csa-review

Automate CSA code reviews with machine-readable findings and reports.

12|1|Updated Feb 6, 2026
One-click install
npx skills add https://github.com/RyderFreeman4Logos/cli-sub-agent --skill csa-review
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: csa-review
Source: https://github.com/RyderFreeman4Logos/cli-sub-agent/tree/main/patterns/csa-review/skills/csa-review
Command: npx skills add https://github.com/RyderFreeman4Logos/cli-sub-agent --skill csa-review

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Automates structured, autonomous CSA code reviews by routing to an independent model stack and producing machine-readable findings and reports.

Core Features & Use Cases

  • Independent model routing for code review when orchestrating CSA agents
  • Three-pass review workflow (discovery, evidence filtering, adversarial security)
  • AGENTS.md compliance discovery across changed files and root-to-leaf scans
  • Output artifacts: review-findings.json and review-report.md, session persistence for follow-ups
  • Supports standard and red-team review modes, plus fix workflow via --fix
  • Context-aware: can align with spec.toml or TODO.md when provided
  • Tooling orchestration: SA-mode propagation and pre-PR alignment prompts

Quick Start

Invoke the skill against the current changeset to generate a structured review and artifacts.

Frequently Asked Questions about csa-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate code reviews to enforce AGENTS.md compliance?

Automated code reviews enforce AGENTS.md compliance by running a three-pass workflow across changed files and root-to-leaf scans. It produces machine-readable findings and reports to ensure reproducible governance artifacts.

What is an autonomous static analysis review and how does it work?

An autonomous static analysis review uses an independent model stack to run discovery, evidence filtering, and adversarial security passes. It routes code changes through a structured protocol to validate outputs against a strict schema.

Can I run a red-team security review on my uncommitted git diff?

Red-team security reviews can run on uncommitted diffs using a specific base range scope. The review mode applies adversarial security passes and session isolation to ensure rigorous, independent threat detection.

Does automated static analysis require external dependencies to generate reports?

Automated static analysis requires no external dependencies or changes to generate reports. It operates entirely within the existing environment to produce review-findings.json and review-report.md artifacts.

How do I generate machine-readable findings from a code review?

Generate machine-readable findings by invoking the review against your current changeset. The workflow automatically outputs review-findings.json and review-report.md files validated against the Output Schema.

What is the best way to handle fixes found during an automated code review?

Handle fixes found during automated code reviews by activating the fix workflow. This mode uses session persistence from the initial review to apply corrections and align with pre-PR prompts.