Use when assessing AI/ML systems for prompt injection, jailbreak vulnerabilities, model inversion risk, data poisoning exposure, or agent tool abuse. Covers MITRE ATLAS technique mapping, injection signature detection, and adversarial robustness scoring.
open-code-review
open-code-review is an open-source security skill for Claude Code and compatible agents, published by alibaba. Its author describes it as: “Performs AI-powered code review on Git changes using the `ocr` CLI from alibaba/open-code-review. Use when the user asks to review code, review a pull request, review staged/unstaged changes, review a commit, or compa…”. The project has 21k stars on GitHub and is available under the Apache-2.0 license. Add it to your setup with `/plugin marketplace add alibaba/open-code-review`.
What open-code-review does
A skill for invoking open-code-review (`ocr`) — an open-source AI code review CLI that reads Git diffs and generates structured, line-level review comments.
Installation
Add open-code-review to your agent with:
/plugin marketplace add alibaba/open-code-reviewAlways review a skill's source before installing it. This command comes from the skill's public repository; the linked repo is the source of truth for exact setup steps.
What's inside
The SKILL.md for open-code-review is organised into these sections:
- Prerequisites check
- Workflow
- Step 1: Gather Business Context
- Step 2: Run Code Review
- Step 3: Classify and Report
- Step 4: Fix
- Output Format
- Custom Review Rules
- Gotchas
- Validation
- References
When to use it
Reach for open-code-review when you want security help from your agent without writing the same instructions every session. Load the skill and the agent picks it up automatically for relevant tasks.
Strengths
- Clear Apache-2.0 license — safe to read and adapt
- Ships in alibaba/open-code-review, an established project with 20,727 GitHub stars
- Actively maintained (recent commits)
Topics
Frequently asked questions
- What does open-code-review do?
- Performs AI-powered code review on Git changes using the `ocr` CLI from alibaba/open-code-review. Use when the user asks to review code, review a pull request, review staged/unstaged changes, review a commit, or compare branches for code quality issues. Produces line-level review comments and can automatically apply fixes when requested. With appropriate review rules, can detect various types of issues including bugs, security vulnerabilities, performance problems, and code quality concerns.
- How do I install open-code-review?
- Run /plugin marketplace add alibaba/open-code-review in your agent, then reload your skills. Review the source at https://github.com/alibaba/open-code-review before installing.
- Is open-code-review free to use?
- Yes. open-code-review is free and open source under the Apache-2.0 license, so you can read, run, and adapt it within that license's terms.
- Where does open-code-review come from?
- open-code-review ships inside alibaba/open-code-review, a repository that contains 3 catalogued skills in total. The repository's 20,727 GitHub stars apply to that whole collection, not to this skill on its own.
Related skills
More Security →/cs:aims-audit <scope> — ISO/IEC 42001 AIMS internal-audit 6-question forcing interrogation. Use before certification stage 1, before annual internal audit cycles, or when onboarding a new AI system into an existing AIMS.
Audits and designs iOS/macOS/watchOS/visionOS interfaces against the Apple Human Interface Guidelines, including the Liquid Glass design language (announced WWDC25, shipped with iOS 26/macOS Tahoe, Sept 2025). Use when reviewing an Apple-platform mockup or app for HIG compliance, checking contrast or tap-target sizes, or designing native-feeling Apple UI (e.g., 'audit my iOS app against the HIG', 'is this text readable on Liquid Glass?').
The durable documentation set that makes an AI-built (vibe-coded) app reviewable before shipping. A small core every app needs — architecture, user/permission flows, permissions, variables/secrets, and a test-coverage map — plus conditional docs added only when they apply: emails, scheduled work, SEO, and embedded agents/automation. Defines what each doc must capture and how a reviewer or auditor uses it. Use when documenting a codebase for handoff, mapping user journeys and trust-boundary crossings, planning test coverage, or preparing for a security or performance audit.
Security auditing for code, configs, and infrastructure. Use when the user wants to audit or improve security: scan for vulnerabilities (SQL injection, XSS, command injection, path traversal), detect hardcoded secrets and credentials, review auth and authorization, check dependencies for known CVEs, audit config files for insecure defaults, or generate security reports. Trigger on "security audit", "vulnerability scan", "code review for security", "find secrets", "check for vulnerabilities", "OWASP", "CVE", or questions about code security.