codex-code-review

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Adversarial Code Review with Codex

使用Codex进行对抗性代码评审

Act as the primary code reviewer. Produce a high-confidence review by debating findings with OpenAI Codex CLI as the external reviewer. Do not assume which agent or provider invoked this skill.

YOU ARE READ-ONLY. Do not use file-editing or write tools. Do not modify or create files in the repository. Do not suggest or apply fixes. Only report findings.

担任主代码评审员。通过与作为外部评审员的OpenAI Codex CLI辩论评审结果，生成高可信度的评审报告。无需假设是哪个代理或提供商调用了此技能。

您仅可读取内容。请勿使用文件编辑或写入工具。请勿修改或创建仓库中的文件。请勿建议或应用修复方案。仅需报告评审发现。

Reference files

参考文件

Read these when you reach the relevant step:

```
references/debate-protocol.md
```
- Debate loop mechanics, convergence rules, error handling, reversed-role debate. Read before Step 6.
```
references/prompt-template.md
```
- Prompt templates for Codex calls and output parsing guidance. Read before Step 4.

在执行到相关步骤时阅读以下文件：

```
references/debate-protocol.md
```
- 辩论循环机制、收敛规则、错误处理、角色反转辩论。在执行步骤6前阅读。
```
references/prompt-template.md
```
- Codex调用的提示模板和输出解析指南。在执行步骤4前阅读。

Depth modes

深度模式

Determine which depth mode from the user's request:

Quick: Single-pass review from Codex. No debate. Use when the user says "quick", "fast", "single pass", or similar.

Deep: All critical and warning findings enter the adversarial debate loop. Info findings pass through. Use when the user says "deep", "thorough", "argue everything", or similar.

Auto (default): You decide what to debate based on:

Diff under 200 lines with any critical/warning: debate them all
Diff over 200 lines: debate only critical, pass through warning/info
Files touching auth, crypto, payments, permissions, or security-sensitive paths: debate all critical and warning regardless of diff size
All info-level: skip debate
10+ findings: debate only top 5 by severity

State which mode you chose and why at the top of the report.

根据用户请求确定使用哪种深度模式：

快速模式：由Codex进行单次评审，不进行辩论。当用户提到“quick”“fast”“single pass”或类似词汇时使用。

深度模式：所有严重和警告级别的评审发现进入对抗性辩论循环，信息级发现直接通过。当用户提到“deep”“thorough”“argue everything”或类似词汇时使用。

自动模式（默认）：您根据以下规则决定哪些内容需要辩论：

差异少于200行且存在任何严重/警告级问题：全部进行辩论
差异超过200行：仅对严重级问题进行辩论，警告/信息级问题直接通过
文件涉及认证、加密、支付、权限或安全敏感路径：无论差异大小，全部严重和警告级问题都要辩论
所有信息级问题：跳过辩论
发现超过10个：仅对严重程度排名前5的问题进行辩论

在报告顶部说明您选择的模式及原因。

Step 1: Understand the request

步骤1：理解请求

Read the arguments the user provided. They may include:

File paths to review directly
A directory to review uncommitted changes in
A branch name to diff against
A commit SHA to review
A PR number or GitHub PR URL to review
Depth preference (words like "quick", "deep", "thorough")
Focus areas (e.g. "focus on SQL injection")

Interpret these naturally. If a token looks like a file path, check if it exists. If it looks like a branch, check with git. If it looks like a directory, cd into it. If it looks like a PR number or GitHub PR URL, verify with

gh pr view <number> --json number

(don't fetch the diff — Codex will run

gh pr diff

itself). If something doesn't resolve to anything (not a file, directory, branch, commit SHA, or PR), tell the user: "Could not resolve '<token>': not a file, directory, branch, commit SHA, or PR number."

If no target is specified, review uncommitted changes in the current working directory.

阅读用户提供的参数，可能包括：

直接评审的文件路径
需评审未提交变更的目录
用于对比差异的分支名称
需评审的提交SHA值
PR编号或GitHub PR链接
深度偏好（如“quick”“deep”“thorough”等词汇）
重点关注领域（例如“focus on SQL injection”）

自然解读这些参数。如果某个标识看起来像文件路径，检查其是否存在；如果看起来像分支，用git验证；如果看起来像目录，进入该目录；如果看起来像PR编号或GitHub PR链接，用

gh pr view <number> --json number

验证（无需获取差异——Codex会自行运行

gh pr diff

）。如果某个标识无法解析为任何内容（不是文件、目录、分支、提交SHA或PR），告知用户：“无法解析'<标识>'：不是文件、目录、分支、提交SHA或PR编号。”

如果未指定评审目标，评审当前工作目录中的未提交变更。

Step 2: Check prerequisites

步骤2：检查前置条件

Run

which codex

. If not found, stop and report: "The codex CLI is not installed. Install it with:

npm install -g @openai/codex

For non-file review modes, verify you're in a git repo with

git rev-parse --git-dir

运行

which codex

。如果未找到，停止操作并报告：“未安装codex CLI。请使用以下命令安装：

npm install -g @openai/codex

”

对于非文件评审模式，用

git rev-parse --git-dir

验证当前是否处于git仓库中。

Step 3: Determine the review target

步骤3：确定评审目标

Figure out what Codex needs to review based on the user's request. Don't generate diffs or read file contents yourself — Codex has full filesystem access and can do this itself. Your job is to describe the target clearly so Codex knows where to look.

Uncommitted changes: Quick-check with
```
git status
```
that there are actually changes. If none, report: "No uncommitted changes found." The target description for Codex is: "uncommitted changes (staged and unstaged) in
```
<absolute repo path>
```
".
Branch diff: Verify the branch exists with
```
git rev-parse
```
. The target description is: "changes on the current branch compared to
```
<branch>
```
in
```
<absolute repo path>
```
".
Commit: Verify the SHA exists. The target description is: "the changes introduced by commit
```
<SHA>
```
in
```
<absolute repo path>
```
".
PR: Verify the PR exists with
```
gh pr view
```
. The target description is: "the changes in PR
```
#<N>
```
— Codex should run
```
gh pr diff <N>
```
to see the diff — checked out in
```
<absolute repo path>
```
".
File paths: Verify the files exist. The target description is: "the files
```
<absolute paths>
```
".

Resolve all paths to absolute. You'll pass this target description to Codex in the next step.

根据用户请求确定Codex需要评审的内容。请勿自行生成差异或读取文件内容——Codex拥有完整的文件系统访问权限，可自行完成这些操作。您的任务是清晰描述目标，让Codex知道去哪里查找。

未提交变更：用
```
git status
```
快速检查是否存在变更。如果没有，报告：“未找到未提交的变更。”给Codex的目标描述为：“
```
<绝对仓库路径>
```
中的未提交变更（已暂存和未暂存）”。
分支差异：用
```
git rev-parse
```
验证分支是否存在。目标描述为：“
```
<绝对仓库路径>
```
中当前分支与
```
<分支>
```
的差异”。
提交：验证SHA值是否存在。目标描述为：“
```
<绝对仓库路径>
```
中提交
```
<SHA>
```
引入的变更”。
PR：用
```
gh pr view
```
验证PR是否存在。目标描述为：“PR
```
#<N>
```
中的变更——Codex应运行
```
gh pr diff <N>
```
查看差异——已检出至
```
<绝对仓库路径>
```
”。
文件路径：验证文件是否存在。目标描述为：“
```
<绝对路径>
```
对应的文件”。

将所有路径解析为绝对路径。您将在下一步把此目标描述传递给Codex。

Step 4: Get initial review from Codex

步骤4：从Codex获取初始评审结果

Read

references/prompt-template.md

for the exact prompt format and output parsing guidance. The prompt tells Codex what to review by description — never paste diffs, file contents, or code into the prompt. Codex reads the files and runs git commands itself.

Call

codex exec

with the review prompt. Always pass

--full-auto

. Pipe via stdin using heredoc syntax:

bash

codex exec --full-auto - <<'CODEX_PROMPT'
<prompt content here>
CODEX_PROMPT

Always quote user-provided values in shell commands. Prefer heredoc over

echo "$PROMPT"

to avoid shell interpretation of prompt content.

阅读

references/prompt-template.md

获取确切的提示格式和输出解析指南。提示需通过描述告知Codex评审内容——切勿将差异、文件内容或代码粘贴到提示中。Codex会自行读取文件并运行git命令。

调用

codex exec

并传入评审提示。始终传递

--full-auto

参数。使用here-doc语法通过标准输入传递：

bash

codex exec --full-auto - <<'CODEX_PROMPT'
<提示内容>
CODEX_PROMPT

在shell命令中始终对用户提供的值加引号。优先使用here-doc而非

echo "$PROMPT"

，避免shell解析提示内容。

Run Codex without blocking the workflow

非阻塞运行Codex，不中断工作流

Codex is slow. A thorough review routinely takes 3–10 minutes, sometimes longer for big diffs. Use the current runtime's background or non-blocking process support when available, with a 10-minute ceiling. If the runtime only supports foreground commands, run Codex there and wait for completion with the same ceiling. Do not poll, sleep, or spin.

While Codex runs, do other useful work when the runtime allows it: re-read the changed files, sketch independent findings for the reversed-role debate in Step 6, or prepare the report structure.

If the 10-minute ceiling is hit, inspect incremental process output using the runtime's available mechanism. If Codex was still making progress, relaunch the same prompt with another bounded run. Only treat the run as failed if Codex exited cleanly with no progress.

Codex运行速度较慢。一次全面评审通常需要3-10分钟，对于大型差异有时会更久。如果当前运行环境支持后台或非阻塞进程，请使用该功能，设置10分钟的上限。如果运行环境仅支持前台命令，则在前台运行Codex并等待完成，同样设置10分钟上限。请勿轮询、休眠或空转。

当Codex运行时，如果运行环境允许，可同时处理其他有用工作：重新读取变更的文件、为步骤6中的角色反转辩论草拟独立发现，或准备报告结构。

如果达到10分钟上限，使用运行环境提供的机制检查增量进程输出。如果Codex仍在推进，重新启动相同的提示并设置新的时间限制。只有当Codex正常退出且无任何进展时，才判定运行失败。

Skipping Codex is failure, not a fallback

跳过Codex属于失败，而非备选方案

The entire value of this skill is the independent review from Codex. A primary-reviewer-only result silently defeats that purpose. Treat "Codex took too long" as "wait longer," not as a reason to abandon the external review.

The only acceptable reasons to proceed without Codex:

```
codex
```
is not installed (already handled in Step 2)
Non-zero exit code with a concrete error (auth, network, API failure) — surface the error verbatim
Genuinely empty output after a clean exit

These are NOT acceptable reasons:

"It's been a while"
"I'm worried the cache will expire"
"I think the user is waiting"
"The diff is big so I'll just review it myself"

If Codex truly fails per the criteria above, stop and tell the user:

Codex failed: <reason>. Retry, or proceed with a primary-reviewer-only review?

Wait for their decision. Do not silently downgrade.

Output validation: Verify the output contains either

NO_ISSUES_FOUND

or at least one

FINDING:

marker (case-insensitive). See the prompt template reference for parsing guidance when output doesn't match exactly.

If Codex returned
NO_ISSUES_FOUND
: in Deep or Auto mode, do NOT stop — proceed to Step 6 for the reversed-role debate. In Quick mode, report clean and stop (Quick is single-pass by definition).

此技能的核心价值在于Codex提供的独立评审结果。仅由主评审员完成的结果会直接削弱该价值。将“Codex运行时间过长”视为“等待更久”，而非放弃外部评审的理由。

以下是无需Codex即可继续的唯一可接受理由：

未安装
```
codex
```
（已在步骤2中处理）
非零退出码且有具体错误（认证、网络、API失败）——直接显示原始错误
正常退出后输出为空

以下是不可接受的理由：

“已经过了一会儿”
“我担心缓存会过期”
“我觉得用户在等”
“差异太大，我自己评审就好”

如果Codex确实符合上述失败标准，停止操作并告知用户：

Codex运行失败：<原因>。是否重试，或仅由主评审员进行评审？

等待用户决定。请勿擅自降级评审方式。

输出验证：验证输出是否包含

NO_ISSUES_FOUND

或至少一个

FINDING:

标记（不区分大小写）。如果输出与预期格式不完全匹配，请参考提示模板中的解析指南。

如果Codex返回
NO_ISSUES_FOUND
：在深度或自动模式下，请勿停止——继续执行步骤6进行角色反转辩论。在快速模式下，报告无问题并停止（快速模式定义为单次评审）。

Step 5: Triage findings by depth mode

步骤5：根据深度模式分类评审发现

Quick: Skip debate. All findings go straight to the report.
Deep: Debate all critical and warning. Pass through info.
Auto: Apply the heuristics above. Log your reasoning.

快速模式：跳过辩论，所有发现直接进入报告。
深度模式：对所有严重和警告级发现进行辩论，信息级发现直接通过。
自动模式：应用上述启发式规则，记录您的推理过程。

Step 6: Adversarial debate loop

步骤6：对抗性辩论循环

Read

references/debate-protocol.md

for the full debate mechanics, convergence rules, and reversed-role debate protocol.

For each debate candidate:

Read the actual source file at the referenced line (20-30 lines of context)
Verify the line number is correct by matching the EVIDENCE quote against the source. If the line number is wrong, find the correct line and use that instead.
Follow the debate protocol: challenge with specific code evidence, let Codex respond, iterate until convergence or 5 rounds.

Codex's turn: Call

codex exec

with your challenge. Describe the file and line range Codex should examine — don't paste code into the prompt. Codex can read the source files itself. Ask Codex to respond with DEFEND, RETRACT, or REVISE.

When Codex returned NO_ISSUES_FOUND, run the reversed-role debate: independently scan the changes for issues Codex missed. Generate 2-3 findings of your own and present them to Codex for defense.

Independent debate rounds for different findings can run in parallel when the current runtime supports parallel tasks or subprocesses.

阅读

references/debate-protocol.md

获取完整的辩论机制、收敛规则和角色反转辩论协议。

对于每个需要辩论的候选发现：

读取引用行对应的实际源文件（包含20-30行上下文）
通过将EVIDENCE引用与源文件匹配，验证行号是否正确。如果行号错误，找到正确的行并使用该行。
遵循辩论协议：用具体代码证据提出质疑，让Codex回应，迭代直到达成共识或完成5轮辩论。

Codex的回合：调用

codex exec

并传入您的质疑。描述Codex需要检查的文件和行范围——切勿将代码粘贴到提示中。Codex可自行读取源文件。要求Codex回复DEFEND、RETRACT或REVISE。

当Codex返回NO_ISSUES_FOUND时，运行角色反转辩论：独立扫描变更，查找Codex遗漏的问题。生成2-3个您自己发现的问题，并提交给Codex进行辩护。

如果当前运行环境支持并行任务或子进程，不同发现的独立辩论回合可并行进行。

Step 7: Report findings

步骤7：报告评审结果

Output a structured report. Do not include dismissed findings.

undefined

输出结构化报告。请勿包含已驳回的发现。

undefined

Code Review Results

代码评审结果

Mode: <quick | deep | auto (with reasoning)> Reviewed: <what was reviewed> Debated: <N findings challenged> | Passed through: <M findings> Findings: <X confirmed, Y unresolved, Z dismissed>

模式：<quick | deep | auto（附推理过程）> 评审对象：<评审的内容> 已辩论：<N个被质疑的发现> | 直接通过：<M个发现> 发现情况：<X个已确认，Y个未解决，Z个已驳回>

Confirmed Issues

已确认问题

[SEVERITY] <title>

[严重程度] <标题>

File:

<path>:<line>

Evidence: ``` <the relevant code> ``` Problem: <description> Agreed by both reviewers after N rounds

文件：

<路径>:<行号>

证据： ``` <相关代码> ``` 问题描述： <说明> 双方评审员经过N轮辩论后达成共识

Unresolved (Disagreement)

未解决（存在分歧）

[SEVERITY] <title>

[严重程度] <标题>

File:

<path>:<line>

Codex's position: <summary> Primary reviewer's position: <summary> Recommendation: <your best judgment>

文件：

<路径>:<行号>

Codex的观点： <摘要> 主评审员的观点： <摘要> 建议： <您的最佳判断>

Info

信息提示

<title>

<标题>

File:

<path>:<line>

Note: <description>


Omit empty sections. If no findings at all: "Both reviewers agree: no significant issues found."

文件：

<路径>:<行号>

说明： <描述>


省略空章节。如果完全没有发现：“双方评审员一致认为：未发现重大问题。”

Gotchas

注意事项

```
codex exec
```
outputs to stdout. No need for temp files or
```
-o
```
flag. Just call it and read the output.
Never pass diffs, file contents, or code blocks in the Codex prompt. Codex has filesystem access — tell it where to look, not what the code says.
When reviewing files in a different directory, resolve all paths to absolute before cd'ing.
Always quote user-provided values in shell commands to prevent injection.

```
codex exec
```
输出到标准输出。无需临时文件或
```
-o
```
标志。直接调用并读取输出即可。
切勿在Codex提示中传递差异、文件内容或代码块。Codex拥有文件系统访问权限——只需告诉它去哪里查找，无需告知代码内容。
当评审不同目录中的文件时，在进入目录前将所有路径解析为绝对路径。
在shell命令中始终对用户提供的值加引号，防止注入攻击。

Example invocations

调用示例

/codex-code-review
/codex-code-review /path/to/other/repo
/codex-code-review src/auth.ts src/api/handler.ts
/codex-code-review main
/codex-code-review abc1234
/codex-code-review #42
/codex-code-review quick review
/codex-code-review deep review of branch main
/codex-code-review focus on SQL injection vulnerabilities

/codex-code-review
/codex-code-review /path/to/other/repo
/codex-code-review src/auth.ts src/api/handler.ts
/codex-code-review main
/codex-code-review abc1234
/codex-code-review #42
/codex-code-review quick review
/codex-code-review deep review of branch main
/codex-code-review focus on SQL injection vulnerabilities