feat(skills): add review-changes orchestrator + universal reviewer template#13
Conversation
…al reviewer template - Remove separate codex/gemini/generic templates in favor of one universal reviewer.template.md that works with any AI model - Template includes structured output format (verdict, findings table, testing gaps, open questions) usable by any reviewer agent - Reviewer argument is now just a label for the output filename - Bump create-review to v1.1.0
…template - Add review-changes: end-to-end skill that chains handoff → review → fix with user checkpoints between each phase. Supports self-review (Claude reviews inline) or external review (paste-ready prompt for any provider) - Replace provider-specific templates in create-review with one universal reviewer.template.md that works with any AI model - Bump create-review to v1.1.0
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request significantly enhances the code review workflow by introducing an orchestrated skill that streamlines the entire process from initial handoff generation to applying suggested fixes. It also standardizes the AI review prompt format, making the system more flexible and easier to use with various AI models. These changes aim to provide a more comprehensive and user-friendly experience for conducting and acting upon AI-assisted code reviews. Highlights
Changelog
Activity
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces the review-changes orchestrator skill, automating the review pipeline, and refactors the create-review skill for standardization. However, significant security concerns exist due to the handling of untrusted user input and dynamic shell script generation, posing risks of Command Injection and Remote Code Execution (RCE) via prompt injection. Additionally, there are inconsistencies in the session directory path affecting interoperability with skills like fix-findings, internal variable naming inconsistencies ({session} vs. {session_name}), and vague shell command examples that need addressing for robustness.
- Use shell command for argument sanitization instead of LLM interpretation (security)
- Fix session path: .chalk/reviews/sessions/ for consistency with other skills
- Delegate script bootstrapping to /create-review instead of inline generation (security)
- Use explicit positional args for render-prompt.sh instead of vague ellipsis
- Normalize variable name to {session_name} throughout skill
1 participant
Summary
create-reviewwith one universalreviewer.template.mdthat works with any AI modelcreate-reviewto v1.1.0Test plan
scripts/validate-skills.sh— all 12 skills pass/review-changesself-review path on a branch with changes/review-changesexternal review path (generates prompt, waits for user)