bmad-code-review
Review code changes with several independent reviewers in parallel, then triage and present the findings. Use when the user says "run code review" or "review this code"
How do I install this agent skill?
npx skills add https://github.com/bmad-code-org/bmad-method --skill bmad-code-reviewIs this agent skill safe to install?
- Gen Agent Trust Hubpass
This skill implements a multi-stage code review workflow that utilizes independent subagents to analyze code changes. It collects context from Git, tickets, and plans, performs triage on identified issues, and can apply patches to the codebase. The skill relies on local project scripts and standard developer tools like `uv` and `gh`. While it processes external data such as diffs and tickets, which creates a potential indirect prompt injection surface, this is inherent to its function and mitigated by using context-free subagents for analysis.
- Socketpass
No alerts
- Snykwarn
Risk: MEDIUM · 1 issue
- ZeroLeakspass
Score: 93/100 · 2 sections analyzed
What does this agent skill do?
Run the following command exactly once without changing the current working directory.
Replace {project-root} with the nearest folder containing _bmad/, from the working directory upward.
Replace {skill-root} with the absolute path to this skill's directory.
If the invocation asks for a quick or thorough review, append --set workflow.review=<value> to the command.
If the invocation asks for a no-code review, append --set workflow.fixes=handoff to the command.
If the invocation is clearly non-interactive -- it says not to ask questions, or a bot, a CI job or another workflow is running the review -- append --set workflow.interactive=false. When in doubt, don't.
uv run --no-cache "{project-root}/_bmad/scripts/render_skill.py" --project-root "{project-root}" --skill "{skill-root}"
- The command prints the skill's workflow: follow it.
HALT: <reason>: report the reason and stop. - If the script does not exist, BMad is not set up in this project yet. Offer to set it up using
bmadskill, then run the command again. If you do not have thebmadskill, offer to install it first. - On any other output or failure, including
uvbeing unavailable, report the command output and stop. Do not run any workflow source directly.
How can the creator link this skill?
Add the canonical catalog link to the repository README so users can inspect current installs and available audits. The publishing guide covers the complete discovery path.
<a href="https://skillzs.dev/skills/bmad-code-org/bmad-method/bmad-code-review">View bmad-code-review on skillZs</a>