code-review

Reviews substantial repository changes against SPEC, PLAN, architecture rules, tests, and security boundaries.

Updated Aug 5, 2026
One-click install
npx skills add https://github.com/ahsanghalib/ai-workflow --skill code-review-ahsanghalib
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: code-review
Source: https://github.com/ahsanghalib/ai-workflow/tree/main/skills/code-review
Command: npx skills add https://github.com/ahsanghalib/ai-workflow --skill code-review-ahsanghalib

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Reviewing a large implementation by hand is error-prone: reviewers miss SPEC mismatches, plan deviations, authorization leaks, and missing tests. This Skill provides a disciplined, read-only review workflow that checks a substantial change against its approved SPEC and PLAN, engineering rules, and security boundaries, then reports only actionable findings with evidence. ## Core Features & Use Cases - Plan-backed review: Verifies the exact SPEC and PLAN status before reviewing, and routes to a diff-only review when those artifacts are missing or unapproved. - Mechanical and structural checks: Runs only configured, non-installing checks (tests, typecheck, lint, dependency-cruiser, knip, spectral, betterleaks, ast-grep) and uses structural indexes like CodeGraph for caller and blast-radius analysis. - Evidence-backed findings report: Outputs severity-ordered findings with exact path/line evidence, impact, remediation, verified checks, and residual risk. - Use Case: After an engineer finishes a feature branch with an approved PLAN, ask for a full code review to confirm the implementation matches the SPEC, has no authorization or data-integrity regressions, and includes adequate tests before merge. ## Quick Start Review the current working-tree diff against the approved SPEC and PLAN, and report actionable findings with file and line evidence without editing any code.

Frequently Asked Questions about code-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I review a code change against a SPEC and plan?▼

Provide the review scope (named files, a diff, or the current working-tree diff) along with the approved SPEC and PLAN. The review traces changed behavior through validation, authorization, storage, and error paths, then reports findings with exact path and line evidence.

What is the difference between a full code review and a diff-only review?▼

A full code review evaluates a substantial implementation against its SPEC, approved PLAN, architecture rules, and security boundaries. A diff-only review (handled by review-diff) is for quick reviews without planning artifacts; this Skill routes there when no approved SPEC or PLAN exists.

Which checks run during an automated code review?▼

Only configured, local, non-installing checks permitted by repository policy: narrow tests, typecheck, lint, dependency-cruiser for import boundaries, knip for unused exports, spectral for OpenAPI changes, betterleaks for secret scanning, and ast-grep for structural rules. Missing tools are never installed during review.

Can the code review edit or fix the code it finds problems in?▼

No. The review is strictly read-only: it does not edit code, tests, plans, or configuration, and it does not change Git state or install tools. Implementation fixes are routed to the relevant engineering skill, after which the changed scope is re-reviewed.

What happens if there is no approved SPEC or PLAN for the change?▼

The review reports the limitation instead of inventing a plan, and routes the request to a diff-only review when appropriate. It never assumes a baseline commit or fabricates planning artifacts.

Does the review cover security and supply-chain risks?▼

Yes, conditionally on the changed surface. Authentication, authorization, sensitive data, and external integrations trigger security-and-hardening review, while dependency, lockfile, or CI changes trigger supply-chain-security review, when those skills are available.