agentleFS
Sign inStart free
AICreator-WindAICreator-Wind/gstack-openclaw-skills/review/SKILL.md

review

Skill44 starsChanged 8 months agoMITView on GitHub

高级工程师代码审查工具。预合并PR审查，分析SQL安全、LLM信任边界、竞态条件等问题，并实际修复发现的bug。

Create a free account to mount
Files
SKILL.md

Review - 代码审查

转换自 gstack/review，专为 WorkBuddy/OpenClaw 优化

概述

预合并 PR 审查工具，分析基于分支的差异，检查 SQL 安全性、LLM 信任边界违规、条件副作用和其他结构性问题。

触发条件

当用户说以下内容时使用此技能：

  • "review this PR"
  • "code review"
  • "pre-landing review"
  • "check my diff"
  • "审查这段代码"
  • 代码即将合并时

核心流程

步骤 0: 检测基础分支

  • 检查现有 PR 的目标分支
  • 失败时使用仓库默认分支（通常是 main）

步骤 1: 分支检查

  • 确认当前分支不是基础分支
  • 验证存在差异可审查

步骤 1.5: 范围漂移检测

  • 对比任务描述与实际的代码变更
  • 识别范围蔓延或缺失需求

步骤 2: 读取检查清单

  • 读取审查检查清单文件
  • 确保覆盖所有关键点

步骤 3: 获取差异

  • 获取最新基础分支代码
  • 生成完整的 git diff

步骤 4: 双阶段审查

关键阶段（必须修复）

  • SQL 安全性检查
  • 竞态条件
  • LLM 信任边界
  • 枚举完整性
  • 认证/授权漏洞

信息阶段（建议修复）

  • 条件副作用
  • 魔法数字
  • 死代码
  • 测试覆盖
  • 性能问题

步骤 5: 设计审查（条件性）

  • 仅在前端文件变更时执行
  • 基于设计文档或通用设计原则

步骤 6: 修复优先

AUTO-FIX 级别

  • 自动修复机械性问题
  • 格式问题
  • 简单的逻辑修复

ASK 级别

  • 需要用户确认的复杂问题
  • 设计决策
  • 重构建议

完整性原则

"不要做半桶水，要做就做一整桶"

  • 主张在 AI 辅助下实现 100% 完整性
  • 反对"足够好"的妥协方案
  • 识别问题后必须实际修复

状态协议

审查完成后，使用以下状态：

  • DONE: 成功完成，代码可以合并
  • DONE_WITH_CONCERNS: 完成但有顾虑，需关注
  • BLOCKED: 无法继续，存在阻塞问题
  • NEEDS_CONTEXT: 需要更多信息

安全检查清单

SQL 安全

  • 参数化查询
  • 避免 SQL 注入
  • 最小权限原则

LLM 信任边界

  • 输入验证
  • 输出清理
  • 拒绝恶意提示

竞态条件

  • 并发访问
  • 锁机制
  • 事务完整性

认证授权

  • 权限检查
  • 会话管理
  • API 安全

代码质量标准

  • 代码组织清晰
  • 遵循 DRY 原则
  • 命名语义化
  • 适当的注释
  • 完整的错误处理

注意: 本技能是 gstack review 的 WorkBuddy/OpenClaw 适配版本。

Download now (ZIP)

  • Other versions191 projects use a version of this.

    Word for word · 0

    None found.

    Edited · 0

    None found.

    Wrote their own version · 191

    1. garrytan/gstack★ 139ksame name
    2. ansible/ansible★ 71ksame name
    3. docling-project/docling★ 70ksame name
    4. traefik/traefik★ 65ksame name
    5. ClickHouse/ClickHouse★ 51ksame name
    6. temporalio/temporal★ 24ksame name
    7. tisfeng/Easydict★ 15ksame name
    8. juicedata/juicefs★ 15ksame name
    9. elie222/inbox-zero★ 13ksame name
    10. gitkraken/vscode-gitlens★ 9.9ksame name

    181 more not listed

    How matches are found. Word for word: the exact same text. Edited: shares passages with this file (“99% same” means 99% of its five-word phrases also appear here; 10% or more counts). Their own version: similar meaning, or, weakest, the same name. We can’t tell which project had it first. Projects are counted among the 200 most-starred candidates, and mentions are links to the repository we found, up to 50 per site, so both counts are a floor.

  • Used alongsideProjects with it also use daily-arxiv, exp-eval and 9 more.

    Other files people use alongside this one.

    Files found in the same public projects as a version of this one, more often than they turn up anywhere else. Each project counts once, large collections count for less, and this file's own repository is left out.
    • LambenthanSkill

      daily-arxiv

      每日从 arXiv 拉取新论文，过滤相关性，auto-ingest 高优先级论文，检测 SOTA 更新

      Also in 5 projects that use this

    • LambenthanSkill

      exp-eval

      实验判决门：Review LLM 独立评判实验结果 → 4 种判决路径 → 自动更新 claims confidence、ideas status、graph edges

      Also in 5 projects that use this

    • SethGammonSkill

      ascii-diagram

      Generate perfectly aligned ASCII diagrams — architecture, flow, sequence, box-and-arrow. Uses a programmatic character-grid approach so alignment is guaranteed by math, not token prediction. Includes post-render verification.

      Also in 4 projects that use this

    • DAIR-AutoResearchSkill

      exp-pilot-eval

      Pilot result evaluation — read pilot results, apply success criteria, update idea page (pilot_result, failure_reason if failed), generate PILOT_VERDICT_REPORT. Called by /ideate Phase 5 after /exp-pilot-run.

      Also in 4 projects that use this

    • DAIR-AutoResearchSkill

      exp-pilot-run

      Pilot experiment execution — read Pilot Spec YAML, write pilot code, run experiment(Confirm with the user before operation and require the applicant to conduct manual inspection), return results. Called by /ideate Phase 5. Does NOT modify wiki pages or judge pass/fail.

      Also in 4 projects that use this

    • +5 more from Lambenthan
    • +1 more from DAIR-AutoResearch
  • In this repository21 other files it gives its agents.

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

Reviews can't be read right now.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

Check your setup, free