Quick Review

You are performing a lightweight, ad-hoc code review. This is the fast alternative to /draft:review — no track context needed, focused on a specific PR, diff, or file set.

MANDATORY GRAPH LOOKUP (read before dimension review)

When draft/graph/schema.yaml exists, this skill must follow the graph-first lookup contract in core/shared/graph-query.md §Mandatory Lookup Contract. Quick-review keeps the graph load light:

First resolve the bundled helpers:

# Locate Draft's bundled helpers (cwd is the user's project; ${CLAUDE_PLUGIN_ROOT}
# is not exported into skill Bash). See core/shared/tool-resolver.md.
DRAFT_TOOLS="${DRAFT_PLUGIN_ROOT:-$(cat ~/.cache/draft/plugin-root 2>/dev/null)}/scripts/tools"
[ -d "$DRAFT_TOOLS" ] || DRAFT_TOOLS="$(ls -d ~/.claude/plugins/cache/*/draft/*/scripts/tools 2>/dev/null | sort -V | tail -1)"
[ -d "$DRAFT_TOOLS" ] || DRAFT_TOOLS="$(ls -d ~/.claude/plugins/marketplaces/*draft*/scripts/tools 2>/dev/null | tail -1)"
[ -d "$DRAFT_TOOLS" ] || DRAFT_TOOLS="$PWD/scripts/tools"

1. Always run "$DRAFT_TOOLS/hotspot-rank.sh" --repo . for every changed file (Step 2 blast-radius pre-check below).
2. If a finding spans more than one file, run "$DRAFT_TOOLS/graph-callers.sh" --repo . --symbol <name> to enumerate the call sites before claiming "no other usages".

Filesystem grep is reserved for source-text scans (literal strings, regex patterns). Symbol and caller discovery go through the graph.

Red Flags — STOP if you're

See shared red flags — applies to all code-touching skills.

Skill-specific:

• Reviewing without reading the code first
• Providing generic feedback not grounded in the actual code
• Missing security implications in authentication/authorization code
• Ignoring error handling paths
• Reviewing a whole module when asked for a specific file

Read the code. Ground every finding in a specific line.

Pre-Check

0. Capture Git Context

Before starting, capture the current git state:

git branch --show-current # Current branch name
git rev-parse --short HEAD # Current commit hash

Store this for the review report header. The review is scoped to this specific branch/commit.

1. Load Draft Context (if available)

ls draft/ 2>/dev/null

If draft/ exists, read and follow core/shared/draft-context-loading.md. This enriches review with project patterns, guardrails, and accepted patterns from tech-stack.md. Layer 0.5 of that procedure includes loading the relevant core/guardrails/language-standards.md section for the project stack — apply those standards in Dimension 4 (Maintainability) and Dimension 3 (Correctness) for language-specific patterns.

If no draft context, proceed with generic review — still valuable.

Step 1: Parse Arguments

Check for arguments:

• /draft:quick-review — Review staged changes (git diff --cached) or current branch diff
• /draft:quick-review <file> — Review specific file(s)
• /draft:quick-review <PR-URL> — Review a pull request (via GitHub/GitHub MCP)
• /draft:quick-review <commit-range> — Review specific commits

Determine the diff to review:

1. If PR URL: fetch via GitHub MCP (get_change_detail, get_change_diff) or GitHub
2. If file path: read the file(s)
3. If commit range: git diff <range>
4. Default: git diff HEAD~1..HEAD (last commit)

Step 2: Blast Radius Pre-check (if draft/graph/schema.yaml exists)

Before the four-dimension review, run "$DRAFT_TOOLS/hotspot-rank.sh" --repo . and check if any files in scope appear in the output. If any file has a fanIn in the top 20% of the list, add this warning at the top of the review report:

⚠ HIGH IMPACT: {file} is a high-fanIn hotspot (fanIn={N}). Changes here propagate to many callers — review with extra care.

If no hotspot data exists or no file matches, skip silently.

Step 3: Four-Dimension Review

Review the code across four dimensions. For each finding, cite the specific file:line.

Dimension 1: Security

Load core/guardrails/security.md before this dimension. Apply the 5-step security reasoning chain (identify goal → check hard red lines SEC-01…SEC-10 → assess blast radius → trace generative paths → classify). Any hard red line violation is automatically Critical.

If a violation has a // SECURITY-OVERRIDE: <ticket> <justification> annotation, downgrade to Important and include the ticket in the finding.

• Authentication/authorization gaps [RC-005, SEC-10]
• Input validation and sanitization [RC-003]
• SQL injection, XSS, CSRF vulnerabilities [RC-002, RC-011, SEC-03]
• Secrets or credentials in code [RC-001, SEC-01]
• Disabled TLS or certificate verification [SEC-04]
• Shell injection or unsafe subprocess calls [SEC-06]
• PII or credentials in log output [RC-006, SEC-05]
• OWASP Top 10 patterns
• Insecure deserialization

Dimension 2: Performance

• N+1 query patterns
• Missing indexes for frequent queries
• Unnecessary allocations in hot paths
• Missing caching opportunities
• Unbounded loops or recursion
• Large payload serialization

Dimension 3: Correctness

• Logic errors, off-by-one, null handling
• Race conditions in concurrent code
• Error handling gaps (uncaught exceptions, missing error paths)
• Edge cases not covered
• State management issues
• Contract violations (API, type, invariant)

Dimension 4: Maintainability

• Code clarity and naming
• DRY violations (repeated logic)
• Dead code or unreachable paths
• Missing or misleading comments
• Test coverage for new logic
• Consistency with project patterns (from tech-stack.md if available)

Step 4: Classify Findings

Classify each finding:

Step 5: Generate Review Report

Present findings organized by severity:

## Quick Review: {scope description}

**Reviewer:** Draft Quick Review
**Scope:** {files/PR/commits reviewed}
**Date:** {ISO_TIMESTAMP}

### Summary
- Critical: {count}
- Important: {count}
- Suggestion: {count}

### Verdict: {PASS | PASS WITH NOTES | NEEDS CHANGES}

### Findings

#### Critical
1. **[finding title]** — `file:line`
   [description and recommendation]

#### Important
...

#### Suggestion
...

### What Went Well
[2-3 positive observations about the code — good patterns, clean logic, thorough error handling]

If track-scoped, save to draft/tracks/<id>/quick-review-<timestamp>.md.

Also check core/guardrails/dependency-triage.md if the diff modifies a dependency manifest file.

MANDATORY: Include YAML frontmatter with git metadata when saving. Follow core/shared/git-report-metadata.md.

Include the report header table immediately after frontmatter:

| Field | Value |
|-------|-------|
| **Branch** | `{LOCAL_BRANCH}` → `{REMOTE/BRANCH}` |
| **Commit** | `{SHORT_SHA}` — {COMMIT_MESSAGE} |
| **Generated** | {ISO_TIMESTAMP} |
| **Synced To** | `{FULL_SHA}` |

Mandatory Self-Check (before review report)

Before printing the review report, internally verify and report:

1. Graph files queried — JSONL files loaded plus any live graph query-tool invocations.
2. Layer 1 files deliberately skipped — list any context sections skipped.
3. Filesystem grep fallback justification — for every grep/find run, state the concept it searched for.

If draft/graph/schema.yaml does not exist, set Graph files queried: NONE and use justification graph data unavailable.

Graph Usage Report (append to review report)

Emit the canonical footer from core/shared/graph-usage-report.md §Canonical footer. The lint hook scripts/tools/check-graph-usage-report.sh validates the section on save.

Cross-Skill Dispatch

• Offered by: /draft:implement at phase boundaries as lightweight alternative to full review
• Escalates to: /draft:review if critical findings require deeper analysis
• Feeds into: /draft:learn (findings update guardrails via pattern learning)
• Suggests at completion:
  • If many findings: "Consider running /draft:review for full three-stage analysis"
  • If security findings: "Consider running /draft:deep-review for security audit"
• Jira sync: If ticket linked, attach review and post summary via core/shared/jira-sync.md

Error Handling

If no diff/file found: "No changes to review. Specify a file, PR URL, or commit range." If MCP unavailable for PR: Fall back to local git diff. "GitHub/GitHub MCP unavailable. Reviewing local diff instead." If no draft context: Proceed with generic review patterns. Note: "Review enriched when draft context is available (run /draft:init)."