open-code-review-delegate
Delegation mode for open-code-review (OCR). Instead of OCR calling an LLM endpoint, this skill instructs the host agent to perform the code review itself, using OCR only for deterministic engineering: file selection and rule resolution
Install / Use
npx skills add alibaba/open-code-review --skill open-code-review-delegateInstalls into whichever agent you are using.
SKILL.md
Installable skill definition
Quality Score
Category
AI & Machine LearningSupported Platforms
Our assessment of open-code-review-delegate
open-code-review-delegate scores 98/100 on our quality scale, 31st of 598 AI & Machine Learning skills we index (top 6%).
Its SKILL.md is 7.7 KB long, well organised into 16 sections with 6 code examples: a thorough specification that gives an agent plenty to work with.
With 40,478 GitHub stars, it is one of the more widely adopted skills in the catalogue.
Maintenance, license and trust
- The repository was last updated yesterday, so open-code-review-delegate is actively maintained.
- It is released under the Apache-2.0 license, a permissive license that allows use, modification and commercial use with attribution.
- Its trust signals score 100/100, with no cautions. These come from repository metadata, not a code audit — read the skill file before letting an agent act on it.
Safety scan
No issues foundOur scan of the whole file found no instruction hijacking, hidden characters, credential access, data exfiltration or destructive commands.
Automated pattern scan on 2026-09-25. It catches known dangerous patterns, not every risk — read a skill before letting an agent act on it.
open-code-review-delegate compared with similar skills
All 4 of these similar skills score higher than open-code-review-delegate; compare them before choosing.
| Skill | Score | Stars | Updated | Format |
|---|---|---|---|---|
| open-code-review-delegate (this skill)by alibaba | 98 | 40.5k | 1d ago | SKILL.md |
| claude-memby thedotmack | 100 | 94.7k | today | CLAUDE.md |
| Agent-Reachby Panniantong | 100 | 85.4k | 9d ago | CLAUDE.md |
| Understand-Anythingby Egonex-AI | 100 | 84.1k | 13d ago | CLAUDE.md |
| headroomby headroomlabs-ai | 100 | 73.8k | today | CLAUDE.md |
Frequently asked questions
- How do I install open-code-review-delegate?
- Run
npx skills add alibaba/open-code-review --skill open-code-review-delegate. The install tabs above show the steps for each supported agent. - Which AI agents does open-code-review-delegate work with?
- It is written for Universal, as a SKILL.md file. Other agents that read the same format can often use it too.
- Is open-code-review-delegate safe to use?
- Our scan of the whole file found no instruction hijacking, hidden characters, credential access, data exfiltration or destructive commands. It is Apache-2.0-licensed and scores 100/100 on trust signals. Skills are instructions an agent will follow, so read the file before installing it and do not approve commands you do not understand.
- Is open-code-review-delegate still maintained?
- The repository was last updated yesterday, so open-code-review-delegate is actively maintained.
Skill content
View source on GitHubname: open-code-review-delegate
description: >
Delegation mode for open-code-review (OCR). Instead of OCR calling an LLM
endpoint, this skill instructs the host agent to perform the code review
itself, using OCR only for deterministic engineering: file selection and
rule resolution. Use when the host agent should drive the review with its
own LLM capabilities.
license: Apache-2.0
compatibility: >
Requires the ocr CLI installed (via npm install -g @alibaba-group/open-code-review or GitHub release binary). Does NOT
require a configured LLM endpoint — delegation mode is LLM-free on the
OCR side.
metadata:
author: alibaba
homepage: https://github.com/alibaba/open-code-review
version: "1.0.0"
Open Code Review — Delegation Mode
A skill for performing AI code review where OCR provides deterministic engineering (file filtering, rule resolution) and the host agent performs the actual review using its own intelligence and tools.
Workflow
Step 1: Preview — Determine What to Review
ocr delegate preview --format json [--from <ref> --to <ref>] [--commit <hash>] [--exclude <patterns>]
This outputs:
- mode (workspace / range / commit)
- from / to / commit / merge_base — ref metadata for constructing git commands
- Reviewable file list — paths, status, insertions/deletions
- Excluded files — with exclusion reason
Common invocations:
| Scenario | Command |
|----------|---------|
| Workspace changes | ocr delegate preview |
| Branch comparison | ocr delegate preview --from main --to feature |
| Single commit | ocr delegate preview -c abc123 |
Step 2: Get Rules for Files
ocr delegate rule --format json <path1> <path2> ...
Pass the reviewable file paths from Step 1. Output is grouped by rule content — files sharing the same rule appear under one group, avoiding repetition.
Step 3: Get Diffs
Use git directly based on the mode/ref info from Step 1:
Range mode (merge_base provided in preview output):
git diff <merge_base>..<to> -- <path>
Commit mode:
git show <commit> -- <path>
Workspace mode:
# Tracked files
git diff HEAD -- <path>
# New untracked files — read directly (entire file is new code)
cat <path>
Step 4: Review Each File
Create a checklist containing every reviewable_files entry. For each reviewable file:
Use (path, status) as the checklist identity. Workspace mode can report the same path twice when a staged deletion is followed by an untracked recreation.
- Get its diff (Step 3)
- Consult its Rule Group (from Step 2) for the review checklist
- Conduct a thorough review, using appropriate context tools as needed
- Mark the file
reviewed, orskippedwith a concrete reason
For large changes, review in bounded batches grouped by shared rules and diff size. Do not stop after finding the first high-severity issue.
Step 5: Format Output
Each comment must follow this structure:
| Field | Type | Required | Description | |-------|------|----------|-------------| | path | string | yes | Relative file path | | content | string | yes | Review comment describing the issue | | start_line | integer | no | Start line in the new file | | end_line | integer | no | End line in the new file | | category | enum | no | bug, security, performance, maintainability, test, style, documentation, other | | severity | enum | no | critical, high, medium, low |
Step 6: Classify and Report
Before reporting, verify that every previewed file is accounted for. Include total_files, reviewed_files, skipped_files, and coverage_rate in the summary. A skipped file must include its reason.
Group findings by severity:
- Critical/High: Bugs, security issues, data loss risks — always report
- Medium: Performance concerns, error handling gaps, maintainability issues — report with context
- Low: Style nits, minor suggestions — report only if clearly valuable
Discard likely false positives silently.
Step 7: Fix (Optional)
If the user requested "review and fix":
- Apply High/Critical fixes directly
- Describe Medium fixes that require manual intervention
- Skip Low-priority items unless trivial
Sub-commands Reference
| Command | Purpose |
|---------|---------|
| ocr delegate preview | Which files to review + mode/ref metadata |
| ocr delegate rule <path...> | Review rules grouped by content |
Shared Flags
| Flag | Description |
|------|-------------|
| --from <ref> | Source ref for range mode |
| --to <ref> | Target ref for range mode |
| -c, --commit <hash> | Single commit mode |
| --repo <path> | Repository root (default: cwd) |
| --rule <path> | Custom rule.json path |
| --exclude <patterns> | Comma-separated exclude patterns |
| -b, --background <text> | Business context |
| -B, --background-file <path> | Business context from Markdown file (takes precedence over -b) |
| -f, --format <text\|json> | Output format; use json for agent integrations |
Gotchas
- No LLM needed on OCR side — delegation mode never calls an LLM. All intelligence comes from the host agent.
- Rules are grouped — Files sharing the same rule are grouped together in the output. You can pass any number of paths per call; for large changes, fetch rules per-batch as you review.
- Working directory matters —
ocr delegateoperates on the Git repo at the current directory. Use--repo /pathto override. - Untracked files in workspace mode —
previewincludes untracked files. For these, read the file directly instead of usinggit diff. - Background context — pass
--backgroundtopreviewwhen you have requirement context; it appears in the output for your reference during review. - Coverage is mandatory — every
reviewable_filesentry must end as reviewed or explicitly skipped; do not silently omit files.
Recovering Oversized Background Context
--background-file has two independent limits. The raw file must not exceed
1 MiB, and the sanitized content must not exceed 8000 characters. Either
condition aborts the command. When the command reports either limit:
- Do not silently truncate the source file.
- Summarize the original material while preserving its requirements, constraints, acceptance criteria, and other review-critical details.
- Retry the affected command by passing the summary as one shell-safe
argument (for example, use a quoted/escaped argument produced by the host
shell, or write it to a new size-bounded file and pass that file). Do not
place untrusted summary text directly in a double-quoted shell template;
$(), backticks, quotes, and variable references can still be evaluated. Omit the original--background-fileso the CLI does not reload the same oversized file and fail again. - If a faithful summary is not possible, omit the OCR background entirely and read the original material directly during the review.
Troubleshooting CLI Version Compatibility
The --format flag is available in ocr v1.9.0 and later. The Skill and the
installed CLI can be updated independently. If a requested preview or rule
command with --format json fails specifically with unknown flag: --format,
rerun it without the flag and use text output for the rest of the delegation
run. Preserve the explicit mode, ref, file, and rule information from that
output; do not parse text output as JSON or invent missing schema fields. Do
not retry without the flag for any other error; report it and stop the affected
workflow.
The host-agent Skill may consume the equivalent text output to complete its
review checklist. Programmatic integrations that require schema_version or
other JSON fields must require a JSON-capable CLI instead: verify with
ocr --version and upgrade when necessary:
npm install -g @alibaba-group/open-code-review
Related Skills
claude-mem
94.7kPersistent Context Across Sessions for Every Agent – Captures everything your agent does during sessions, compresses it with AI, and injects relevant context back into future sessions. Works with Claude Code, OpenClaw, Codex, Gemini, Hermes, Copilot, OpenCode + More
Agent-Reach
85.4kGive your AI agent eyes to see the entire internet. Read & search Twitter, Reddit, YouTube, GitHub, Bilibili, XiaoHongShu — one CLI, zero API fees.
Understand-Anything
84.1kGraphs that teach > graphs that impress. Turn any code into an interactive knowledge graph you can explore, search, and ask questions about. Works with Claude Code, Codex, Cursor, Copilot, Gemini CLI, and more.
headroom
73.8kCompress tool outputs, logs, files, and RAG chunks before they reach the LLM. 20% fewer tokens for coding agents, 60-95% fewer tokens for JSON, same answers. Library, proxy, MCP server.
Languages
Trust signals
From repository metadata: license, adoption, age and documentation. Not a code audit — see the Safety scan above for what the skill file itself contains.
