code-reviewlisted

Send a code diff, pull request, file, or directory to the reviewer for code review with caller-assessed independence focused on security vulnerabilities, edge cases, concurrency hazards, performance bottlenecks, and architectural smells. Use when the user says "code review with the reviewer," "have the reviewer review this code," "have the reviewer review this PR," "have the reviewer review this diff," "check this for security flaws," "security audit," "concurrency audit," or "performance review." Also offer this proactively when the active primary is about to commit a change that touches authentication, authorization, cryptography, financial calculations, payment flows, concurrency primitives, schema migrations, or any module where a class of bug — not just an instance — could have user-visible consequences.
sumitake/agent-collab · ★ 0 · Code & Development · score 63

Install: claude install-skill sumitake/agent-collab

## Unified runtime invocation Resolve the **plugin root** from this loaded file: `SKILL.md` is at `<plugin-root>/skills/<skill-name>/SKILL.md`. Invoke only `python3 "<plugin-root>/coordinator.py"` and send one bounded JSON routing request on EOF-delimited stdin, without a PTY. Use the Python invocation example in the **Routing request** section in `<plugin-root>/README.md` and the co-packaged manifest's signed `wire_contract`; never invent fields or provider actions. Supply one caller-defined work unit per independently useful deliverable, with this skill's logical action and a bounded opaque payload. Use `depends_on` only for actual dependencies. Honor an operator-named provider with `explicit_target`. For an authorized independent review or governance task without an operator-named provider, also use that field to bind the caller-verified distinct reviewer selected by the caller or designated by the workflow. Carry the same target into planning and live dispatch; verify returned native lineage before accepting independence. Otherwise use normal untargeted routing. Choose quality and effort for the workload; include context/output token estimates when known. Read the current manifest digest and actual cwd device/inode; do not copy example values. The runtime owns its timeout; do not wrap it in a shorter fixed timeout. Repository identity, source-head verification, disposable copies, patch capture, and cleanup remain caller-owned where applicable. The shim runs standalone fr