@7dgroup/dsh-skill-7d-code-reviewer
向 DeepSeek Harness 提供 7DGroup 模板驱动代码审查技能的可安装组合包
插件会安装到这里；不确定时保持 web。
npx -y @deepseek-ai/dsh plugin --profile web add github:7dgroup-ai/dsh-skill-7d-code-reviewer#bd0069f4feabbcb6ede8b0ba2da6a59f4d477057
Skill 7d Code Reviewer 以 @7dgroup/dsh-skill-7d-code-reviewer 发布，当前版本为 0.1.0。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。
7DGroup code review skill plugin banner
English | 中文
Author: 7DGroup
A professional, template-driven code review skill plugin for DeepSeek Harness (DSH), developed by the 7DGroup team for AI-assisted code review in any dsh session. Built on TypeScript + Cordis, it installs as a composable bundle and registers the 7d-code-reviewer skill with ctx.skills: a five-step review flow, critical/medium/minor severity grading, four-dimension scoring, and dual text + HTML report output. Zero core changes — install to enable, remove the bundle row to uninstall.
| Field | Value |
|---|---|
| Author | 7DGroup |
| Version | 0.1.0 |
| Runtime | Node `^22.19.0 |
| Supported dsh versions | 0.2.0-rc.2+ (0.2.x) |
| Peer dependencies | @deepseek-ai/cordis · @deepseek-ai/dsh-skill · @deepseek-ai/dsh-invariants |
| Skill name | 7d-code-reviewer |
| Repository | github.com/7dgroup-ai/dsh-skill-7d-code-reviewer |
| License | MIT |
Skill invocation in a dsh session:
Invoking the 7d-code-reviewer skill for a code review
Sample HTML report generated from the pure-placeholder template:
Sample code review HTML report
Core Capabilities:
SKILL.md decides what to review and how severe it is, templates/ only presents. The HTML report template stays pure placeholders; all placeholders must be filled, and every dynamic value is HTML-escaped.references/ on demand) → severity grading → report generation.code-review-report-{timestamp}.html.Use Cases:
github: shorthand), npm or tarballprepare hook, transpile-only)dsh-skill-7d-code-reviewer/
├── src/ # source code
│ ├── index.ts # Cordis plugin: registers the skill provider
│ └── invariant.ts # companion plugin: package ownership invariant
├── assets/7d-code-reviewer/ # skill resources shipped with the package
│ ├── SKILL.md # review logic + template selection
│ ├── references/ # knowledge base, loaded on demand
│ │ ├── coding-standards.md # naming rules, code complexity
│ │ ├── security-checklist.md # SQL injection, XSS, auth, leaks
│ │ └── review-examples.md # worked review examples
│ ├── templates/
│ │ └── report-template.html # pure-placeholder HTML report
│ └── scripts/
│ └── html-report-generation.md # HTML escaping rules for filled content
├── tests/ # vitest suite
│ └── skill-7d-code-reviewer.spec.ts
├── screenshots/ # README screenshots
│ ├── skills.png # skill invocation
│ └── report-preview.png # sample HTML report
├── cordis.patch.yml # composition patch layer
├── tsdown.config.ts # build config (transpile-only)
├── 7dgroup-dsh-skill-7d-code-reviewer-0.1.0.tgz # prebuilt tarball
├── package.json
└── README.md
Prerequisites: dsh CLI, Node ^22.19.0 || >=24.0.0, pnpm 10+.
The most direct way — just ask the agent in any dsh conversation, and it runs the install for you. Use the GitHub spec — the npm name @7dgroup/dsh-skill-7d-code-reviewer only works after the package is published:
安装插件 github:7dgroup-ai/dsh-skill-7d-code-reviewer
(Or in English: "Install the plugin github:7dgroup-ai/dsh-skill-7d-code-reviewer" — the agent executes the equivalent dsh plugin command through its session shell.)
For a git install the agent will hit the same pnpm allowBuilds gate and print the exact key to add to the profile's pnpm settings file (~/.dsh/profiles/<name>/pnpm-workspace.yaml); after you add it, ask the agent to retry and the skill is enabled.
Run one command directly in dsh — the github: shorthand is the fastest way:
dsh plugin --profile <name> add github:7dgroup-ai/dsh-skill-7d-code-reviewer
<name> is the profile you boot with dsh --profile <name> — see What is a dsh profile? below for how profiles work, how to pick a name and where the profile files live.
The full URL form is equivalent:
dsh plugin --profile <name> add git+https://github.com/7dgroup-ai/dsh-skill-7d-code-reviewer.git
dsh plugin appends the bundle to the profile's dsh.profile.bundles, and the bundle's own patch layer mounts the skill-7d-code-reviewer row over the base composition.
pnpm blocks a git dependency's build scripts until explicitly allowed, so the first add fails. Copy the exact package key pnpm printed into the profile's pnpm settings file — ~/.dsh/profiles/<name>/pnpm-workspace.yaml — then re-run:
allowBuilds:
'@7dgroup/dsh-skill-7d-code-reviewer@git+https://github.com/7dgroup-ai/dsh-skill-7d-code-reviewer.git#<sha>': true
(With the github: shorthand the key reads @7dgroup/dsh-skill-7d-code-reviewer@github:7dgroup-ai/dsh-skill-7d-code-reviewer#<sha> — always copy the exact key pnpm prints.)
Allowing a build means letting that package's code run on your machine at install time, outside any agent sandbox. Prefer pinning a commit (...#<sha>) so later pushes cannot silently change what runs.
Every dsh run boots a profile — a named environment whose configuration lives under the harness home in ~/.dsh/profiles/<name> (or $DSH_HOME/profiles/<name> if the DSH_HOME env var is set). A profile directory holds:
| File | Purpose |
|---|---|
package.json | Profile manifest: dsh.profile.bundles lists the ordered plugin bundles to mount; dependencies holds out-of-tree plugins |
cordis.patch.yml | Your own patch layer, applied after every bundle layer |
pnpm-workspace.yaml | pnpm settings for the profile; the allowBuilds key goes here |
node_modules | pnpm-managed plugin dependencies |
There is no default profile — dsh --profile <name> is required on every run (dsh web is a shorthand for dsh --profile web). The shipped web and headless profiles auto-initialize on first boot; any other name is created automatically the first time you run a dsh plugin --profile <name> ... command, which reports where it was created:
dsh plugin --profile tui add github:7dgroup-ai/dsh-skill-7d-code-reviewer
# dsh: initialized profile tui at ~/.dsh/profiles/tui
To see which profiles already exist, list ~/.dsh/profiles/ — each subdirectory is one profile name. A custom name must be created this way before it can boot: dsh --profile <name> on an unknown custom name fails with the hint create it with 'dsh plugin --profile <name> add <package>'.
A prebuilt tarball is committed at the repository root — download it and install directly:
dsh plugin --profile <name> add ./7dgroup-dsh-skill-7d-code-reviewer-0.1.0.tgz
Or once published on npm:
dsh plugin --profile <name> add @7dgroup/dsh-skill-7d-code-reviewer
Both forms ship prebuilt code and need no allowBuilds allowance.
web profileMost sessions boot the default web profile (dsh web is a shorthand for dsh --profile web), so the recommended path is to install the skill there — no new profile needed:
Step 0 — pnpm on PATH. dsh plugin forwards to pnpm in the profile directory, so pnpm must be installed and on PATH:
corepack prepare pnpm@latest --activate # or: npm install -g pnpm@10
Step 1 — install via the github: shorthand. A git install runs the package's prepare build, which pnpm blocks until explicitly allowed — so the first add fails:
dsh plugin --profile web add github:7dgroup-ai/dsh-skill-7d-code-reviewer
Copy the exact key pnpm prints into ~/.dsh/profiles/web/pnpm-workspace.yaml:
allowBuilds:
'@7dgroup/dsh-skill-7d-code-reviewer@github:7dgroup-ai/dsh-skill-7d-code-reviewer#<sha>': true
then re-run the same command. Prefer pinning a commit — append #<sha> to the spec (github:7dgroup-ai/dsh-skill-7d-code-reviewer#<sha>) so later pushes cannot silently change what runs.
Prefer no build approval? Install the prebuilt tarball instead — it ships ready-to-run code and never hits the allowBuilds gate:
dsh plugin --profile web add ./7dgroup-dsh-skill-7d-code-reviewer-0.1.0.tgz
After install. The profile manifest ~/.dsh/profiles/web/package.json gains the dependency and the bundle row:
{
"name": "dsh-profile-web",
"private": true,
"dependencies": {
"@7dgroup/dsh-skill-7d-code-reviewer": "<version>"
},
"dsh": {
"profile": {
"bundles": [
"@deepseek-ai/dsh-base",
"@deepseek-ai/dsh-web-app",
"@7dgroup/dsh-skill-7d-code-reviewer"
]
}
}
}
Nothing else needs editing — cordis.patch.yml stays [], because the bundle's own patch layer mounts the skill-7d-code-reviewer row automatically. Verify the mount with dsh --profile web --dump-config, restart the session (bundle changes apply on the next boot), then run /7d-code-reviewer.
Using a different profile? Replace web with the name you boot (dsh --profile <name>); the skill only activates in the profile it is installed into.
pnpm install
pnpm build # tsdown; also runs as the `prepare` hook on git installs
pnpm test # vitest
The skill activates whenever you ask for a code review — either with the slash command or in natural language:
/7d-code-reviewer Review this module: ...
The five-step review flow:
| Step | What happens |
|---|---|
| 1. Accept the task | Take the submitted code or file paths; determine the language and business context |
| 2. Quick scan | Classify the change (new feature / bugfix / refactor); locate the core files and key logic |
| 3. Line-by-line review | Load the matching references on demand; check naming, security, performance and error handling |
| 4. Severity grading | 🔴 critical — must fix · 🟡 medium — should fix · 🟢 minor — optional improvement |
| 5. Report generation | Fill the placeholder HTML template; output the text summary plus code-review-report-{timestamp}.html |
✅ 优点
- 函数意图明确，返回用户数据
⚠️ 问题
🔴 严重：SQL 注入风险
位置：get_user() 第 2 行
描述：直接使用 f-string 拼接用户输入到 SQL 语句
建议修复：使用参数化查询，如 cursor.execute("SELECT * FROM users WHERE id=?", [uid])
📊 总体评分：3/10
代码质量: 5/10 | 安全性: 1/10 | 性能: 7/10 | 可维护性: 4/10
The full HTML report is saved to code-review-report-{timestamp}.html and the file path is reported back to you.
Severity levels:
| Level | Marker | Definition | Handling |
|---|---|---|---|
| Critical | 🔴 | security vulnerability, crash risk | must fix |
| Medium | 🟡 | performance hazard, logic flaw | should fix |
| Minor | 🟢 | naming, comments | optional improvement |
Dimension scoring (each on a 1–10 scale):
| Dimension | Excellent (8–10) | Good (6–7) | Needs work (4–5) | Poor (1–3) |
|---|---|---|---|---|
| Code quality | clear naming, clean structure, no duplication | mostly compliant, minor issues | confusing naming or high complexity | violates coding standards |
| Security | no risk, parameterized queries, full validation | basically safe, small flaws | security hazards | severe vulnerabilities |
| Performance | efficient algorithms, caching, no N+1 | acceptable | obvious problems | severe defects |
| Maintainability | documented, modular, high test coverage | maintainable | missing comments/tests | hard to maintain |
Overall score bands: 9–10 excellent · 7–8 good · 5–6 fair · 3–4 poor · 1–2 very poor (fix immediately).
scripts/html-report-generation.mddts: false) with no lint or typecheck scripts — type errors surface in the editor/IDE.【类型】简短描述 (nine fixed type tags).Q: Why does the first dsh plugin add fail?
A: pnpm refuses to run build scripts of git dependencies until explicitly allowed. Copy the exact package key pnpm printed into the profile's pnpm-workspace.yaml → allowBuilds, then re-run.
Q: How do I pin a specific commit?
A: Append #<sha> to the spec, e.g. git+https://github.com/7dgroup-ai/dsh-skill-7d-code-reviewer.git#<sha> — later pushes cannot silently change what runs.
Q: How do I uninstall?
A: Run dsh plugin --profile <name> remove @7dgroup/dsh-skill-7d-code-reviewer (pnpm removes the dependency and the bundle row is reconciled away), or edit the profile's package.json and remove the row from dsh.profile.bundles. No core patches are left behind.
Q: Can I install without approving builds?
A: Yes — use the prebuilt tarball (committed at the repository root) or the npm package (once published); neither needs allowBuilds.
Q: Which profile should I install into?
A: The one you boot — dsh --profile <name> is required on every run, and the skill only activates in the profile it is installed into. Most sessions boot web (dsh web), so dsh plugin --profile web add ... is the typical command.
Q: dsh plugin fails with "pnpm not found"?
A: dsh plugin forwards to pnpm in the profile directory — install pnpm and put it on PATH (corepack prepare pnpm@latest --activate or npm install -g pnpm@10), then re-run.
MIT · Copyright (c) 2026 7DGroup