chore(autoreview): use the shared canonical skill

[vincentkoc]

What Problem This Solves

Repository-local autoreview copies drift and can retain retired prerequisites such as TruffleHog.

User Impact

Install autoreview once from openclaw/agent-skills using the setup linked in .agents/skills/autoreview/SKILL.md. Reviews run from this repository through that shared installation. Updating its source checkout updates all symlinked consumers; copy-mode users reinstall once. Product runtime behavior is unchanged.

Why This Change Was Made

Keep only the canonical Markdown entrypoint and remove the copied helper, fixtures, and implementation tests.

Canonical owner and preserved downstream fixes: openclaw/agent-skills#305. Shared changes belong upstream; review runs do not download or update code automatically.

Evidence

• All 17 consumer entrypoints match the canonical template; each contains no local helper or implementation tests.
• git diff --check passes; independent integration review checked callers and removed gates.
• The shared installer and helper dry runs pass from consumer repositories without TruffleHog. Canonical regression tests and review are recorded in the upstream PR.
• Product runtime suites were not run for this shared-tooling cutover.

Landing follow-up

Repository instructions explicitly retain the original P0–P3 review gate with --max-priority P3; direct invocation examples use that override. The shared entrypoint remains identical to the canonical template.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review in progress

ClawSweeper is reviewing this revision. This supersedes any previous blocked status.

View the workflow run.

[clawsweeper]

Codex review: needs changes before merge. Reviewed October 6, 2026, 4:38 AM ET / 08:38 UTC (Revision 11).

ClawSweeper review

What this changes

Replace ClawScan’s copied review helper and tests with a shared skill entrypoint, and update contributor instructions and the changelog.

Merge readiness

⛔ Needs changes before merge - 1 item remains

The shared-install cutover remains useful: current main and the latest release still vendor the helper. No actionable patch defect was found, and this MEMBER-authored PR must remain open for its owner to land.

Priority: P3
Reviewed head: 71e8bc13e76c3015479c1dbb768b39812487765b

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused tooling consolidation with consistent caller updates and an existing shared installation path.
Proof confidence	🌊 off-meta tidepool	Not applicable: The MEMBER-authored PR is exempt from contributor runtime proof; its body reports shared-install dry runs from consumer repositories, and inspected source supports the changed installation and working-directory boundary. No stored-data contract changes.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: The MEMBER-authored PR is exempt from contributor runtime proof; its body reports shared-install dry runs from consumer repositories, and inspected source supports the changed installation and working-directory boundary. No stored-data contract changes.
Evidence reviewed	8 items	Pinned introduced change: The pinned base-to-head delta removes the vendored implementation, harnesses, and implementation tests; replaces the skill with installation guidance; and updates both remaining contributor commands. No product runtime or workflow file changes are introduced. Applicable policy and caller audit: The full root policy and removed skill-scoped policy were read. The latter already identifies agent-skills as the canonical owner and forbids local variants. Searching the current tree found no remaining caller of the removed repository-local helper. Affirmative dependency boundary: The changed entrypoint explicitly installs and executes this repository’s shared skill. At the inspected default-branch revision, the installer already defaults to ~/.agents/skills and supports symlink and copy installations; the helper determines the reviewed repository from the caller’s working directory.
Findings	None	None.
Security	None	None.

How this fits together

Autoreview is a contributor tool that reviews repository changes before handoff. This change directs contributors to an installed shared helper while keeping ClawScan’s review requirements local.

flowchart TD
  A[Repository changes] --> B[Local review instructions]
  B --> C[Shared skill installed]
  C -->|Missing| D[Documented installation]
  D --> E[Shared review helper]
  C -->|Available| E
  E --> F[Structured review results]

Loading

Before merge

• Complete next step (P2) - Mark this draft PR ready for review before landing.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Vendored tooling removal	production −9,258 lines; tests −5,386 lines	The large deletion removes copied review tooling and its tests, with the shared repository retaining implementation ownership.

Technical review

Best possible solution:

Keep one upstream review implementation with explicit installation guidance and repository-specific requirements preserved in ClawScan.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is a tooling consolidation, and source inspection confirms the copied helper remains on current main.

Is this the best way to solve the issue?

Yes: the shared installer and helper already support installation outside the consumer repository while reviewing its working directory, avoiding another local implementation.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 490bd167ea43.

Labels

Label changes:

No label changes.

Label justifications:

• P3: This is contributor-tooling cleanup with no introduced ClawScan runtime change.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The MEMBER-authored PR is exempt from contributor runtime proof; its body reports shared-install dry runs from consumer repositories, and inspected source supports the changed installation and working-directory boundary. No stored-data contract changes.

Evidence

What I checked:

• Pinned introduced change: The pinned base-to-head delta removes the vendored implementation, harnesses, and implementation tests; replaces the skill with installation guidance; and updates both remaining contributor commands. No product runtime or workflow file changes are introduced. (.agents/skills/autoreview/SKILL.md:8, 71e8bc13e76c)
• Applicable policy and caller audit: The full root policy and removed skill-scoped policy were read. The latter already identifies agent-skills as the canonical owner and forbids local variants. Searching the current tree found no remaining caller of the removed repository-local helper. (AGENTS.md:110, 71e8bc13e76c)
• Affirmative dependency boundary: The changed entrypoint explicitly installs and executes this repository’s shared skill. At the inspected default-branch revision, the installer already defaults to ~/.agents/skills and supports symlink and copy installations; the helper determines the reviewed repository from the caller’s working directory. (scripts/install-skills:18, 3d3034af58d4)
• Upstream rollout is open but installation already exists: fix(autoreview): share one installation across repositories agent-skills#305 remains open. Its patch adds the matching consumer template and shared-install documentation, while the existing default-branch installer and working-directory-based helper already support this consumer’s setup. (334cc560ec49)
• Intentional upstream security policy: The complete canonical skill explicitly places approved secret scanning outside autoreview and states that reviewer credential findings occur after transmission. It links the merged policy change fix(autoreview): remove restored TruffleHog dependency agent-skills#240. This consumer cutover follows that recorded policy rather than introducing a local security variant. (skills/autoreview/SKILL.md, 3d3034af58d4)
• Still absent from main and release: Pinned main retains the repository-local helper and contributor command. The latest release, v0.2.0, also instructs contributors to run that local helper, so this cutover is neither implemented nor superseded there. (AGENTS.md:110, ef02eb65260b)

Likely related people:

• vincentkoc: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (10 earlier review cycles; latest 8 shown)

• reviewed 2026-10-02T19:01:46.902Z sha 71e8bc1 :: needs maintainer review before merge. :: none
• reviewed 2026-10-02T20:46:59.608Z sha 71e8bc1 :: needs maintainer review before merge. :: none
• reviewed 2026-10-02T22:45:30.752Z sha 71e8bc1 :: needs maintainer review before merge. :: none
• reviewed 2026-10-03T10:26:36.144Z sha 71e8bc1 :: needs maintainer review before merge. :: none
• reviewed 2026-10-03T23:49:43.113Z sha 71e8bc1 :: needs maintainer review before merge. :: none
• reviewed 2026-10-04T10:50:40.037Z sha 71e8bc1 :: needs maintainer review before merge. :: none
• reviewed 2026-10-04T23:44:53.373Z sha 71e8bc1 :: needs maintainer review before merge. :: none
• reviewed 2026-10-05T08:50:11.157Z sha 71e8bc1 :: needs maintainer review before merge. :: none