Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

Audits and code reviews for coding agents

oy adds repeatable, deterministic-input audit and review workflows to the coding agent you already use. The workflows ship as standard Agent Skills under .agents/skills, which OpenCode, Cursor, Codex, Copilot, and Gemini CLI all read natively.

Use it to:

  • audit a repository and write ISSUES.md or SARIF;
  • review a workspace or git diff <target> and write REVIEW.md;
  • fix one reported finding, verify it, and rerun the review.

The simple mental model

oy selects and freezes the review input
  → your agent analyzes it with your model and permissions
  → oy validates and writes the report

This prevents silent model-selected sampling and makes the reviewed input visible. Findings are still model-generated and can vary.

Start here — 3 steps

1. Install

curl -fsSL https://oy.adonm.dev/install.sh | sh
oy doctor --check   # expect "global skills ok"

2. Finish setup in your agent — copy-paste:

run the oy-setup skill to finish setup

The skill checks that your agent can see oy-audit, oy-review, oy-enhance, and copies them to your host’s preferred location if needed (for example .claude/skills).

3. Create your first report

audit this repository with the oy-audit skill

Look for ISSUES.md in the workspace root. Then try:

review the diff against main with the oy-review skill
use the oy-enhance skill to fix audit-0123456789abcdef

First time? Follow the full walkthrough in Getting started — it explains what each step does and what to do if something fails.

New to Agent Skills?

Agent Skills are plain Markdown files (SKILL.md). oy setup writes four of them to ~/.agents/skills/:

  • oy-audit, oy-review, oy-enhance — the workflows
  • oy-setup — verifies installation and installs the oy persona

Your agent loads the matching SKILL.md when you mention it. No extra daemon, no API keys stored by oy.

What oy owns

  • gitignore-aware repository and target-diff collection;
  • ordered evidence files and explicit coverage limits;
  • changed-input and artifact-integrity checks;
  • normalized Markdown/SARIF reports with stable finding IDs;
  • skill installation and legacy OpenCode plugin migration.

What your agent owns

  • models and provider credentials;
  • permissions and approvals;
  • shell, edit, web, and other tools;
  • sessions, UI, and model execution.

The skills run under your agent’s own permission model and never broaden it. oy is not a sandbox; see the security policy.

Choose your next page