Uploaded July 2026 | Updated September 2026, 2 weeks ago
"The agent now has a repeatable process that I've given it on how I want it to conduct code reviews," says cloud architect and AWS Hero Kesha Williams, who brought a live demo to the AI Superstream showing exactly how to build that process from scratch. She covered how to structure a SKILL.md file with a name, description, and step-by-step instructions the agent follows every time; how to configure the review to flag issues across specific categories like security, testing, complexity, and style; and how to set a three-verdict rating system: ship it, needs changes, or needs discussion. She then ran the skill against a deliberately broken Python script packed with hard-coded credentials, SQL injection vulnerabilities on three separate routes, unauthenticated remote code execution, seven levels of nested webhook logic, plain text password storage, and a database connection that never closes, among other issues. The agent surfaced 17 separate problems and returns a clear verdict: do not deploy. If you've been prompting your agent ad hoc for code reviews and getting inconsistent results, this may be your solution.
Follow O'Reilly on:
LinkedIn: linkedin.com/company/oreilly
Facebook: facebook.com/OReilly
Instagram: instagram.com/oreillymedia
BlueSky: https://bsky.app/profile/oreilly.bsky.social
TikTok: tiktok.com/@oreillymedia
"The agent now has a repeatable process that I've given it on how I want it to conduct code reviews," says cloud architect and AWS Hero Kesha Williams, who brought a live demo to the AI Superstream showing exactly how to build that process from scratch. She covered how to structure a SKILL.md file with a name, description, and step-by-step instructions the agent follows every time; how to configure the review to flag issues across specific categories like security, testing, complexity, and style; and how to set a three-verdict rating system: ship it, needs changes, or needs discussion. She then ran the skill against a deliberately broken Python script packed with hard-coded credentials, SQL injection vulnerabilities on three separate routes, unauthenticated remote code execution, seven levels of nested webhook logic, plain text password storage, and a database connection that never closes, among other issues. The agent surfaced 17 separate problems and returns a clear verdict: do not deploy. If you've been prompting your agent ad hoc for code reviews and getting inconsistent results, this may be your solution.
Follow O'Reilly on:
LinkedIn: linkedin.com/company/oreilly
Facebook: facebook.com/OReilly
Instagram: instagram.com/oreillymedia
BlueSky: https://bsky.app/profile/oreilly.bsky.social
TikTok: tiktok.com/@oreillymedia
