What problem does it solve? Manual code review is slow and inconsistent, often missing security vulnerabilities, performance regressions, and architectural violations. This Skill automates multi-layered pull request analysis by combining static analysis tools with LLM-based reasoning, producing structured, severity-classified review comments. ## Core Features & Use Cases - Multi-Tool Static Analysis: Orchestrates CodeQL, SonarQube, Semgrep, Snyk, and TruffleHog to detect vulnerabilities, code smells, secrets, and supply chain risks. - AI-Assisted Review: Routes pull requests to appropriate LLMs (GPT-4o, Claude Sonnet, Qodo) based on size, security sensitivity, and coverage gaps, generating JSON-formatted findings with CWE identifiers and fix examples. - CI/CD Integration: Provides a GitHub Actions workflow that posts inline review comments, enforces quality gates on critical issues, and requests changes automatically. - Use Case: A team opens a pull request touching authentication code; the Skill runs Semgrep and CodeQL, sends the diff plus static results to Claude for deep security analysis, and posts line-referenced comments flagging a SQL injection with a parameterized-query fix. ## Quick Start Ask the AI to review the current pull request for security, performance, and architecture issues and generate severity-classified comments with fix examples.
