skills.rest
JonusNattapong
JonusNattapongCOMMUNITY
Explore all skills by this author →
GitHub

review-code

Review code diffs for correctness, security, and maintainability with severity-tagged findings.

Updated Sep 3, 2026
Search Tags:#code quality#diff analysis#code review#pull request#owasp#security review#severity tagging
One-click install
npx skills add https://github.com/JonusNattapong/A2A-MCP --skill review-code-jonusnattapong
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: review-code
Source: https://github.com/JonusNattapong/A2A-MCP/tree/main/src/agenttalk/skills/devkit/review-code
Command: npx skills add https://github.com/JonusNattapong/A2A-MCP --skill review-code-jonusnattapong

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Code reviews often miss real defects because reviewers skim hunks in isolation, trust plausible-looking code, or get lost in style nits while broken data flow ships. This Skill enforces a disciplined, adversarial review process that grounds every finding in the actual code and produces a clear merge verdict. ## Core Features & Use Cases - Priority-ordered walkthrough: Reviews design, correctness, complexity, tests, naming, and style in that order so effort goes to what gates the merge. - Adversarial verification: Requires quoting exact lines, confirming referenced symbols exist, tracing data flow, and running tests or minimal repros before asserting any finding. - Security pass: Ships an OWASP-aligned checklist (references/security.md) covering access control, injection, secrets, dependency slopsquatting, and resource safety for changes touching sensitive surfaces. - Structured verdicts and evidence: Emits APPROVE / APPROVE-WITH-NITS / REQUEST-CHANGES mapped to a review-result evidence profile with severity-tagged Conventional Comments. - Use Case: Before merging a pull request that touches authentication logic, run this Skill to verify every changed line in context, execute the OWASP security sweep, and produce a blocker-tagged report with a release-blocker verdict. ## Quick Start Review the current uncommitted diff for code health and give me a severity-tagged findings report with a final approve or request-changes verdict.

Frequently Asked Questions about review-code

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I review a pull request diff for code quality?▼

Review the diff in priority order: design and architecture first, then correctness, complexity, tests, naming, and style. Read every changed line with its surrounding context, verify claims against the real code, and tag each finding as blocker, major, minor, or nit.

How to check AI-generated code for security vulnerabilities?▼

Run an OWASP-aligned security pass whenever the change touches auth, input handling, secrets, file paths, deserialization, or dependencies. Check for broken access control, injection, hardcoded secrets, and nonexistent suggested packages, since AI-written code carries security bugs at a higher rate.

When should a code review request changes instead of approving?▼

Request changes when there is any mandatory follow-up, unresolved major finding, unverified required test, compatibility risk, or security concern. Approve-with-nits is only for truly non-blocking issues; never withhold approval over imperfection alone.

What are the limitations of reviewing large diffs?▼

Defect detection collapses past roughly 400 lines of changes, so large diffs should be reviewed in focused chunks. Reviewing hunks in isolation also hides bugs that live in unchanged-but-affected surrounding code.

When should I not use this code review skill?▼

Do not use it for writing new code, reviewing documentation, or answering general code questions unrelated to a specific diff. It is scoped to reviewing a concrete change or pull request against the actual codebase.

Related Skills

Explore More Software Engineering Skills→
vonomarapvonomarap

code-reviewer

Review local diffs or GitHub pull requests and produce structured findings.

Community
Intermediate
go-musicfoxgo-musicfox
2.6k

om-code-review

Reviews diffs, branches, and PRs against correctness, security, and breaking-change checklists with severity-ranked findings.

Official
Advanced
arndvsarndvs

pr-preflight

Audits changed files, diffs, and stack tooling before opening a pull request.

Community
Advanced
juxtjuxt
10

propagate

Generate unit, integration, property-based, and state machine tests from Allium behavioral specifications.

Official
Advanced