code-review

Review code changes for correctness, performance, and security defects across cross-boundary agreements.

26.6k|2.8k|Updated Mar 1, 2026
One-click install
npx skills add https://github.com/phuryn/pm-skills --skill code-review-phuryn
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: code-review
Source: https://github.com/phuryn/pm-skills/tree/main/pm-ai-shipping/skills/code-review
Command: npx skills add https://github.com/phuryn/pm-skills --skill code-review-phuryn

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Code review output is often noise: unranked lists of things that look wrong, with no proof they are real defects. This Skill produces a small number of verified findings, each with a required behavior, a feasible trigger, a concrete contradiction, an observable consequence, and the strongest counterargument already checked. ## Core Features & Use Cases - Agreement-based correctness analysis: Anchors review on agreements between participants across boundaries (caller/callee, producer/consumer, writer/reader) rather than scanning file by file, surfacing the cross-boundary defects reviewers miss most. - Three selectable dimensions: Correctness is the default core; performance (workload to resource demand to consequence) and security (source to trust boundary to sink) activate as sub-cases of the same engine via the dimensions argument. - Refutation discipline: Every candidate finding must survive a five-part test — supported obligation, feasible execution, concrete contradiction, observable consequence, and an examined counterargument — before it is reported. - Use Case: After a large refactor touching async task handling, run the review on working changes to force violating executions around identity correlation and authority reconciliation, then receive ranked findings citing both sides of each broken agreement. ## Quick Start Ask the AI to review the current working changes for correctness defects using the code-review skill, optionally adding performance or security dimensions.

Frequently Asked Questions about code-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I review code changes for bugs with an AI assistant?▼

Invoke the code-review skill on your working changes or a target scope. It maps execution flows, identifies obligations between participants, constructs violating executions, and reports only findings that survive refutation, ordered by impact.

What is the difference between correctness, performance, and security review dimensions?▼

Correctness is the default and anchors on agreements between participants across a boundary. Performance anchors on workload versus resource demand and growth. Security anchors on source-to-sink flows across trust boundaries with an attacker controlling the source.

Can I run a security-only or performance-only code review?▼

Yes. Pass dimensions=security, dimensions=performance, or dimensions=all when invoking the skill. An explicit list selects exactly those sub-cases; a bare review request defaults to correctness only.

Why does this review report fewer findings than typical linting tools?▼

Every candidate must satisfy five requirements including a feasible execution and an examined counterargument before being reported. Suspicions without a constructed violating execution are dropped, so zero supported findings is a valid result.

Does static code review confirm exploitable vulnerabilities?▼

No. A static review produces code-review findings, not confirmed exploits or measured regressions. Security findings identify broken trust boundaries with a named victim, but exploitation is not dynamically verified.