fix: allow agents to invoke review-code

[andreatnvidia]

📋 Summary

Allow agents to invoke review-code during development and CI, supporting the required pre-PR self-review and the existing automated PR review recipe.

The skill currently sets disable-model-invocation: true, so Claude Code blocks invocation and instructs agents not to reproduce the review manually, as seen in #1053. Removing the flag lets agents follow those established workflows using the shared skill.

🔗 Related Issue

N/A. Failure observed in the automated review of #1053.

🔄 Changes

• Remove disable-model-invocation: true from .agents/skills/review-code/SKILL.md, allowing model invocation in local sessions and CI.
• Keep the review instructions, workflow authorization, and controls over posting comments unchanged.

🧪 Testing

• Pre-commit checks on the changed skill and git diff --check.
• Parsed the skill's YAML frontmatter and verified the review instructions are unchanged.
• make test: not run; this changes skill metadata only.
• Unit and E2E tests: N/A; no application logic changed.

✅ Checklist

• Follows commit message conventions.
• Commits are signed off (DCO).
• External contributor issue requirement: N/A; repository collaborator.
• Architecture docs: N/A; no architectural changes.

[github-actions]

Thanks for tracking this down and fixing it, @andreatnvidia!

Summary

This PR removes disable-model-invocation: true from the review-code skill's frontmatter, so agents can invoke /review-code themselves. That covers the pre-PR self-review CONTRIBUTING.md asks for (line 66) and the automated agentic-ci-pr-review recipe, which failed on #1053 because the skill was blocked. The diff does exactly what the description says: one frontmatter line, and the review instructions are unchanged.

Findings

Suggestions — Take it or leave it

.agents/skills/review-code/SKILL.md:3 — The skill can now auto-trigger, so a sharper description would help

• What: With model invocation enabled, Claude decides when to load this skill on its own, partly from the description field. The current text ("Perform a thorough code review of the current branch or a GitHub PR by number.") is broad. A casual "can you review this function?" could pull in the full multi-pass workflow (multiple gh calls, a worktree checkout, ruff runs).
• Why: This is a big, expensive workflow, and it could start when the user only wanted a quick look. It's harmless but can be surprising.
• Suggestion: We could narrow the description to say when the skill should be used. For example: "Perform a thorough multi-pass code review of the current branch or a GitHub PR by number. Use for pre-PR self-review or when explicitly asked to run review-code." Totally optional.

What Looks Good

• Small, targeted change. Only review-code loses the flag. commit, create-pr and update-pr change git or GitHub state and keep disable-model-invocation: true. That's the right line between a read-only skill and skills with side effects.
• Posting stays gated. Step 7 still requires explicit user confirmation before gh pr comment, and the CI recipe separately forbids the agent from posting. Enabling model invocation doesn't create a new path for an agent to publish to a PR.
• Clear PR description. It explains the root cause well, links the failed fix: require mcp 1.30.0 for CVE-2026-59951 #1053 run, and points to the CONTRIBUTING requirement this unblocks.

Residual Risk

• .claude/skills/review-code/SKILL.md appears to resolve to the same .agents/skills/ content (the runner's copy already lacks the flag). If any other agent harness keeps its own copy of the skills instead of a symlink, that copy would need the same edit. I didn't find one in the repo.
• No tests apply, since this is metadata only. The real check is the next automated PR review run invoking the skill successfully.

Verdict

Ship it (with nits). The only finding is an optional suggestion to tighten the skill description.

---

This review was generated by an AI assistant.

[greptile-apps]

Confidence Score: 5/5

[Low impact] This PR appears safe to merge.

Summary

Removes disable-model-invocation: true so agents can invoke review-code during development and CI.

• Agents can invoke the shared review-code skill during development and CI.

_{Reviews (1) · Last reviewed commit: "fix: allow agents to invoke review-code" · Reviewed by Greptile}