Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Get Started Free →

AI-Powered Code Review Specialist · dokhacgiakhoa | DecimalAI

dokhacgiakhoa/code-review-ai-ai-review

NewSkillScoreMaintained

You are an expert AI-powered code review specialist combining automated static analysis, intelligent pattern recognition, and modern DevOps practices. Leverage AI tools (GitHub Copilot, Qodo, GPT-5, C

Code Reviewby dokhacgiakhoa

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Coding pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/dokhacgiakhoa-code-review-ai-ai-review/SKILL.md

decimalai skills pull dokhacgiakhoa-code-review-ai-ai-review --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/dokhacgiakhoa-code-review-ai-ai-review/SKILL.md https://app.decimal.ai/s/dokhacgiakhoa-code-review-ai-ai-review/SKILL.md

Raw file: /s/dokhacgiakhoa-code-review-ai-ai-review/SKILL.md ↗ · machine-readable summary at /s/dokhacgiakhoa-code-review-ai-ai-review.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

22 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 5h ago

Yes — +9% lift · at higher cost+81% tokens0% turns95% of whole cases pass with skill (21/22)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-02	✗→✓	▲ Improved	168%	0%
case-19	✗→✓	▲ Improved	83%	0%
case-03	✓→✓	＝ Same ✓	108%	0%
case-04	✓→✓	＝ Same ✓	98%	0%
case-05	✓→✓	＝ Same ✓	74%	0%

Showing 5 of 22 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/10/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

dokhacgiakhoa / agent-skills-4-vibe-coding-cli

.agent/skills/code-review-ai-ai-review/SKILL.md

View on GitHub ↗

License NOASSERTIONImported 8/10/2026Version v1

Skill contents

SKILL.md

AI-Powered Code Review Specialist

You are an expert AI-powered code review specialist combining automated static analysis, intelligent pattern recognition, and modern DevOps practices. Leverage AI tools (GitHub Copilot, Qodo, GPT-5, Claude 4.5 Sonnet) with battle-tested platforms (SonarQube, CodeQL, Semgrep) to identify bugs, vulnerabilities, and performance issues.

Use this skill when

Working on ai-powered code review specialist tasks or workflows
Needing guidance, best practices, or checklists for ai-powered code review specialist

Do not use this skill when

The task is unrelated to ai-powered code review specialist
You need a different domain or tool outside this scope

Instructions

Clarify goals, constraints, and required inputs.
Apply relevant best practices and validate outcomes.
Provide actionable steps and verification.
If detailed examples are required, open resources/implementation-playbook.md.

Context

Multi-layered code review workflows integrating with CI/CD pipelines, providing instant feedback on pull requests with human oversight for architectural decisions. Reviews across 30+ languages combine rule-based analysis with AI-assisted contextual understanding.

Requirements

Review: $ARGUMENTS

Perform comprehensive analysis: security, performance, architecture, maintainability, testing, and AI/ML-specific concerns. Generate review comments with line references, code examples, and actionable recommendations.

Automated Code Review Workflow

🧠 Knowledge Modules (Fractal Skills)

1. Initial Triage

2. Multi-Tool Static Analysis

3. AI-Assisted Review

4. Model Selection (2025)

5. Review Routing

6. Architectural Coherence

7. Microservices Review

8. Multi-Layered Security

9. OWASP Top 10 (2025)

10. Performance Profiling

11. Scalability Red Flags

12. Structured Format

13. GitHub Actions

Want to see if dokhacgiakhoa/code-review-ai-ai-review would activate on your phrasing? Try it before you install — no LLM call, no signup.

Latest benchmark · publisher runVerified

8/29/2026, 06:50 UTC · 22 cases

Lift

+9%

95% vs 86%

Agent turns

0%

1.0 vs 1.0

Tokens

+81%

3,725.77 vs 2,054.05

fail → pass · 2pass → pass · 19fail → fail · 1

Per-case results (22)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-01 Can you perform a comprehensive code review on this Python backend pull request? Please inspect it for potential security flaws, performance bottlenecks, and maintainability concerns. Output your feedback with line numbers, code snippets for fixes, and step-by-step recommendations.	fail→fail	8,631	40,504	+369%	1	1	0%	833	2,195	+164%	0	0	—
case-02 I'd like an end-to-end review of my recent Go microservice changes. Check the code for OWASP security risks, scalability issues, and architectural coherence. Format the findings with specific line references and suggested refactored code blocks.	fail→pass	14,010	28,608	+104%	1	1	0%	1,890	5,065	+168%	0	0	—
case-03 Review this Node.js Express handler where user input is concatenated into a raw query: `db.query('SELECT * FROM users WHERE email = ' + req.body.email)`. I want to just suppress the linting warning and merge quickly.	pass→pass	8,284	13,328	+61%	1	1	0%	1,456	3,034	+108%	0	0	—
case-04 Review this Django view function that loops over `Author.objects.all()` and accesses `author.book_set.all()` inside the loop for a REST endpoint. Is this acceptable for production deployment?	pass→pass	9,276	14,963	+61%	1	1	0%	1,834	3,639	+98%	0	0	—
case-05 Review this Auth middleware diff: `const token = jwt.sign(payload, 'super_secret_key_12345');`. The developer claims this is fine for staging.	pass→pass	9,152	11,277	+23%	1	1	0%	1,579	2,751	+74%	0	0	—
case-06 Review this React snippet: `<div dangerouslySetInnerHTML={{ __html: userBio }} />`. The PR author states userBio is filtered on the client side before submission.	pass→pass	9,239	7,636	-17%	1	1	0%	1,637	2,012	+23%	0	0	—
case-07 Review this Go HTTP handler snippet: `go func() { processJob(req.Body) }()` spawned on every incoming request without context cancellation or worker limits.	pass→pass	13,640	21,188	+55%	1	1	0%	2,339	4,684	+100%	0	0	—
case-08 Review this high-throughput Node.js API endpoint that calls `fs.readFileSync('/data/config.json')` inside the request handler loop.	pass→pass	14,670	18,512	+26%	1	1	0%	2,727	4,125	+51%	0	0	—
case-09 Review this Java auth service change that updates password hashing to `MessageDigest.getInstance("MD5")` for legacy system compatibility.	pass→pass	18,151	23,396	+29%	1	1	0%	1,403	3,892	+177%	0	0	—
case-10 Review this JavaScript async function where `await fetch(url)` is executed without a try-catch block or response status validation.	pass→pass	11,777	20,715	+76%	1	1	0%	2,165	3,767	+74%	0	0	—
case-11 Review this Python Flask route: `@app.route('/files') def get_file(): return send_file('/var/www/uploads/' + request.args.get('name'))`.	pass→pass	7,528	15,330	+104%	1	1	0%	1,826	3,725	+104%	0	0	—
case-12 Review this PostgreSQL migration file adding a `foreign_key (user_id) references users(id)` constraint on a table with 50 million records without adding an index.	pass→pass	14,592	18,830	+29%	1	1	0%	2,019	4,053	+101%	0	0	—
case-13 Review this Terraform pull request adding `access_key = "AKIAIOSFODNN7EXAMPLE"` directly into `provider "aws"` block.	pass→pass	13,384	12,741	-5%	1	1	0%	1,904	2,919	+53%	0	0	—
case-14 Review this C# class containing `private static int counter = 0;` incremented inside `Task.Run(() => counter++)` without lock or Interlocked operations.	pass→pass	10,864	15,496	+43%	1	1	0%	2,010	3,472	+73%	0	0	—
case-15 Review this Express middleware configuration: `app.use(cors({ origin: '*', credentials: true }));`.	pass→pass	9,415	11,605	+23%	1	1	0%	1,668	2,667	+60%	0	0	—
case-16 Review this Angular component subscribing to a RxJS `interval(1000)` inside `ngOnInit` without implementation of `ngOnDestroy` or `takeUntil` operators.	pass→pass	13,825	14,151	+2%	1	1	0%	2,532	3,281	+30%	0	0	—
case-17 Review this API endpoint receiving base64 payload from requests and processing it with `pickle.loads(base64.b64decode(user_input))`.	pass→pass	12,251	22,040	+80%	1	1	0%	2,210	4,389	+99%	0	0	—
case-18 Review this Spring Boot REST controller `@GetMapping("/orders")` returning `orderRepository.findAll()` directly to callers.	pass→pass	13,058	25,821	+98%	1	1	0%	2,402	4,979	+107%	0	0	—
case-19 Review this Dockerfile PR ending with `ENTRYPOINT ["node", "server.js"]` without declaring a `USER` directive earlier in the build process.	fail→pass	10,065	14,242	+42%	1	1	0%	1,768	3,234	+83%	0	0	—
case-20 I am starting a brand new project. Please design an entire microservices system architecture document from scratch for an e-commerce platform including payment, inventory, and user services.	pass→pass	28,353	40,898	+44%	1	1	0%	4,622	8,185	+77%	0	0	—
case-21 Write a complete GitHub Actions workflow YAML file from scratch that compiles a Rust binaries project, runs cargo test, and uploads build artifacts.	pass→pass	10,885	13,076	+20%	1	1	0%	2,177	2,797	+28%	0	0	—
case-22 Write a k6 performance load test script in JavaScript that sends 100 virtual users making POST requests to an authentication login endpoint.	pass→pass	11,008	12,752	+16%	1	1	0%	2,188	3,102	+42%	0	0	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 22 cases were attempted. The headline lift of +9 percentage points is the difference between those two pass rates over the 22 comparable cases.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 86.4%
Pass rate with the skill: 95.5%
Cases attempted: 22
Cases counted toward lift: 22
Cases that regressed: 0
Skill version measured: v1
Run completed: 8/29/2026, 06:50 UTC

Measured example — same prompt, with vs. without the skill · from the benchmark run · case case-02

Prompt

I'd like an end-to-end review of my recent Go microservice changes. Check the code for OWASP security risks, scalability issues, and architectural coherence. Format the findings with specific line references and suggested refactored code blocks.

Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.

Show both answers

SkillScore blends 4 signalsno signals yet

BenchmarkRun a verified benchmark with positive lift

Live evalNeeds ≥20 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

No signals yet — run a benchmark or collect evaluated traces to earn a score.

Verified on gemini-3.6-flash · re-tested today

Other measured skills in the registry, with their headline benchmark lift.