open-code-review

Performs AI-powered code review on Git changes using the `ocr` CLI from alibaba/open-code-review. Use when the user asks to review code, review a pull request, review staged/unstaged changes, review a commit, or compare branches for code quality issues. Produces line-level review comments and can automatically apply fixes when requested. With appropriate review rules, can detect various types of issues including bugs, security vulnerabilities, performance problems, and code quality concerns.

by alibaba 21k GitHub stars Apache-2.0 Updated Aug 18, 2026
open-code-review skill by alibaba
Social preview for alibaba/open-code-review

Overview

open-code-review is an open-source security skill for Claude Code and compatible agents, published by alibaba. Its author describes it as: “Performs AI-powered code review on Git changes using the `ocr` CLI from alibaba/open-code-review. Use when the user asks to review code, review a pull request, review staged/unstaged changes, review a commit, or compa…”. The project has 21k stars on GitHub and is available under the Apache-2.0 license. Add it to your setup with `/plugin marketplace add alibaba/open-code-review`.

What open-code-review does

A skill for invoking open-code-review (`ocr`) — an open-source AI code review CLI that reads Git diffs and generates structured, line-level review comments.

Best for

What’s inside

The SKILL.md for open-code-review is organised into these sections:

  • Prerequisites check
  • Workflow
  • Step 1: Gather Business Context
  • Step 2: Run Code Review
  • Step 3: Classify and Report
  • Step 4: Fix
  • Output Format
  • Custom Review Rules
  • Gotchas
  • Validation
  • References

Installation

Add open-code-review to your agent with:

/plugin marketplace add alibaba/open-code-review

Review a skill’s source before installing it — skills can instruct your agent to run commands. This command comes from the skill’s public repository, which is the source of truth for setup steps. New to skills? Read how to install Claude Code skills.

Supported agents

  • Claude Code — ships a claude code plugin marketplace

License

open-code-review is published under the Apache-2.0 license.

Strengths

  • Clear Apache-2.0 license — safe to read and adapt within its terms
  • Ships in alibaba/open-code-review, an established project with 20,727 GitHub stars
  • Works with Claude Code
  • Actively maintained — repository updated in the last 90 days

Author

alibaba 4 skills in the catalog · GitHub profile ↗
View skills

Topics

Need a skill like this, tailored to your team?Build a custom skill →

Frequently asked questions

What does open-code-review do?
Performs AI-powered code review on Git changes using the `ocr` CLI from alibaba/open-code-review. Use when the user asks to review code, review a pull request, review staged/unstaged changes, review a commit, or compare branches for code quality issues. Produces line-level review comments and can automatically apply fixes when requested. With appropriate review rules, can detect various types of issues including bugs, security vulnerabilities, performance problems, and code quality concerns.
How do I install open-code-review?
Run /plugin marketplace add alibaba/open-code-review in your agent, then reload your skills. Review the source at https://github.com/alibaba/open-code-review before installing.
Is open-code-review free to use?
Yes. open-code-review is free and open source under the Apache-2.0 license, so you can read, run, and adapt it within that license's terms.
Which agents does open-code-review work with?
open-code-review lists Claude Code — named in its SKILL.md, its plugin marketplace or its repository topics. Skills use the portable SKILL.md format, so other agents that read that format may load it too.
Where does open-code-review come from?
open-code-review ships inside alibaba/open-code-review, a repository that contains 3 catalogued skills in total. The repository's 20,727 GitHub stars apply to that whole collection, not to this skill on its own.

Use when assessing AI/ML systems for prompt injection, jailbreak vulnerabilities, model inversion risk, data poisoning exposure, or agent tool abuse. Covers MITRE ATLAS technique mapping, injection signature detection, and adversarial robustness scoring.

Claude CodeCodexCursor+1
25k GitHub stars MIT Updated Aug 17, 2026 Free

/cs:aims-audit <scope> — ISO/IEC 42001 AIMS internal-audit 6-question forcing interrogation. Use before certification stage 1, before annual internal audit cycles, or when onboarding a new AI system into an existing AIMS.

Claude CodeCodexCursor+1
25k GitHub stars MIT Updated Aug 17, 2026 Free

Audits and designs iOS/macOS/watchOS/visionOS interfaces against the Apple Human Interface Guidelines, including the Liquid Glass design language (announced WWDC25, shipped with iOS 26/macOS Tahoe, Sept 2025). Use when reviewing an Apple-platform mockup or app for HIG compliance, checking contrast or tap-target sizes, or designing native-feeling Apple UI (e.g., 'audit my iOS app against the HIG', 'is this text readable on Liquid Glass?').

Claude CodeCodexCursor+1
25k GitHub stars MIT Updated Aug 17, 2026 Free

The durable documentation set that makes an AI-built (vibe-coded) app reviewable before shipping. A small core every app needs — architecture, user/permission flows, permissions, variables/secrets, and a test-coverage map — plus conditional docs added only when they apply: emails, scheduled work, SEO, and embedded agents/automation. Defines what each doc must capture and how a reviewer or auditor uses it. Use when documenting a codebase for handoff, mapping user journeys and trust-boundary crossings, planning test coverage, or preparing for a security or performance audit.

Claude Code
25k GitHub stars MIT Updated Jul 3, 2026 Free

Security auditing for code, configs, and infrastructure. Use when the user wants to audit or improve security: scan for vulnerabilities (SQL injection, XSS, command injection, path traversal), detect hardcoded secrets and credentials, review auth and authorization, check dependencies for known CVEs, audit config files for insecure defaults, or generate security reports. Trigger on "security audit", "vulnerability scan", "code review for security", "find secrets", "check for vulnerabilities", "OWASP", "CVE", or questions about code security.

15k GitHub stars Apache-2.0 Updated Aug 18, 2026 Free