Dev & automation

Uses

This skill reviews a diff the way a senior teammate would: it reads the surrounding code, not just the changed lines, before it says anything. It reports what breaks the program first, then what a security review would flag, and it never touches your files.

It runs when you ask for a review of a diff, a PR, or a set of changes. You get a ranked list of findings, each one anchored to a file and line, with the smallest patch that fixes it. You decide which patches to apply.

The skill never rewrites your code on its own. Every fix comes back as a proposed diff, so the change that lands in your repo is still the one you chose.

What it includes

• A SKILL.md with Purpose, Workflow, Output Contract, and Operating Rules sections.
• A fixed review order: correctness bugs, then security issues, each ranked by severity.
• A rule that blocks the skill from writing, editing, or staging any file.

Example

Input: a diff adding a new /api/refund endpoint that reads an amount from the request body and calls charge.refund(amount).

Output (excerpt):

1. api/refund.ts:14
   Failure scenario: A caller sends a negative amount. The endpoint passes it straight to
   charge.refund, which credits the caller's account instead of refunding it.
   Fix:
   --- a/api/refund.ts
   +++ b/api/refund.ts
   @@ -12,6 +12,9 @@
      const { amount } = req.body;
   +  if (typeof amount !== "number" || amount <= 0) {
   +    return res.status(400).json({ error: "amount must be a positive number" });
   +  }
      const result = await charge.refund(amount);

2. api/refund.ts:14
   Failure scenario: The endpoint has no check that the caller owns the charge being
   refunded. Any authenticated user can refund any charge ID.
   Fix: add an ownership check before the call to charge.refund (ties to the auth
   middleware already used in api/charges.ts:22).