Guide · Agent skill
How to use the Open Code Review agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
The open-code-review skill lets an AI agent review your Git changes by running the open-source ocr command-line tool. It is for developers and teams who want a structured second review before a pull request is merged or a release goes out. After this guide you will know what the skill does, how to install it, how to ask for a review in plain language, and what to check before you trust the results.
Open Code Reviewalibaba/open-code-review · Apache-2.0 Download the skill Quick start
- 1Get the ocr CLI. Install the tool with npm i -g @alibaba-group/open-code-review, or use a GitHub release binary.
- 2Configure an LLM provider. Make sure you have working API access to Anthropic, OpenAI Chat Completions, OpenAI Responses or AWS Bedrock.
- 3Download and unzip the skill. Get the ZIP from this page and unzip it into ~/.claude/skills/ or a project's .claude/skills/ folder.
- 4Or upload it in the Claude apps. Go to Settings → Capabilities → Skills and upload the skill there.
- 5Ask for a review. In a Git repository with changes, ask the agent to review your changes, a commit or a branch.
- 6Check the report. Read the findings grouped by severity and verify each one against the code.
- 7Apply fixes only on request. Ask for fixes explicitly, then review and test the changes before committing.
What the open-code-review skill makes the agent do
An agent skill is a folder with a SKILL.md file that tells an AI agent how to perform a specific task. This skill teaches the agent to run the ocr CLI from alibaba/open-code-review on your Git changes. The tool sends the diffs to an AI model you configure and returns line-level comments on bugs, security vulnerabilities, performance problems and code quality.
The agent then groups the findings by severity and drops low-severity items it judges to be nitpicks. It only edits your code to fix problems if you explicitly ask it to.
- Reviews uncommitted work, a single commit, or the difference between two branches
- Each comment carries a severity (critical, high, medium, low) and a category (bug, security, performance, maintainability, test, style, documentation, other)
- Applies fixes only when you ask for them
Install the open-code-review skill
Download the skill ZIP from this page and unzip it. Then put the skill folder in one of two places: ~/.claude/skills/ to make it available across your projects, or .claude/skills/ inside a specific project to make it available only there.
If you use the Claude apps instead, upload the skill under Settings → Capabilities → Skills.
- Personal install: unzip into ~/.claude/skills/
- Project install: unzip into the project's .claude/skills/ folder
- Claude apps: Settings → Capabilities → Skills, then upload
Install the ocr CLI the skill depends on
The skill does not review code by itself. It needs the ocr CLI on your machine. The source lists two ways to get it: the npm package or a GitHub release binary. The npm command is shown below.
If the agent runs a review and gets a command not found error, it is expected to install ocr with this same command.
npm i -g @alibaba-group/open-code-reviewSet up an LLM provider before the first run
The ocr tool sends diffs to an AI model, so you need working API access to a supported provider before the first review. The source lists four protocols: Anthropic, OpenAI Chat Completions, OpenAI Responses, and AWS Bedrock.
The skill source does not describe the provider configuration steps. Check the alibaba/open-code-review project for those details before you run your first review.
- Anthropic
- OpenAI Chat Completions
- OpenAI Responses
- AWS Bedrock
Trigger the skill with natural requests
You do not need to type a command. Ask the agent in plain language and the skill should trigger. The skill description names these kinds of requests: review code, review a pull request, review staged or unstaged changes, review a commit, or compare branches for code quality issues.
Adding background about the change helps. The skill tells the agent to pass business context through the --background flag, which the source says improves review quality.
- review my changes
- review the working copy
- review this PR or feature branch
- review commit abc123
- what would be reviewed? (preview only, no LLM call)
ocr review --audience agent -b "context"Review a branch, commit or preview the file list
For a branch comparison, the agent uses --from and --to with the two refs. For one commit, it uses --commit (or -c) to review that commit against its parent. To see which files would be reviewed without running the LLM, use --preview (or -p).
Large reviews can be written to a file with --output so the agent can read the full result. If your ocr version does not recognise --output, the skill tells the agent to ask you before upgrading.
- Branch: ocr review --audience agent -b "context" --from main --to <branch>
- Commit: ocr review --audience agent -b "context" --commit abc123
- Preview: ocr review --preview
- Full output file: --output /tmp/ocr_out.txt
ocr review --audience agent -b "context" --from main --to <branch>Read the results and decide on fixes
The agent presents findings grouped by severity: critical, high and medium, with low items discarded. Each finding shows a file and line, a category tag, a short description and a recommendation. If a comment has start_line and end_line both set to 0, the position failed and the agent is told to locate the relevant code itself.
Fixes are a separate step. If you asked for a review without fix intent, the agent should ask permission before changing anything. Verify any fix yourself before committing.
- Focus is on critical, high and medium items
- Complex fixes are described rather than applied
- Always check fixes before committing
Add project-specific review rules
You can define custom rules. OCR checks them in this order: a --rule flag, then <repo>/.opencodereview/rule.json, then ~/.opencodereview/rule.json, then the built-in defaults. By default a matching user rule replaces the built-in rule for that file, unless you set merge_system_rule to true.
To check which rule applies to a file before reviewing, use the rules check command.
ocr rules check src/main/java/com/example/Foo.javaWhat people use it for
- Reviewing your uncommitted work before you commit it
- Checking a feature branch against main before opening a pull request
- Looking at a single commit for bugs or security issues before a release
- Previewing which files a review would cover before spending LLM calls
Frequently asked questions
Is the open-code-review skill free to use?
The source lists the license as Apache-2.0 for the skill. It does not state any pricing. You still need your own API access to an LLM provider, and that provider may charge for usage.
What do I need before the skill works?
You need the ocr CLI installed, working API access to a supported LLM provider (Anthropic, OpenAI Chat Completions, OpenAI Responses or AWS Bedrock), and a Git repository with changes to review.
How do I install the open-code-review skill?
Download the ZIP from this page and unzip it into ~/.claude/skills/ for all projects or a project's .claude/skills/ folder for one project. In the Claude apps, you can upload it under Settings → Capabilities → Skills.
Does the skill send my code to an external service?
Yes. The ocr tool sends your Git diffs to the AI model you configure. Do not use it on projects where code must not leave your environment.
Why does the agent say ocr command not found?
The ocr CLI is not installed on your machine. Install it with npm i -g @alibaba-group/open-code-review, or use a GitHub release binary, then run the review again.
Can the skill fix my code automatically?
Only if you ask. The skill applies fixes when you request them, and it asks for permission first if you only asked for a review. Verify fixes before committing.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Use this skill if you want a structured, severity-grouped second review of your Git changes and you are comfortable sending diffs to an LLM provider you have set up. Pick a different tool if your code cannot leave your environment, or if you need a guaranteed or exhaustive audit, since AI review can miss issues and report false positives.
Download the skill