skills.rest
avbel
avbelCOMMUNITY
Explore all skills by this author →
GitHub

dev-review

Reviews code diffs for spec gaps, security issues, and missing edge-case tests.

2|Updated May 16, 2026
Search Tags:#diff analysis#code review#pull request#edge cases#security audit#test coverage#spec compliance
One-click install
npx skills add https://github.com/avbel/ai-skills --skill dev-review-avbel
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: dev-review
Source: https://github.com/avbel/ai-skills/tree/main/skills/dev-review
Command: npx skills add https://github.com/avbel/ai-skills --skill dev-review-avbel

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? AI-authored and human-authored diffs often silently drop spec requirements, leave stubs posing as implementations, miss security holes like IDOR or SQL injection, and skip edge-case tests. This Skill runs a structured, multi-axis review so nothing important slips through before merge. ## Core Features & Use Cases - Spec-Completeness Audit: Walks every spec item against the diff to catch silently skipped requirements, stubs, and quietly narrowed scope. - Security Pass: Traces untrusted input to sinks, checks authz on new endpoints, scans for secrets, weak crypto, SSRF, and TOCTOU races. - Edge-Case Test Audit: Lists exactly which edge cases (null input, boundaries, concurrency, partial failure) lack tests. - Second Opinion: Delegates to an independent reviewer skill when installed for a fresh-session review. - Use Case: Before merging a feature branch, ask for a review and get a verdict organized by severity: spec gaps, security findings, blocking issues, missing tests, and unused code. ## Quick Start Ask the agent to review my current changes and tell me if this branch is ready to merge.

Frequently Asked Questions about dev-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I review a pull request for spec completeness?▼

Walk each spec or plan item and point at the code that implements it; anything you cannot point at is a blocking finding. Also search the diff for TODO, FIXME, unimplemented markers, and empty function bodies that pose as finished work.

How to check a code diff for security vulnerabilities?▼

Trace every new input to its sink: string-concatenated SQL, shell commands with interpolated input, path traversal, unescaped HTML, and unsafe deserialization. Also verify object-level authorization on new endpoints and scan for hardcoded secrets or weak randomness.

What edge cases should tests cover for new code?▼

Cover empty or null input, boundary values, duplicate or concurrent calls, dependency failures, and partial failure paths. Each new or changed code path without a test for these cases is reported as a finding, same as a bug.

Does this review skill work without a second-opinion reviewer installed?▼

Yes, the second opinion step is optional. If the delegated review skill is not installed, the verdict explicitly states no second opinion was available rather than silently skipping it.

When should a code review escalate to a dedicated security review?▼

Escalate when the diff touches auth flows, session handling, crypto, payments, sandboxing, or file upload handling. Run the platform's dedicated security review or an adversarial second opinion and note it in the verdict.

Related Skills

Explore More Software Engineering Skills→
tta-labtta-lab
23

plan-triage

Categorize plan review findings into fixes, deferrals, and escalations.

Official
Intermediate
daniyarseifolladaniyarseifolla

adapter-gitlab

Automate GitLab CI/CD merge requests, pipeline monitoring, and deploy triggers.

Community
Advanced
kdlbskdlbs
562

verify

Run format, typecheck, tests, and lint across monorepo packages.

Official
Intermediate
ckrono-progckrono-prog

security_scan

Conducts a multi-scanner security audit of a codebase for critical and high vulnerabilities.

Community
Intermediate