review-by-opp:help
Learn about review-by-opp - what it does, how to use it, and available commands
Best use case
review-by-opp:help is best used when you need a repeatable AI agent workflow instead of a one-off prompt.
Learn about review-by-opp - what it does, how to use it, and available commands
Teams using review-by-opp:help should expect a more consistent output, faster repeated execution, less prompt rewriting.
When to use this skill
- You want a reusable workflow that can be run more than once with consistent structure.
When not to use this skill
- You only need a quick one-off answer and do not need a reusable workflow.
- You cannot install or maintain the underlying files, dependencies, or repository context.
Installation
Claude Code / Cursor / Codex
Manual Installation
- Download SKILL.md from GitHub
- Place it in
.claude/skills/help/SKILL.mdinside your project - Restart your AI agent — it will auto-discover the skill
How review-by-opp:help Compares
| Feature / Agent | review-by-opp:help | Standard Approach |
|---|---|---|
| Platform Support | Not specified | Limited / Varies |
| Context Awareness | High | Baseline |
| Installation Complexity | Unknown | N/A |
Frequently Asked Questions
What does this skill do?
Learn about review-by-opp - what it does, how to use it, and available commands
Where can I find the source code?
You can find the source code on GitHub using the link provided at the top of the page.
SKILL.md Source
# review-by-opp Help
You are answering questions about the **review-by-opp** Claude Code plugin.
## What is review-by-opp?
A Claude Code plugin that pairs Claude (builder) with OpenAI Codex CLI (independent auditor). It keeps a strict issue ledger so Claude cannot claim "all fixed" until every Codex review finding is actually closed.
## Why does this exist?
AI coding agents (Claude, Codex, etc.) have a problem: **they mark their own homework**. When Claude says "all issues fixed", there's no independent verification. You're trusting the builder to also be the auditor.
review-by-opp fixes this by enforcing **separation of concerns**:
- **Claude builds** - writes code, fixes bugs, implements features
- **Codex audits** - independently reviews Claude's work, finds issues Claude missed
- **The ledger enforces** - a deterministic stop gate prevents Claude from claiming completion until every finding is actually resolved
This creates an adversarial review loop where two different AI models hold each other accountable, with a mechanical gate that can't be talked past.
- **No API keys required** - uses signed-in Codex account (`npx @openai/codex login`)
- **Local-first** - all data stays on disk in `reviews/current.json`
- **Deterministic stop gate** - a shell hook blocks Claude from stopping if blocking findings remain
## Available Commands
| Command | What it does |
|---|---|
| `/review-by-opp:start` | Initialize a new review session. Checks git, Codex, and config. |
| `/review-by-opp:review` | Run Codex audit on your code. Parses findings into the ledger. |
| `/review-by-opp:fix` | Address findings one by one. Each fix requires an explicit resolution. |
| `/review-by-opp:status` | Show session status - open findings, rounds, agent config. |
| `/review-by-opp:resume` | Resume an existing session from `reviews/current.json`. |
| `/review-by-opp:finalize` | Run exit gate. Blocks if findings remain. Emits final verdict. |
| `/review-by-opp:help` | This help page. |
## Typical Workflow
1. `/start` - initialize session
2. `/review` - Codex audits your code, findings appear in the ledger
3. `/fix` - Claude fixes issues, marks each with a resolution state
4. `/review` - re-audit to verify fixes (repeat until clean)
5. `/finalize` - exit gate checks all findings are resolved
## Configuration
Create `.review-by-opp.json` in your project root:
```json
{
"reviewLedger": {
"maxRounds": 4,
"reviewScope": "diff",
"blockingSeverities": ["critical", "high", "medium"]
},
"codex": {
"modelStrategy": "best_available",
"model": "",
"reasoningEffort": "",
"auditMode": "standard",
"deepAuditReasoningEffort": "xhigh"
}
}
```
## Prerequisites
1. **Codex CLI signed in**: `npx @openai/codex login` (one-time, uses ChatGPT account)
2. **Plugin loaded**: `/plugins` → Add from local path, or `claude --plugin-dir /path/to/review-by-opp`
## Resolution States
Each finding must be resolved with one of: `fixed`, `wont_fix`, `false_positive`, `accepted_risk`, `deferred`, `duplicate`.
- `fixed` requires a `resolution_note` explaining the fix
- The exit gate blocks if any blocking finding is still `open` or `fixed` without a note
Answer the user's question about review-by-opp based on this information. If they ask something not covered here, check the project's `docs/` directory for more details.Related Skills
review-by-opp:status
Show current review ledger status including round count, open findings, blocking items, agent configuration, and whether the session can be finalized.
review-by-opp:start
Start a guarded implementation + review session. Use when beginning work that should be reviewed by Codex before completion. Initializes the review ledger and configures the stop gate.
review-by-opp:review
Run Codex as an independent reviewer against the current diff or changed files. Parses findings into the ledger. Use after making code changes.
review-by-opp:resume
Resume an existing review-by-opp session. Use when returning to a previous review session.
review-by-opp:fix
Address Codex review findings from the ledger. Shows open findings and guides resolution. Each finding must get an explicit resolution state.
review-by-opp:finalize
Finalize the review session. Only succeeds if all blocking findings are resolved. Emits final verdict.
flutter-dart-code-review
库无关的Flutter/Dart代码审查清单,涵盖Widget最佳实践、状态管理模式(BLoC、Riverpod、Provider、GetX、MobX、Signals)、Dart惯用法、性能、可访问性、安全性和整洁架构。
security-review
Use this skill when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment/sensitive features. Provides comprehensive security checklist and patterns.
addressing-pr-review-comments
Address all valid review comments on a PR for the current branch in the streamlit/streamlit repo. Covers both inline review comments and general PR (issue) comments. Use when a PR has reviewer feedback to address, including code changes, style fixes, and documentation updates.
lightning-architecture-review
Review Bitcoin Lightning Network protocol designs, compare channel factory approaches, and analyze Layer 2 scaling tradeoffs. Covers trust models, on-chain footprint, consensus requirements, HTLC/PTLC compatibility, liveness, and watchtower support.
helpdesk-automation
Automate HelpDesk tasks via Rube MCP (Composio): list tickets, manage views, use canned responses, and configure custom fields. Always search tools first for current schemas.
gha-security-review
Find exploitable vulnerabilities in GitHub Actions workflows. Every finding MUST include a concrete exploitation scenario — if you can't build the attack, don't report it.