Dual PR Review

VerifiedCaution

Run pr-review twice in parallel (Claude + Codex), then merge findings into unique-to-each and agreed-by-both buckets.

Sby Skills Guide Bot
DevelopmentAdvanced
7/23/2026
Claude Code
#code-review#pull-requests#multi-agent#codex-cli#parallel-execution

Recommended for

Automated summary

Runs the pr-review skill twice in parallel — once in the current Claude session and once through OpenAI's Codex CLI — then merges the findings into Claude-only, Codex-only and agreed-by-both buckets, followed by both raw reports.

Strengths

  • Actually runs the two reviews concurrently (Codex in the background) instead of sequentially, so you don't wait twice.
  • Preserves each finding's original wording and severity tag verbatim, making it easy to see what only one agent caught.
  • Always prints all three buckets (using `_None._` when empty) and keeps the raw reports as an audit trail for the merge.
  • Handles the practical pitfalls of `codex exec`: prompt piped via stdin, `--full-auto` for non-interactive use, `--sandbox read-only` to avoid touching the working tree.

Limitations

  • Assumes the `codex` CLI is installed and authenticated; the preflight aborts otherwise, with no fallback to a single review.
  • Hard-codes the path `.claude/skills/pr-review/SKILL.md` and depends on that skill's output format.
  • Matching findings across the two reports relies on human judgement about file/line proximity and root cause, so partial duplicates can slip through.
When to use it

Use it when you want an independent second opinion on a pull request before merging.

When not to use it

Avoid it when the Codex CLI isn't installed or authenticated, or when a single review is enough and a full second pass isn't worth the cost.

Security analysis

Caution
Quality score84/100

No destructive, obfuscated, or exfiltrating-by-design commands: it pipes a prompt into a read-only sandboxed agent and merges outputs. But it does invoke an external network-connected CLI with auto-approval flags, inherits shell credentials, and stages PR content in world-readable /tmp files, so a caution rating with data-egress caveats is appropriate rather than 'safe'.

Findings
  • •Sends the repository's PR review context (prompt file derived from the local skill plus PR number, and whatever Codex reads from the repo) to OpenAI's Codex CLI — third-party data egress, so private code leaves the machine.
  • •Launches `codex exec --full-auto`, which suppresses interactive approval prompts; blast radius is limited only by the accompanying `--sandbox read-only`, so correctness of that flag matters a lot.
  • •The caveat itself notes Codex 'inherits cwd and shell env', meaning any ambient credentials (GH_TOKEN, cloud keys) are visible to a third-party agent process.
  • •Writes the combined prompt and Codex output to predictable /tmp paths (`/tmp/dual-review-prompt-<N>.md`, `/tmp/dual-review-codex-<N>.md`) that may contain sensitive source/PR content and are readable by other local users on many systems.
  • •Installs/relies on a globally-installed third-party npm package (`@openai/codex`) not declared in allowed-tools.
How this analysis is made

Examples

Basic dual review
dual-review PR #142
Second opinion before merge
Run a dual review of PR 87 — I want a second opinion from Codex before I merge this.
Focus on divergent findings
dual-review #301 and tell me which findings only Codex caught that Claude missed.

name: dual-review description: Run pr-review twice in parallel — once in this Claude session, once via OpenAI's Codex CLI — then merge the findings into unique-to-each / agreed-by-both buckets followed by both raw reports. Use when the user says "dual-review PR #N" or wants a second-opinion review. effort: max

You are running the pr-review skill twice — locally as Claude, and remotely via the codex CLI — and merging the results. Be terse. The user wants the union of findings, not two separate reports.

ARGUMENTS: <PR number> (with or without leading #).

Steps

  1. Preflight. Run command -v codex via Bash. If it errors, stop and tell the user to install the OpenAI Codex CLI (npm i -g @openai/codex or equivalent) and authenticate.

  2. Resolve PR number. Strip a leading # if present. Call it <N>.

  3. Build the Codex prompt. Read .claude/skills/pr-review/SKILL.md and append a final line ARGUMENTS: #<N>. Write the combined text to /tmp/dual-review-prompt-<N>.md.

  4. Launch Codex in the background. Use Bash with run_in_background: true. Pipe the prompt via stdin — the pr-review skill starts with --- (YAML frontmatter), which codex's arg parser treats as a flag separator and rejects with exit 2 if passed positionally:

    cat /tmp/dual-review-prompt-<N>.md | \
      codex exec --skip-git-repo-check --sandbox read-only --full-auto - \
      > /tmp/dual-review-codex-<N>.md 2>&1
    

    --full-auto is required for non-interactive background use (otherwise codex blocks on approval prompts). --sandbox read-only keeps codex from touching the working tree. You'll be notified when it finishes. Do not poll.

  5. In parallel, run pr-review yourself by following .claude/skills/pr-review/SKILL.md for PR <N>. Produce the full report (template and all). Hold it in memory; do not print it yet.

  6. When the background task completes, read /tmp/dual-review-codex-<N>.md. If it's empty or errored, skip to step 8 and note the dual leg failed — don't suppress your own findings to fit the template.

  7. Merge. Walk both reports finding-by-finding. Two findings match if they cite the same file.go:line (±a few lines) or describe the same root cause in different words. Preserve each finding's original severity tag ([blocker]/[nit]/[question]) and original wording — do not paraphrase. For agreed-by-both findings, prefer the more specific phrasing of the two and cite both severities if they disagree (e.g. [blocker — Claude] / [nit — Codex]).

  8. Print the merged report in this exact order:

    ## PR #<N> — Dual review
    
    ### Findings unique to Claude
    - **[blocker]** `file.go:42` — …
    
    ### Findings unique to Codex
    - **[blocker]** `file.go:99` — …
    
    ### Findings agreed by both
    - **[blocker]** `file.go:123` — …
    
    ### Description vs. diff
    <one line: union of both reports' findings>
    
    ### Recommendation
    <one short paragraph merging both recommendations>
    
    ---
    
    ### Raw — Claude
    
    <verbatim Claude pr-review output>
    
    ### Raw — Codex
    
    <verbatim Codex pr-review output>
    

    If a bucket is empty, write _None._ rather than omitting the header — the user wants to see at a glance whether each agent found something the other missed.

Don'ts

  • Don't drop a finding because the other side missed it. Bucketing exists precisely to surface those.
  • Don't paraphrase severity tags or finding text in the buckets — copy them verbatim. Only the trailing Description vs. diff and Recommendation are synthesized.
  • Don't post the review (no gh pr review, no comments). Just print.
  • Don't strip the raw reports — they're the audit trail for the merge.
  • Don't run codex exec in the foreground; it blocks long enough that running pr-review yourself in parallel is the whole point.

Caveats

  • Codex inherits cwd and shell env, so gh and git auth carry over. If gh auth status fails for Claude, it'll fail for Codex too.
  • Codex output is whatever its model decides to produce; it may not follow the pr-review template exactly. Bucket what's there; don't try to rewrite it.
  • If the two reports disagree on a fact (e.g. one claims a line panics, the other claims it's safe), put it in unique to <agent> rather than agreed-by-both. Don't arbitrate — that's the user's job.

From the file to a first result

The download contains exactly the content displayed on this page. This copy may differ from the latest version in the source repository.

View the source and supporting files

This download contains SKILL.md only. Any scripts, references, templates and dependencies are not included. Get the required files from the source, preserving their directory structure, before continuing.

1. Download the file

Download SKILL.md

From the root of a test project, save the file as .skill-downloads/dual-pr-review-mrx3xzsg/SKILL.md, or use the command below. This folder is for inspecting the skill before installation.

Command for macOS/Linux or WSL: requires a POSIX shell and curl. On Windows without WSL, use the download button and create the folder manually.

mkdir -p '.skill-downloads/dual-pr-review-mrx3xzsg' && curl --fail --show-error --location 'https://skills-guides.com/api/skills/dual-pr-review-mrx3xzsg/download' --output '.skill-downloads/dual-pr-review-mrx3xzsg/SKILL.md.part' && mv '.skill-downloads/dual-pr-review-mrx3xzsg/SKILL.md.part' '.skill-downloads/dual-pr-review-mrx3xzsg/SKILL.md'

2. Check prerequisites

Read SKILL.md before using it. If it references scripts or external services, inspect them and prepare the required access in your test environment.

No recognized prerequisites section in this file. This does not mean it is self-contained: libraries, tools and access requirements may be mentioned elsewhere in the content or source repository.

The platforms on this page are catalog indications. The paths below follow tool documentation; they do not prove this skill has been run in those tools. No minimum tool version is confirmed for this listing.

3. Load the skill

After inspection, copy the complete folder into your project using one of the commands below, then open a new tool session. The command stops if a folder with the same name already exists: compare the files before replacing it.

Claude Code
test -f '.skill-downloads/dual-pr-review-mrx3xzsg/SKILL.md' && test -s '.skill-downloads/dual-pr-review-mrx3xzsg/SKILL.md' && mkdir -p '.claude/skills' && test ! -e '.claude/skills/dual-review' && cp -R '.skill-downloads/dual-pr-review-mrx3xzsg' '.claude/skills/dual-review'

OpenSkills

OpenSkills must already be installed. The local install/read procedure is checked with OpenSkills 1.5.0, which requires Node.js ≥ 20.6.0. Catalog slugs are not resolved automatically.

Official OpenSkills installation
openskills install './.skill-downloads/dual-pr-review-mrx3xzsg'

openskills read 'dual-pr-review-mrx3xzsg'

Reading should display the installed file content and its base directory. It does not run the skill or install its dependencies.

For an agent that reads AGENTS.md, then sync the index. This command changes AGENTS.md: review the diff before using it.

openskills sync

Manual method or another tool: attach SKILL.md to a conversation, or open it in an agent that can read files. Include any required supporting resources. No universal folder is recognized by every tool.

4. Try a first task

Use a short, synthetic input: an API endpoint, a small document or an interface brief. In a new conversation, attach the file or give the agent its path, then adapt this request:

Read .skill-downloads/dual-pr-review-mrx3xzsg/SKILL.md and apply its instructions to this example: [describe a test input]. Identify any missing files, dependencies or access. Produce the result requested by the skill without inventing data or running unreviewed scripts.

Expected result: output matching the skill instructions, or a precise list of missing prerequisites. A read confirmation alone does not validate a first use. If an external resource is unavailable, that path remains untested.

Related skills