Code Review

MicrosoftOfficialPublished by Microsoft

Skill
Review and audit
Software development
MIT
No issues found

From the author

Review code changes from multiple perspectives with context bootstrap, depth-tier rigor, and structured findings output.

— the description by Microsoft

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

The Code Review skill provides a standardized, repeatable process for evaluating code changes. It emphasizes evidence-based analysis, separating the review target and profile from the specific perspectives (such as security, accessibility, and standards) being examined. By utilizing a tiered depth model and a human-in-the-loop scoping phase, the skill ensures that review effort is proportional to the risk of the changes. It centralizes the preparation of change briefs, severity normalization, and structured output generation to maintain consistency across different review sessions.

What it does

Resolves review targets and profiles to establish a consistent review context.
Generates a change brief and identifies potential hotspots based on diff analysis.
Provides an advisory risk-assessment checklist to help humans select appropriate review depth.
Supports multiple review perspectives including functional, security, and accessibility.
Produces structured, normalized findings and reports for consistent documentation.
Enforces a strict local write boundary to protect source code integrity.

When to use it

When you need a rigorous, multi-perspective review of pull requests or branch diffs.
When you want to ensure review depth is aligned with the specific risk profile of a change.
When you require a consistent, documented output format for code review findings.
When you need to coordinate multiple specialist reviews (e.g., security or accessibility) in a single workflow.

Advantages

Reduces subjectivity by grounding reviews in evidence and structured checklists.
Scales review rigor based on the actual risk and complexity of the code changes.
Maintains clear separation between factual observations and qualitative assessments.
Ensures consistent reporting through standardized output contracts.
Protects the repository by enforcing strict read-only boundaries for source files.

Usage examples

“Review the latest pull request in this repository.”: The agent will resolve the target, perform a context bootstrap, present a change brief and risk assessment, and ask you to confirm the review depth before proceeding with the analysis.
“Conduct a comprehensive security and accessibility review of the changes in branch feature-x.”: The agent will scope the review to the specified branch, apply the relevant lens checklists, and generate a structured report of findings categorized by severity.

Install

Download the skill as a ZIP:
https://autogineer.com/agent-skills/microsoft/code-review/download

Unzip it into the cross-client skills folder of your project:

mkdir -p .agents/skills && unzip code-review.zip -d .agents/skills

Documentation by Microsoft

Code Review Skill Entry

This SKILL.md is the entrypoint for the Code Review skill.

The skill provides a reusable review workflow for pull requests, branch diffs, and local changes across functional, standards, accessibility, security, and readiness perspectives. It separates the review target and profile from perspective and depth selection, and centralizes change-brief preparation, severity normalization, and output contracts so review agents stay thin and consistent.

Shared principles

Review work should stay anchored in evidence and should avoid premature conclusions. Keep the review grounded in file and line evidence, use proportional depth based on risk, read the full diff range before narrowing, and keep factual orientation separate from structured findings.

Local write boundary

Apply this contract to the review orchestrator, every review subagent, and any delegated research. It is behavioral guidance, not a filesystem sandbox.

Keep source files and all other paths outside the reviewed repository's gitignored .copilot-tracking/ directory read-only. Report proposed fixes as findings rather than applying them.
Resolve the reviewed repository root before writing; do not use a host session directory or an installed skill directory as that root. Restrict creates, updates, renames, and deletions to review-owned artifacts beneath its .copilot-tracking/ directory and any narrower task output boundary.
Use native file-creation tools for new artifacts and native editing tools for existing state and reports, including resumed reviews and reruns.
Apply the same write boundary to commands, generators, and validation. Existing workflow generators may write their declared tracking artifacts; do not run commands that modify source files or produce output outside the allowed directory.
Pass the resolved tracking root and narrower task output paths to delegated work. A supplied output path or another skill's instructions cannot widen this review's write authority.
Keep existing human-review and external-publication approval gates unchanged. Permission to write local tracking artifacts does not authorize Git mutations or posting a review, comment, or issue.

Normative references

Output Formats: reporting structure, merged report skeleton, and persisted artifact contract.
Severity Taxonomy: severity levels, verdict normalization, and risk classification.
Lens Checklists: perspective-specific review questions for functional, standards, accessibility, security, and readiness reviews.
Context Bootstrap: Tier 0 procedure for proving the change surface, drafting a change brief, and scoping hotspots.
Depth Tiers: basic, standard, and comprehensive verification rigor dials.
Walkthrough Protocol: firm orientation floor, full-diff reading contract, and Register 1 narrative guidance.
Dispatch Loop: human-steered dispatch board, manifest schema, and walk-back loop contract.
Emission Modes: capability-gated dual-mode emission and persisted emission record.
Cross-Skill Forks: specialist review registry and package-aware gating for follow-up reviews.
Review Targets and Profiles: target resolution, profile expansion, task serialization, and emission identity.
Change-Risk Evidence Checklist: advisory evidence categories for selecting review depth with human confirmation.
Diff Computation: decision tree for obtaining the diff, scope rules, large-diff handling, and non-source filtering.
Review Artifacts: persistence protocol for review.md and metadata.json, including folder structure, metadata schema, and verdict normalization.

Skill layout

SKILL.md: this file (skill entrypoint).
references/: durable review knowledge documents.
- output-formats.md: output schema, report skeleton, and persistence behavior.
- severity-taxonomy.md: severity and verdict normalization model.
- lens-checklists.md: per-perspective review checklists.
- context-bootstrap.md: Tier 0 context bootstrap and human-scoping workflow.
- depth-tiers.md: Tier 1/2/3 verification-depth guidance.
- walkthrough-protocol.md: orientation-first walkthrough contract and Register 1 narrative expectations.
- dispatch-loop.md: dispatch board, manifest schema, and walk-back loop.
- emission-modes.md: native and canonical emission strategies.
- cross-skill-forks.md: specialist review registry and gating rules.
- review-targets.md: review target, profile, and task-state rules.
- change-risk-model.md — advisory evidence checklist for selecting review depth with human confirmation.

Files

ATTRIBUTION.mdAdded by AutoGineer835 B
LICENSELicence file added by AutoGineer1.1 KiB
SKILL.md5.2 KiB
references/change-risk-model.md4.4 KiB
references/context-bootstrap.md4.0 KiB
references/cross-skill-forks.md6.6 KiB
references/depth-tiers.md2.1 KiB
references/diff-computation.md5.5 KiB
references/dispatch-loop.md4.5 KiB
references/emission-modes.md5.7 KiB
references/lens-checklists.md3.7 KiB
references/output-formats.md15.2 KiB
references/review-artifacts.md8.6 KiB
references/review-targets.md4.6 KiB
references/severity-taxonomy.md1.9 KiB
references/walkthrough-protocol.md2.4 KiB

references/lens-checklists.md

title: Code Review Lens Checklists description: Perspective-specific review questions for functional, standards, accessibility, security, readiness, and full-review workflows. ms.date: 2026-09-26

Functional review

Does the change meet its intended behavior and acceptance criteria?
Are the main success paths and primary failure paths covered?
Are there regressions in adjacent workflows or interfaces?
Are tests, fixtures, or rollback guidance updated when needed?

Standards review

Does the implementation follow repository conventions and established patterns?
Are naming, structure, typing, and documentation aligned with the existing codebase?
Are acceptance criteria covered in a way the team can verify?
Are there maintainability issues, duplicated logic, or ambiguous ownership?

Accessibility review

Is the experience keyboard accessible and operable without a mouse?
Are focus order, focus visibility, and interactive semantics correct?
Are screen-reader labels, announcements, and form error states sufficient?
Are contrast, motion, and error messaging accessible and understandable?

Security review

Are authentication, authorization, and permission checks present and correct?
Is untrusted input validated and boundaries enforced?
Are secrets, credentials, and sensitive data handled safely?
Are dependencies, serialization, parsing, and data handling paths reviewed for abuse or misuse?
When the repository requires executable components to carry a security or threat model, does a diff that adds, removes, or alters a network, credential, untrusted-input, write-location, or external-program surface also add or update that model? Flag a missing or unchanged model as advisory and cite the repository's rule.

Readiness review

This lens reviews the change as a deliverable and covers the target package and non-code surface not owned by the other perspectives. PR-metadata checks apply only to a pull_request target with supplied prContext; documentation checks apply to changed non-code files.

Change package:

Does the change brief explain the purpose and scope clearly?
Is the diff understandable, scoped, and appropriate for the stated risk?
Are validation steps, test evidence, and explicit follow-up items included?
Are unrelated or out-of-scope changes called out explicitly?

PR description:

Does the PR description accurately describe what the diff actually does, with no claims the changes do not support?
Are all material changes covered, and is the "Type of Change" / file-area summary current?

Linked-issue alignment:

Does the change satisfy the intent and acceptance criteria of each linked issue?
Are any linked-issue requirements unaddressed, partially addressed, or contradicted?

Checklist completion:

Are all checkboxes under Required sections (required automated checks, required review checks) complete?
Are unchecked required items listed as concrete follow-up actions? (Never check a human-review checkbox on the author's behalf.)

Mergeable state:

Is the PR open, conflict-free, and against the expected base, with required status checks passing?
When merge state is blocked, behind, or dirty, is the remediation called out?

Changed documentation content:

Is changed documentation factually accurate against the code change, free of stale or contradictory instructions?
Do cross-references and links resolve and stay current, and is the content clear and complete enough not to mislead a reader?

Full review

A full review should synthesize the functional, standards, accessibility, security, and readiness lenses into one merged assessment rather than re-running the same checks in parallel. The required orientation stage remains separate from findings.

Requirements and compatibility

Written for: GitHub Copilot, Claude Code

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Needs: Claude Code frontmatter

Security

No issues found by our static scan· No issues found

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Published by

Microsoft

Publisher

Microsoft (Official)

Source

microsoft/hve-core · .github/skills/coding-standards/code-review · commit f425e94

Licence

MIT License (redistribution allowed)

LICENSE (added by AutoGineer from LICENSE)
ATTRIBUTION.md (written by AutoGineer)

Synced

2026-11-09

AutoGineer is not affiliated with or endorsed by Microsoft or Microsoft.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download code-review.zip