Fetches code-review from alinaqi/claude-bootstrap and configures it for Cursor.
3
Select Cursor when prompted
The CLI shows a list of agents. Use arrow keys and space to select Cursor:
◆ Which agents do you want to install to?
│
│ ── Universal (.agents/skills) ────────────────
│ · Cline · Codex · Goose · Windsurf
│ ●Cursor(selected)
│ · Cursor · Aider · Continue
4
Verify installation
Confirm successful installation by checking the skill directory location:
.cursor/skills/code-review
Restart Cursor to activate code-review. Access via /code-review in your agent's command palette.
⚠
Security Notice
We perform automated surface-level scans (Gen AI Scanner, Socket, Snyk) during installation. These checks detect common vulnerabilities but do not guarantee complete security. Always review skill source code and verify the publisher's reputation before production use.
Skills execute code in your environment. Always review source, verify the publisher, and test in isolation before production.
Load with: base.md + [codex-review.md for OpenAI Codex] + [gemini-review.md for Google Gemini]
Purpose: Enforce automated code reviews as a mandatory guardrail before every commit and deployment. Choose between Claude, OpenAI Codex, Google Gemini, or multiple engines for comprehensive analysis.
Review Engine Choice
When running /code-review, users can choose their preferred review engine:
┌─────────────────────────────────────────────────────────────────┐
│ CODE REVIEW - Choose Your Engine │
├─────────────────────────────────────────────────────────────────┤
│ │
│ ○ Claude (default) │
│ Built-in, no extra setup, full conversation context │
│ │
│ ○ OpenAI Codex CLI │
│ GPT-5.2-Codex specialized for code review, 88% detection │
│ Requires: npm install -g @openai/codex │
│ │
│ ○ Google Gemini CLI │
│ Gemini 2.5 Pro with 1M token context, free tier available │
│ Requires: npm install -g @google/gemini-cli │
│ │
│ ○ Dual Engine (any two) │
│ Run two engines, compare findings, catch more issues │
│ │
│ ○ All Three (maximum coverage) │
│ Run Claude + Codex + Gemini for critical/security code │
│ │
└─────────────────────────────────────────────────────────────────┘
Engine Comparison
Aspect
Claude
Codex
Gemini
Multi-Engine
Setup
None
npm + OpenAI API
npm + Google Account
All setups
Speed
Fast
Fast
Fast
2-3x time
Context
Conversation
Fresh per review
1M tokens
N/A
Detection
Good
88% (best)
63.8% SWE-Bench
Combined
Free Tier
N/A
Limited
1,000/day
Varies
Best for
Quick reviews
High accuracy
Large codebases
Critical code
Set Default Engine
# ~/.claude/settings.toml or project CLAUDE.md[code-review]default_engine="claude"# Options: claude, codex, gemini, dual, all
Usage Examples
# Use default engine/code-review
# Explicitly choose engine/code-review --engine claude
/code-review --engine codex
/code-review --engine gemini
# Dual engine (pick any two)/code-review --engine claude,codex
/code-review --engine claude,gemini
/code-review --engine codex,gemini
# All three engines/code-review --engine all
# Quick shortcuts/code-review # Uses default/code-review --codex# Use Codex/code-review --gemini# Use Gemini/code-review --all# All three engines
Multi-Engine Output
When using multiple engines, findings are compared and deduplicated:
┌─────────────────────────────────────────────────────────────────┐
│ CODE REVIEW RESULTS - TRIPLE ENGINE │
├─────────────────────────────────────────────────────────────────┤
│ │
│ ✅ UNANIMOUS (All 3 found): │
│ 🔴 SQL injection in auth.ts:45 │
│ │
│ ✅ MAJORITY (2 of 3 found): │
│ 🟠 Memory leak - unclosed stream in upload.ts:34 (Codex+Gemini)│
│ 🟡 Missing error handling in api.ts:112 (Claude+Codex) │
│ │
│ 🔷 CLAUDE ONLY: │
│ 🟠 Potential race condition in worker.ts:89 │
│ │
│ 🔶 CODEX ONLY: │
│ 🟡 N+1 query pattern in orders.ts:156 │
│ │
│ 🟢 GEMINI ONLY: │
│ 🟡 Consider using batch API for better performance │
│ 🟢 Type could be more specific in types.ts:23 │
│ │
├─────────────────────────────────────────────────────────────────┤
│ SUMMARY │
│ Unanimous: 1 | Majority: 2 | Single: 5 │
│ Critical: 1 | High: 2 | Medium: 3 | Low: 2 │
│ Status: ❌ BLOCKED - Fix critical/high issues │
└─────────────────────────────────────────────────────────────────┘
When to Use Each Mode
Mode
Use When
Single (Claude)
Quick in-flow reviews, exploration
Single (Codex)
CI/CD automation, high accuracy needed
Single (Gemini)
Large codebases (100+ files), free tier
Dual
Important PRs, pre-merge reviews
Triple (All)
Security-critical code, payment systems, auth
Core Philosophy
┌─────────────────────────────────────────────────────────────────┐
│ CODE REVIEW IS NON-NEGOTIABLE │
│ ───────────────────────────────────────────────────────────── │
│ │
│ Every commit must pass code review. │
│ Every PR must be reviewed before merge. │
│ Every deployment must include review sign-off. │
│ │
│ AI catches what humans miss. Humans catch what AI misses. │
│ Together: fewer bugs, cleaner code, better security. │
├─────────────────────────────────────────────────────────────────┤
│ INVOKE: /code-review │
│ PLUGIN: code-review@claude-plugins-official │
└─────────────────────────────────────────────────────────────────┘
When to Run Code Review
Mandatory Review Points
Trigger
Action
Command
Before commit
Review staged changes
/code-review
Before PR
Review all changes vs base
/code-review
Before merge
Final review of PR
/code-review
Before deploy
Review deployment diff
/code-review
Automatic Integration
Run code review automatically before every commit:
#!/bin/bash# .git/hooks/pre-commitecho"🔍 Running code review..."# Run Claude code review on staged filesSTAGED_FILES=$(gitdiff--cached --name-only --diff-filter=ACM |grep-E'\.(ts|tsx|js|jsx|py|go|rs)$')if[-n"$STAGED_FILES"];then# Invoke code review (requires claude CLI) claude --print"/code-review $STAGED_FILES"> /tmp/code-review-result.txt 2>&1# Check for critical/high issuesifgrep-q"🔴\|Critical\|🟠\|High" /tmp/code-review-result.txt;thenecho"❌ Code review found critical/high issues:"cat /tmp/code-review-result.txt
echo""echo"Fix these issues before committing."exit1fiecho"✅ Code review passed"fiexit0
Make Hook Executable
chmod +x .git/hooks/pre-commit
Codex CLI Setup (For Codex/Both Modes)
If you want to use Codex or Both modes, install the Codex CLI:
# Prerequisites: Node.js 22+node--version# Must be 22+# Install Codex CLInpminstall-g @openai/codex
# Authenticate (choose one):# Option 1: ChatGPT subscription (Plus, Pro, Team, Enterprise)codex # Follow prompts to sign in# Option 2: API keyexportOPENAI_API_KEY=sk-proj-...
Verify Installation
✓
Make data-driven prioritization decisions faster
Stakeholder Communication
Draft PRDs, status updates, and stakeholder presentations
›Access to product documentation and roadmap tools (Jira, Notion, etc.)
›Understanding of product management frameworks (RICE, Jobs-to-be-Done, etc.)
›Stakeholder contact information and communication channels
Time Estimate
30-60 minutes to see productivity improvements
Steps
1Install product management skill
2Start with user story generation for known feature
3Progress to competitive analysis: research 2-3 competitors
4Use for roadmap prioritization: apply RICE/ICE scoring
5Draft stakeholder communications and refine based on feedback
6Build template library for recurring PM tasks
7Share effective prompts with product team
Common Pitfalls
⚠Not validating competitive research—verify facts before sharing
⚠Accepting user stories without involving engineering team
⚠Over-relying on frameworks without qualitative judgment
⚠Not customizing outputs to company culture and communication style
⚠Skipping stakeholder validation of generated requirements
Best Practices
✓ Do
+Validate research and competitive analysis with real data
+Collaborate with engineering when generating technical requirements
+Customize frameworks and templates to your company context
+Use skill for first drafts, refine with stakeholder input
+Document successful prompt patterns for PM tasks
+Combine AI efficiency with human judgment and intuition
✗ Don't
−Don't publish competitive analysis without fact-checking
−Don't finalize user stories without engineering review
−Don't make prioritization decisions solely on AI scoring
−Don't skip customer validation of generated requirements
−Don't ignore company-specific context and culture
💡 Pro Tips
★Provide context: company goals, constraints, customer feedback
★Ask for alternatives: 'Show 3 ways to prioritize this roadmap'
★Request stakeholder-specific formatting: 'Executive summary vs. engineering spec'
★Use skill for 70% generation + 30% customization to company needs
When to Use This
✓ Use when
Use for user story writing, competitive research, roadmap prioritization, stakeholder communication, and PRD drafting. Best for reducing repetitive documentation and research work.
✗ Avoid when
Avoid for strategic product vision (requires deep customer empathy), pricing decisions (needs market and financial expertise), or when face-to-face customer discovery is more valuable than speed.
Learning Path
1Basic: user stories, feature specs, status updates
