ai-code-reviewer

majiayu000's avatarfrom majiayu000

WHEN: Deep AI-powered code analysis, multi-model code review, security scanning with Codex and GeminiWHAT: Comprehensive code review using external AI models with severity-based findings, deduplication, and secret detectionWHEN NOT: Simple lint checks -> code-reviewer, Quick security only -> security-scanner, Style formatting -> code-quality-checker

⭐0stars🔀0forks📁View on GitHub🕐Updated Jan 5, 2026
[Code Review]

When & Why to Use This Skill

This Claude skill provides comprehensive, multi-model AI code analysis by leveraging external models like OpenAI Codex and Google Gemini. It goes beyond standard linting to offer deep security scanning, secret detection, and architectural reviews with consensus-based scoring to ensure high-confidence findings and actionable recommendations.

Use Cases

  • Deep Security Analysis: Identifying complex vulnerabilities and hardcoded secrets using external AI perspectives to enhance codebase integrity before deployment.
  • Multi-Model Consensus Review: Aggregating insights from both Codex and Gemini to provide a balanced, high-accuracy audit of logic errors and architectural patterns.
  • Automated Secret Scanning: Detecting sensitive credentials, API keys, and private keys locally to prevent security leaks in repositories.
  • Performance & Style Optimization: Analyzing code for efficiency bottlenecks and consistency with project-specific style guides using specialized AI models.
nameai-code-reviewer
description|
WHENDeep AI-powered code analysis, multi-model code review, security scanning with Codex and Gemini
WHATComprehensive code review using external AI models with severity-based findings, deduplication, and secret detection
WHEN NOTSimple lint checks -> code-reviewer, Quick security only -> security-scanner, Style formatting -> code-quality-checker

AI Code Reviewer Skill

Purpose

Leverages external AI models (OpenAI Codex CLI and Google Gemini CLI) for deep code analysis beyond Claude's built-in capabilities. Provides multi-perspective code reviews with result aggregation and consensus scoring.

Prerequisites

At least one of the following must be installed and authenticated:

  • Codex CLI: Run codex auth to authenticate
  • Gemini CLI: Run gemini auth login to authenticate

When to Use

  • Deep security analysis requiring external AI perspective
  • Performance optimization requests needing specialized analysis
  • Multi-model code review for high-confidence findings
  • Large codebase analysis with result caching
  • Secret and credential detection in code

Available MCP Tools

analyze_code_with_codex

Uses OpenAI Codex for comprehensive code analysis.

  • Best for: General code review, bug detection, logical errors
  • Input: Code snippet with optional context (project type, language, focus areas)
  • Output: Structured findings with severity levels and suggestions

analyze_code_with_gemini

Uses Google Gemini for code analysis.

  • Best for: Performance analysis, architectural review, style consistency
  • Input: Code snippet with optional context
  • Output: Structured findings with code examples

analyze_code_combined

Aggregates results from both Codex and Gemini with deduplication.

  • Best for: High-stakes reviews requiring consensus
  • Features:
    • Parallel execution for speed
    • Result deduplication with similarity threshold
    • Confidence scoring based on agreement
  • Output: Merged findings with source attribution

scan_secrets

Detects hardcoded secrets, API keys, credentials, and sensitive data.

  • Best for: Pre-commit security checks
  • Patterns: AWS, GCP, Azure, GitHub, database credentials, private keys
  • Excludes: Test files, mock files by default
  • Output: Secret findings with severity and remediation suggestions

get_analysis_status

Retrieves status of async analysis operations.

  • Input: Analysis ID from previous tool call
  • Output: Status (pending/in_progress/completed/failed), result or error

Workflow

Step 1: Determine Analysis Type

Ask user for analysis preference:

Question: "What type of AI analysis do you need?"

Options:

  1. Quick Review - Single model, faster (Codex OR Gemini)
  2. Deep Review - Combined models with consensus scoring
  3. Security Scan - Secret detection only
  4. Performance Focus - Optimization-focused review
  5. Full Audit - Combined + secret scan

Step 2: Model Selection (if Quick Review)

Question: "Which AI model should be used?"

Options:

  1. Codex (OpenAI) - Better for bug detection, logical errors
  2. Gemini (Google) - Better for architectural patterns, style

Step 3: Set Context (Optional)

Question: "What's the project context?"

Options:

  1. Auto-detect - Infer from code
  2. Web App (React/Vue) - Frontend focus
  3. API (Node/Express) - Backend focus
  4. MCP Server - Protocol focus
  5. CLI Tool - User tool focus
  6. Library - Reusability focus

Step 4: Execute Analysis

Call the appropriate MCP tool based on selections.

Step 5: Present Results

Format findings in structured markdown with:

  • Overall assessment
  • Summary statistics
  • Grouped findings by severity
  • Actionable recommendations

Response Template

## AI Code Review Results

**Analysis ID**: [id]
**Models Used**: [codex/gemini/combined]
**Cache Status**: [hit/miss]
**Duration**: [Xms]

### Overall Assessment

[AI-generated overall assessment of code quality]

### Summary

| Severity | Count |
|----------|-------|
| Critical | X |
| High | X |
| Medium | X |
| Low | X |
| **Total** | **X** |

### Findings

#### Critical Issues

1. **[Title]** (Line X)
   - **Description**: [...]
   - **Suggestion**: [...]
   - **Code**: `[snippet]`

#### High Priority

[...]

### Recommendations

1. [Prioritized action item 1]
2. [Prioritized action item 2]
3. [...]

---
*Analysis by [model(s)] | Confidence: [X]% | Duration: [X]ms*

Integration Notes

  • Works alongside code-reviewer for comprehensive analysis
  • Complements security-scanner with external AI perspective
  • Results are cached (1 hour TTL) for repeated queries
  • Secret scanning runs locally, no external API calls
  • Triggered by /cr express command

Error Handling

  • CLI Not Found: Gracefully reports missing CLI, suggests installation
  • Authentication Failed: Guides user through auth process
  • Timeout: Returns partial results with warning
  • Rate Limited: Queues requests with exponential backoff

Performance Notes

  • Combined analysis runs in parallel by default
  • Cache reduces repeated analysis costs
  • Large files are truncated with warning
  • SQLite storage for persistent cache