chore(autoreview): use the shared canonical skill

[vincentkoc]

What Problem This Solves

Repository-local autoreview copies drift and can retain retired prerequisites such as TruffleHog.

User Impact

Install autoreview once from openclaw/agent-skills using the setup linked in .agents/skills/autoreview/SKILL.md. Reviews run from this repository through that shared installation. Updating its source checkout updates all symlinked consumers; copy-mode users reinstall once. Product runtime behavior is unchanged.

Why This Change Was Made

Keep only the canonical Markdown entrypoint and remove the copied helper, fixtures, and implementation tests.

Canonical owner and preserved downstream fixes: openclaw/agent-skills#305. Shared changes belong upstream; review runs do not download or update code automatically.

Evidence

• All 17 consumer entrypoints match the canonical template; each contains no local helper or implementation tests.
• git diff --check passes; independent integration review checked callers and removed gates.
• The shared installer and helper dry runs pass from consumer repositories without TruffleHog. Canonical regression tests and review are recorded in the upstream PR.
• Product runtime suites were not run for this shared-tooling cutover.

Landing follow-up

The changelog now includes the PR link and contributor credit. Fresh and forced-upgrade symlink/copy installations passed against the canonical skill. The shared-install cutover is explicitly maintainer-requested.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed October 6, 2026, 2:49 PM ET / 18:49 UTC (Revision 3).

ClawSweeper review

What this changes

Replaces Crabbox’s copied autoreview helper and tests with a shared-installation entrypoint, adds a release note, and updates image-bake documentation.

Merge readiness

✅ Ready for maintainer review

This remains useful work absent from Crabbox main. The prior changelog finding is resolved, the canonical upstream migration is merged, and no blocking introduced defect was identified.

Priority: P2
Reviewed head: 0d649dc571b8b32d2d30af3af6515583d15bf743

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	The focused migration follows the merged canonical contract and resolves the prior actionable feedback.
Proof confidence	🌊 off-meta tidepool	Not applicable: The MEMBER author is exempt from ordinary contributor proof. The captured body reports real shared-helper and fresh/upgrade symlink/copy checks; source confirms consumer working-directory handling. No material authority or stored-data contract changes require an additional proof gate.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: The MEMBER author is exempt from ordinary contributor proof. The captured body reports real shared-helper and fresh/upgrade symlink/copy checks; source confirms consumer working-directory handling. No material authority or stored-data contract changes require an additional proof gate.
Evidence reviewed	8 items	Pinned change and current-main necessity: The introduced delta removes the local implementation and fixtures and retains a 23-line entrypoint. Main still contains the bundled helper. The verified test merge has the exact main and PR-head parents, and its result preserves the same bounded migration. Previous finding resolved: The Unreleased bullet now includes #2663 and thanks @vincentkoc, satisfying the concrete previous finding and root release-note policy. Consumer callers: Searches of current source, scripts, workflows, docs, and repository instructions found no remaining direct caller of the deleted repository-local helper or harness outside the replaced skill. The only main-side reference outside that directory and changelog was the image-bake sentence updated by this PR.
Findings	None	None.
Security	None	None.

How this fits together

Autoreview is development tooling that reads a repository’s Git changes and review requirements to produce structured review results. This change moves its implementation into an operator-installed shared skill while retaining Crabbox’s local review policy.

flowchart TD
  A[Crabbox Git changes] --> D[Shared review helper]
  B[Repository entrypoint] --> C[Operator-installed skill]
  C --> D
  E[Crabbox review requirements] --> D
  D --> F[Structured review results]

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Local tooling consolidation	14 files affected; 18 lines added, 14,344 removed	The large deletion retires copied development tooling and fixtures rather than product runtime code.

Technical review

Best possible solution:

Maintain one canonical review implementation with thin consumer entrypoints, explicit installation updates, and repository-specific requirements kept local.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this consolidates development tooling rather than reporting a single runtime bug. Source inspection confirms the bundled copy and its retired scanner prerequisite on main.

Is this the best way to solve the issue?

Yes. The entrypoint reuses the canonical installer and working-directory-aware helper, avoiding another implementation while preserving local requirements.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against f9a122dd96e8.

Labels

Label changes:

No label changes.

Label justifications:

• P2: This is a bounded development-tooling migration with installation and review-policy implications.
• merge-risk: 🚨 compatibility: Users switch from a bundled helper to an explicit shared installation; the documented cutover and reported fresh/upgrade verification cover this intentional change.
• merge-risk: 🚨 security-boundary: The shared helper adopts the canonical scanner-free policy, whose pre-transmission screening tradeoff is explicitly recorded upstream.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The MEMBER author is exempt from ordinary contributor proof. The captured body reports real shared-helper and fresh/upgrade symlink/copy checks; source confirms consumer working-directory handling. No material authority or stored-data contract changes require an additional proof gate.

Evidence

What I checked:

• Pinned change and current-main necessity: The introduced delta removes the local implementation and fixtures and retains a 23-line entrypoint. Main still contains the bundled helper. The verified test merge has the exact main and PR-head parents, and its result preserves the same bounded migration. (.agents/skills/autoreview/SKILL.md:8, 0d649dc571b8)
• Previous finding resolved: The Unreleased bullet now includes chore(autoreview): use the shared canonical skill #2663 and thanks @vincentkoc, satisfying the concrete previous finding and root release-note policy. (CHANGELOG.md:7, 0d649dc571b8)
• Consumer callers: Searches of current source, scripts, workflows, docs, and repository instructions found no remaining direct caller of the deleted repository-local helper or harness outside the replaced skill. The only main-side reference outside that directory and changelog was the image-bake sentence updated by this PR. (docs/features/image-bake-runbook.md:498, f9a122dd96e8)
• Authoritative dependency and merged rollout: The changed entrypoint explicitly delegates implementation to this repository. GitHub verifies fix(autoreview): share one installation across repositories agent-skills#305 merged on 2026-10-06. Its committed repository-entrypoint template matches Crabbox’s entrypoint, and its scoped policy expressly requires consumers to retain only that entrypoint. (skills/autoreview/references/repository-entrypoint.md:8, 0595f725087f)
• Installation and working-directory contract: The inspected installer supports symlink installation, copy mode, custom targets, and forced replacement. Canonical instructions explain copy upgrades and prohibit automatic review-time updates. The real helper discovers the reviewed repository from Path.cwd(), matching the consumer’s instruction to preserve its working directory. (skills/autoreview/scripts/autoreview:1995, 0595f725087f)
• Intentional scanner-free policy: The merged canonical skill explicitly documents scanner-free operation and requires a maintainer decision before reintroducing a scanner. fix(autoreview): remove restored TruffleHog dependency agent-skills#240 records the transmission tradeoff; reviewer credential findings occur after transmission and do not replace a pre-send scan. This migration adopts that established policy rather than introducing an unexplained bypass. (skills/autoreview/SKILL.md, 0595f725087f)

Likely related people:

• vincentkoc: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (2 earlier review cycles)

• reviewed 2026-10-02T07:44:20.778Z sha 648c918 :: needs changes before merge. :: [P3] Add the required PR reference and contributor credit
• reviewed 2026-10-02T08:49:54.532Z sha e14a708 :: blocked before merge. :: [P3] Add the required PR reference and contributor credit