Generated banner for Code Review
Generated logo for Code Review

Code Review

MicrosoftOfficialPublished by Microsoft

  • Skill
  • Review and audit
  • Software development
  • MIT
  • No issues found

From the author

Review code changes from multiple perspectives with context bootstrap, depth-tier rigor, and structured findings output.
— the description by Microsoft

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

The Code Review skill provides a standardized, repeatable process for evaluating code changes. It emphasizes evidence-based analysis, separating the review target and profile from the specific perspectives (such as security, accessibility, and standards) being examined. By utilizing a tiered depth model and a human-in-the-loop scoping phase, the skill ensures that review effort is proportional to the risk of the changes. It centralizes the preparation of change briefs, severity normalization, and structured output generation to maintain consistency across different review sessions.

What it does

  • Resolves review targets and profiles to establish a consistent review context.
  • Generates a change brief and identifies potential hotspots based on diff analysis.
  • Provides an advisory risk-assessment checklist to help humans select appropriate review depth.
  • Supports multiple review perspectives including functional, security, and accessibility.
  • Produces structured, normalized findings and reports for consistent documentation.
  • Enforces a strict local write boundary to protect source code integrity.

When to use it

  • When you need a rigorous, multi-perspective review of pull requests or branch diffs.
  • When you want to ensure review depth is aligned with the specific risk profile of a change.
  • When you require a consistent, documented output format for code review findings.
  • When you need to coordinate multiple specialist reviews (e.g., security or accessibility) in a single workflow.

Advantages

  • Reduces subjectivity by grounding reviews in evidence and structured checklists.
  • Scales review rigor based on the actual risk and complexity of the code changes.
  • Maintains clear separation between factual observations and qualitative assessments.
  • Ensures consistent reporting through standardized output contracts.
  • Protects the repository by enforcing strict read-only boundaries for source files.

Usage examples

“Review the latest pull request in this repository.”
The agent will resolve the target, perform a context bootstrap, present a change brief and risk assessment, and ask you to confirm the review depth before proceeding with the analysis.
“Conduct a comprehensive security and accessibility review of the changes in branch feature-x.”
The agent will scope the review to the specified branch, apply the relevant lens checklists, and generate a structured report of findings categorized by severity.

Install

  1. Download the skill as a ZIP:

    https://mp-staging.autogineer.com/agent-skills/microsoft/code-review/download
  2. Unzip it into the cross-client skills folder of your project:

    mkdir -p .agents/skills && unzip code-review.zip -d .agents/skills

Documentation by Microsoft

Code Review Skill Entry

This SKILL.md is the entrypoint for the Code Review skill.

The skill provides a reusable review workflow for pull requests, branch diffs, and local changes across functional, standards, accessibility, security, and readiness perspectives. It separates the review target and profile from perspective and depth selection, and centralizes change-brief preparation, severity normalization, and output contracts so review agents stay thin and consistent.

Shared principles

Review work should stay anchored in evidence and should avoid premature conclusions. Keep the review grounded in file and line evidence, use proportional depth based on risk, read the full diff range before narrowing, and keep factual orientation separate from structured findings.

Local write boundary

Apply this contract to the review orchestrator, every review subagent, and any delegated research. It is behavioral guidance, not a filesystem sandbox.

  • Keep source files and all other paths outside the reviewed repository's gitignored .copilot-tracking/ directory read-only. Report proposed fixes as findings rather than applying them.

  • Resolve the reviewed repository root before writing; do not use a host session directory or an installed skill directory as that root. Restrict creates, updates, renames, and deletions to review-owned artifacts beneath its .copilot-tracking/ directory and any narrower task output boundary.

  • Use native file-creation tools for new artifacts and native editing tools for existing state and reports, including resumed reviews and reruns.

  • Apply the same write boundary to commands, generators, and validation. Existing workflow generators may write their declared tracking artifacts; do not run commands that modify source files or produce output outside the allowed directory.

  • Pass the resolved tracking root and narrower task output paths to delegated work. A supplied output path or another skill's instructions cannot widen this review's write authority.

  • Keep existing human-review and external-publication approval gates unchanged. Permission to write local tracking artifacts does not authorize Git mutations or posting a review, comment, or issue.

Normative references

  1. Output Formats: reporting structure, merged report skeleton, and persisted artifact contract.

  2. Severity Taxonomy: severity levels, verdict normalization, and risk classification.

  3. Lens Checklists: perspective-specific review questions for functional, standards, accessibility, security, and readiness reviews.

  4. Context Bootstrap: Tier 0 procedure for proving the change surface, drafting a change brief, and scoping hotspots.

  5. Depth Tiers: basic, standard, and comprehensive verification rigor dials.

  6. Walkthrough Protocol: firm orientation floor, full-diff reading contract, and Register 1 narrative guidance.

  7. Dispatch Loop: human-steered dispatch board, manifest schema, and walk-back loop contract.

  8. Emission Modes: capability-gated dual-mode emission and persisted emission record.

  9. Cross-Skill Forks: specialist review registry and package-aware gating for follow-up reviews.

  10. Review Targets and Profiles: target resolution, profile expansion, task serialization, and emission identity.

  11. Change-Risk Evidence Checklist: advisory evidence categories for selecting review depth with human confirmation.

  12. Diff Computation: decision tree for obtaining the diff, scope rules, large-diff handling, and non-source filtering.

  13. Review Artifacts: persistence protocol for review.md and metadata.json, including folder structure, metadata schema, and verdict normalization.

Skill layout

  • SKILL.md: this file (skill entrypoint).

  • references/: durable review knowledge documents.

    • output-formats.md: output schema, report skeleton, and persistence behavior.

    • severity-taxonomy.md: severity and verdict normalization model.

    • lens-checklists.md: per-perspective review checklists.

    • context-bootstrap.md: Tier 0 context bootstrap and human-scoping workflow.

    • depth-tiers.md: Tier 1/2/3 verification-depth guidance.

    • walkthrough-protocol.md: orientation-first walkthrough contract and Register 1 narrative expectations.

    • dispatch-loop.md: dispatch board, manifest schema, and walk-back loop.

    • emission-modes.md: native and canonical emission strategies.

    • cross-skill-forks.md: specialist review registry and gating rules.

    • review-targets.md: review target, profile, and task-state rules.

    • change-risk-model.md — advisory evidence checklist for selecting review depth with human confirmation.

Files

references/diff-computation.md


description: "Code review diff computation: branch detection, scope locking, large-diff handling, and non-source filtering"

Diff Computation Protocol

Obtain the diff before reading any source files. Use the decision tree below to determine the appropriate method, then apply scope rules and large diff handling.

Decision Tree

Run git branch --show-current and git status --short to determine context. Match the first applicable case:

  1. Branch review (user explicitly requests a specific branch or PR, or is on a feature branch that is not main and not detached HEAD): follow the Feature Branch Diff section. The pr-reference skill captures committed changes; a working-tree supplement captures staged, unstaged, and untracked changes. If the user says "review the PR" while on main or detached HEAD without naming a branch, PR, or commit, ask which branch or PR they want reviewed, then route to this case or to the Specific Commit section as appropriate.

  2. Local uncommitted changes on main or detached HEAD (not on a feature branch, but edits exist that are not yet committed): follow the Uncommitted Changes section.

  3. Selected code or #file references (user selects code in the editor or references #file:path/to/file.ext): follow the Selected Code section.

  4. Specific commit review (user asks to review a particular commit): follow the Specific Commit section.

  5. No reviewable content: inform the user that no diff could be determined and stop.

Feature Branch Diff

Invoke the pr-reference skill to compute the diff. The skill handles branch detection, merge-base resolution, file listing, non-source exclusions, and large diff chunking.

  1. Generate the structured diff to an explicit output path so that path is a single source of truth the review agent reuses for diffPatchPath (overridable, not implicitly coupled to the skill default):

    generate.sh --base-branch auto --merge-base --exclude-ext min.js,min.css,map --output .copilot-tracking/pr/pr-reference.xml
    generate.ps1 -BaseBranch auto -MergeBase -ExcludeExt min.js,min.css,map -OutputPath .copilot-tracking/pr/pr-reference.xml
  2. Get the changed file list:

    list-changed-files.sh --exclude-type deleted --format plain
    list-changed-files.ps1 -ExcludeType Deleted -Format Plain
  3. For large diffs, use chunk planning and batched analysis:

    read-diff.sh --info       # chunk count and size summary
    read-diff.sh --chunk N    # read chunk N
    read-diff.ps1 -Info        # chunk count and size summary
    read-diff.ps1 -Chunk N     # read chunk N

If the changed-file list (list-changed-files.sh or list-changed-files.ps1) returns an empty list, stop and report "no reviewable content" per Decision Tree case 5.

Pass the diff output and file list as pre-computed input to the review agent so it skips its own scope detection.

Uncommitted Changes

  • Unstaged: git diff HEAD

  • Staged: git diff --cached

  • Untracked (new files not yet staged): enumerate with git ls-files --others --exclude-standard, then read the full content of each file as the review input.

Selected Code

Use the provided code as the review input; no git diff is needed. Apply all loaded skills or review logic to the selected code. Skip artifact persistence since there is no branch context.

Specific Commit

git diff <commit>^..<commit>

Scope Rules

  • Do not enumerate, list, or read source files before obtaining the diff or review input.

  • Only lines present in the diff (added or modified lines) are in scope for findings.

  • For selected code reviews (no diff context), all provided code lines are in scope.

  • Read full file contents only for contextual understanding of diff lines, never as a source of findings.

  • Pre-existing issues in unchanged code go in the Out-of-scope Observations table, clearly labelled and excluded from the verdict.

Large Diff Handling

Use the timeout parameter on terminal commands to prevent hanging on large repositories.

Changed FilesStrategy
Fewer than 20Analyze all files with full diffs.
20 to 50Group files by directory and analyze each group.
More than 50Progressive batched analysis, processing 5-10 files at a time.

When a diff exceeds 2000 lines of combined changes or 500 lines in a single file, review the most recent commits individually using git log --oneline and git show --stat.

Non-Source Artifact Skip List

Skip these artifacts when computing and analyzing diffs:

  • Lock files: package-lock.json, yarn.lock, pnpm-lock.yaml

  • Minified bundles: .min.js, .min.css

  • Source maps: .map

  • Binaries

  • Build output directories: /bin/, /obj/, /node_modules/, /dist/, /out/, /coverage/

Fallback (pr-reference skill unavailable)

If the pr-reference skill scripts are not found or fail, compute the diff manually:

  1. Resolve the merge-base: git merge-base origin/<default-branch> HEAD

  2. Generate the diff: git diff <merge-base>...HEAD

  3. List changed files: git diff <merge-base>...HEAD --name-only

  4. For uncommitted changes, supplement with git diff HEAD, git diff --cached, and git ls-files --others --exclude-standard

Apply the Non-Source Artifact Skip List and Large Diff Handling rules to the manual output.

Requirements and compatibility

Written for: GitHub Copilot, Claude Code

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Needs: Claude Code frontmatter

Security

No issues found by our static scan· No issues found

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Published by
Microsoft
Publisher
Microsoft (Official)
Source
microsoft/hve-core · .github/skills/coding-standards/code-review · commit f425e94
Licence
MIT License (redistribution allowed)
  • LICENSE (added by AutoGineer from LICENSE)
  • ATTRIBUTION.md (written by AutoGineer)
Synced

AutoGineer is not affiliated with or endorsed by Microsoft.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download code-review.zip