Code Review Skill

Review a merge/pull request's changed code for security vulnerabilities, code quality / architecture issues, and repository-purpose / scope alignment, synthesize the findings into a single severity-tagged markdown report, and post that report as pinpointed file/line comments (plus a summary note) on the merge request. This skill is review-only: it never edits source files or applies fixes. It detects the target project's language/framework family (Java Maven/Spring Boot or Node/React/Next.js) first and loads only the matching review patterns.

This skill is designed to run standalone, not only as a chained step after an upstream "Fetch PR Details" agent. When pr-code-context.md does not already exist, this skill fetches the PR/MR details, diff, and commit history itself using the gitlab-mcp MCP tool and generates pr-code-context.md before reviewing.

No Human-in-the-Loop: This skill runs as an autonomous step, whether invoked standalone or inside an agentic PR-review pipeline. It never pauses for approval of a finding, a severity label, or whether to post a comment. Scope resolution, severity classification, and posting are driven by the deterministic rules in this document.

Read-only on source code: This skill only reads the diff/changed files. It never writes to, renames, or edits the files under review. Its only write outputs are pr-code-context.md (when it must be generated), the review markdown file (pr-code-review-doc.md), and the posted MR/PR comment(s).

STEP -2: Load Implementation Context (Optional — Run First)

Before resolving the diff, check the workspace root for a jira-context.md file (or an equivalently named implementation/requirements context file handed off from an upstream step, e.g. a JIRA-fetch agent or the code-context-retrieval skill).