adversarial-review

Hunts correctness, security, contract, and fake-green defects in pull requests before merge.

1|Updated Aug 14, 2026
One-click install
npx skills add https://github.com/zhiyuan-zhang0206/Ava --skill adversarial-review-zhiyuan-zhang0206
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: adversarial-review
Source: https://github.com/zhiyuan-zhang0206/Ava/tree/main/.agents/skills/adversarial-review
Command: npx skills add https://github.com/zhiyuan-zhang0206/Ava --skill adversarial-review-zhiyuan-zhang0206

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Ordinary code review and green CI routinely miss semantic defects: string-compared watermarks, swallowed exceptions, fail-open checks, and fake-green test runs. This Skill performs a structured adversarial review of every PR before it enters the merge queue, assuming the diff is defective and hunting for what breaks and when. ## Core Features & Use Cases - Nine review dimensions: correctness and data flow, boundary polarity, contracts, silent failure, security, unbounded growth, test quality, design invariants (R1-R4), and documentation sync, each with concrete defect classes drawn from real incidents. - Verification-chain validation: proves CI green is real before reviewing by inspecting run durations, artifacts, coverage gates, and proof-of-work, catching fake-green signatures like seconds-long full suites. - Pattern library matching: matches diffs against a catalog of defect classes the repo has actually shipped, plus adversarial techniques like impact-surface tracing and reverse scenarios. - Use Case: Before enqueueing a PR that touches the event pipeline, run this Skill to verify CI genuinely ran, trace watermark advancement on failure paths, and produce a P0/P1/P2 report posted as a PR comment. ## Quick Start Run an adversarial review on PR number 123 and post the verdict report as a PR comment.

Frequently Asked Questions about adversarial-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I review a pull request for hidden bugs before merging?▼

Run an adversarial review that assumes the diff is defective: verify CI genuinely ran, then walk nine dimensions covering correctness, polarity, contracts, silent failure, security, growth, test quality, invariants, and docs. Every finding must cite file:line with evidence and a suggested fix.

How to detect fake-green CI runs on GitHub pull requests?▼

Inspect run durations and artifacts with gh run view rather than trusting the check box. A full backend suite finishing in seconds, missing junitxml artifacts, skipped checks, or NO_WORKFLOW_RUNS are documented fake-green signatures requiring local verification.

What severity levels should a code review report use?▼

This Skill uses three levels: P0 for production risk like data loss, leaks, or silent failure; P1 for clear bugs, contract breaks, and resource leaks; P2 for hygiene. P0 and P1 block merge, and an empty report on a clean diff is a valid outcome.

Can the PR author perform their own adversarial review?▼

No. The reviewer must be the repo steward or a dedicated reviewer agent named by the delegator, never the PR author, because reviewing your own diff is self-confirmation and defeats the adversarial stance.

When should adversarial review run in the merge process?▼

It runs after the PR is open and CI is verified genuinely green, but before the PR is enqueued for merge. Findings loop back to the author for fixes or evidence-based rebuttals, and the reviewer re-checks only changed hunks.