Agent Code Review Skill — AI Agent PR Review & Code Quality Protocol

The agent-code-review-skill is a 5-phase SKILL.md behavioral protocol for systematic AI agent code review. It teaches agents to analyze cyclomatic complexity, surface pre-commit security issues (OWASP patterns), detect test coverage gaps, generate actionable PR comments with blocking/suggestion/nit severity levels, and apply multi-language pattern libraries for TypeScript, Python, Go, and Rust. Built for vibe coding workflows where an agent reviews AI-generated code before merge — and for developer teams that want a consistent, automated review baseline across every PR. Compatible with Claude Code, OpenAI Codex CLI, Cursor, GitHub Copilot, and VS Code Copilot.

What's Covered (5 Phases)

Target Keywords Covered

• Agent code review skill — install via npx skills install agent-code-review-skill for any SKILL.md-compatible agent runtime
• AI agent code review protocol — structured SKILL.md behavioral protocol that agents load and execute at runtime
• Vibe coding code review agent — systematic review layer for AI-generated code before it merges to production
• AI agent PR review protocol — generates blocking/suggestion/nit PR comments with severity-labeled summaries
• SKILL.md code quality agent — 5-phase protocol covering the full code review stack: quality, security, tests, comments, language patterns
• Code review skill Claude Code OpenAI Codex — compatible with Claude Code, OpenAI Codex CLI, Cursor, GitHub Copilot, VS Code Copilot

Code Sample — Complexity Scorer

// From agent-code-review-skill Phase 1
// Cyclomatic + cognitive complexity scoring for any function

interface ComplexityScore {
  cyclomatic: number;   // Decision points + 1
  cognitive: number;    // Nesting depth × decision points
  verdict: 'green' | 'yellow' | 'red';
  action: string;
}

function scoreComplexity(fn: FunctionNode): ComplexityScore {
  const cyclomatic = countDecisionPoints(fn) + 1;
  const cognitive = countNestingPenalty(fn);

  // Green: cyclomatic ≤ 10 — maintainable
  // Yellow: cyclomatic 11–20 — review closely
  // Red: cyclomatic > 20 — must refactor

  const verdict =
    cyclomatic <= 10 && cognitive <= 15 ? 'green' :
    cyclomatic <= 20 && cognitive <= 25 ? 'yellow' : 'red';

  return { cyclomatic, cognitive, verdict,
    action: verdict === 'red' ? 'Extract sub-functions, reduce nesting depth' : 'OK' };
}

Code Sample — Security Red-Flag Scanner

// From agent-code-review-skill Phase 2
// Automated security pattern detection

const SECURITY_RED_FLAGS = [
  { pattern: /evals*(/, severity: 'critical', msg: 'eval() — remote code execution risk' },
  { pattern: /innerHTMLs*=/, severity: 'high', msg: 'innerHTML — XSS risk if user data involved' },
  { pattern: /querys*+s*['"`]/, severity: 'high', msg: 'SQL string concat — injection risk' },
  { pattern: /execs*(.*${/, severity: 'high', msg: 'Template literal in exec() — command injection' },
  { pattern: /console.log(.*key|secret|password/i, severity: 'medium', msg: 'Potential credential logging' },
];

function scanForSecurityIssues(code: string): SecurityFinding[] {
  return SECURITY_RED_FLAGS
    .filter(({ pattern }) => pattern.test(code))
    .map(({ severity, msg }) => ({ severity, message: msg }));
}

Use Cases

• Vibe coding quality gate — run agent-code-review-skill on every AI-generated PR before merge; catch complexity and security issues that slip through when code is written at high velocity
• Claude Code Auto Mode reviews — configure Claude Code to run this protocol on its own output before committing; agents that review their own work before shipping have far lower defect rates
• Pre-commit security checks — surface OWASP Top 10 patterns (SQL injection, XSS, command injection, secret logging) before code reaches CI/CD pipeline
• Test coverage enforcement — detect missing happy path, error path, and edge case tests at review time, not after a production incident
• Multi-language teams — consistent review baseline across TypeScript, Python, Go, and Rust codebases without language-specific linter configuration overhead
• PR comment generation for agent-written code — generate structured, severity-labeled PR comments that human reviewers can act on immediately

Compatible Agent Clients

How to Install

How to Access via x402

1. Free preview: GET https://clawmerchants.com/v1/preview/agent-code-review-skill — inspect protocol structure before paying
2. Probe: GET https://clawmerchants.com/v1/data/agent-code-review-skill → HTTP 402 with USDC payment details
3. Pay: Send $0.05 USDC on Base L2 (chain ID 8453) to the provider address in the 402 response
4. Receive: Resend with X-PAYMENT: <base64 proof> → HTTP 200 with full 5-phase code review protocol

# Step 1: Probe — discover payment requirements
curl -i https://clawmerchants.com/v1/data/agent-code-review-skill
# HTTP/1.1 402 Payment Required
# X-Payment-Required: {"amount":"50000","currency":"USDC","chain":8453,...}

# Step 2: Pay + resend with proof
curl -H "X-PAYMENT: <base64-payment-proof>"      https://clawmerchants.com/v1/data/agent-code-review-skill
# HTTP/1.1 200 OK — returns full agent-code-review-skill SKILL.md protocol

Pricing

$0.05 USDC per access — no subscription, no API key, no account required. The protocol catches security issues that would cost orders of magnitude more to fix after merge. A single blocked SQL injection vulnerability justifies the cost 10,000× over.

ClawMerchants — agent code review skill | AI agent code review protocol | SKILL.md code quality agent | vibe coding code review agent | AI agent PR review protocol | code review skill Claude Code OpenAI Codex | x402 + USDC + Base L2