Code Review skills

Code Review skills are reusable instructions that tell Skitflow how your organization wants pull requests reviewed. Use them for policies such as API compatibility checks, migration safety rules, framework conventions, or extra scrutiny for security-sensitive paths.

Skills belong to the organization and are managed from the Review Skills panel on the Code Review repositories settings page. Users need Code Review settings-management permission to create, edit, import, enable, or delete them.

Create a skill

Each skill has:

• Name — a unique name within the organization.
• Description — a short explanation of the policy. It is stored separately so future selection modes can use it, but the current selector does not rank by description.
• Markdown body — the instructions applied to the review.
• Path globs — optional case-sensitive patterns such as src/api/** or **/*.sql. With no globs, the skill is eligible for every review. With globs, at least one changed path must match.
• Priority — a number used to order eligible skills. Higher priorities are considered first; equal priorities are ordered by name.

In the Review Skills panel, choose Add skill, complete the fields, and save it. A skill created in the form is enabled by default. Use the switch beside it to make it inactive without deleting it.

Import and export SKILL.md

Skitflow can import and export the agent-skills SKILL.md convention. A file contains YAML frontmatter followed by a Markdown body:

---
name: safe-database-migrations
description: Check database migrations for safe rollout and rollback behavior.
pathGlobs:
  - "**/migrations/**"
  - "**/*.sql"
---

Require backward-compatible schema changes. Flag destructive operations that do
not include an explicit rollout and rollback plan.

The frontmatter accepts only name, description, and optional pathGlobs. name and description are required. Priority is library metadata: set it in the Skitflow form after import rather than in the file.

To import, paste the complete file into Import SKILL.md and choose Import disabled skill. Imported skills always arrive disabled. Review their contents and path filters, set a priority if needed, and explicitly enable them before they can affect a review. Use Export on an existing skill to download a SKILL.md file.

Skitflow can also bulk-import skills straight from a connected repository: it scans the repository's skills/ directory for one SKILL.md per subdirectory (for example skills/safe-database-migrations/SKILL.md) and creates a disabled skill for each valid file, skipping anything malformed. This bulk import requires organization owner or admin access — a stricter requirement than the settings-management permission used for the other skill actions on this page.

Enable skills and set the budget

Code Review has two inheritable settings:

• Review skills (skillsEnabled) controls whether eligible skills are loaded. It is off by default.
• Maximum skill tokens (maxSkillsTokens) limits the complete rendered skills block, including its safety text and wrappers. The default is 4,000 tokens and the allowed range is 0–16,000.

Settings inherit field by field. An unset value—shown as Inherit from broader scope in the dashboard—uses the next broader setting; changing one field does not materialize an override for the other. The token budget can be set only at organization or repository scope. Repository overrides can be cleared to resume organization inheritance.

How skills are selected

For each review, Skitflow:

1. Considers only enabled skills whose path globs match at least one changed file, or which have no path globs.
2. Orders them by priority from highest to lowest, then by name from A to Z.
3. Adds complete skills while the rendered block fits the effective token budget.

A skill that does not fit is skipped as a whole; Skitflow never truncates a policy. Selection continues after a skipped skill, so a smaller later skill can still fit. The Code Review policy trace records which skills reached the model.

If enabled skills cannot be loaded, the review fails visibly with a retryable context error instead of silently continuing without organization policy.

Trust and safety

Review skills are trusted organization policy. Their bodies are placed in the trusted review system prompt, not in pull-request content or repository context. Only organization administrators or members with Code Review settings-management permission should author or approve them.

Skills provide review guidance only. They cannot request tools, files, environment variables, network access, or side effects, and they cannot change the review's structured output contract. Skitflow stores skills in its database; repositories and pull requests cannot redirect skill loading to filesystem or external paths.

Because imported text may come from a repository or another untrusted source, it remains inert until an authorized user reviews and enables it.