review-code
Skill137 starsChanged 4 months agoMITView on GitHub
Review the changes since a fixed point (commit, branch, tag, or merge-base) along two axes — Standards (does the code follow this repo's documented coding standards?) and Spec (does the code match what the originating spec/PRD asked for?). Use when the user wants to review a branch, work-in-progress changes, or asks to "review since X".
We split this skill into the rules it gives an agent
4 rules. 0 are common, 3 are distinctive, and 1 is very specific to this project.
0
Common
Most of the 55 edited versions we read keep these.
3
Distinctive
This author's own choices. Worth a look.
1
Very specific
Tied to their project's names, files or tools. Probably skip.
- Common
- Distinctive
- Very specific
- Very specific: line 21
Before going further, confirm the fixed point resolves (git rev-parse <fixed-point>) and the diff is non-empty.
- Distinctive: line 25
Look for the originating spec, in this order:
- Distinctive: line 31
If nothing is found, ask the user where the spec is.
- Distinctive: line 78
If the spec is missing, skip the Spec axis and note this in the final report.
“Common” is measured: kept by at least 6 in 10 of the 55 edited versions of this file we could read. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.
Files
Two-axis review of the diff between HEAD and a fixed point the user supplies:
- Standards — does the code conform to this repo's documented coding standards?
- Spec — does the code faithfully implement the originating spec / PRD?
The two axes are reviewed in isolation so they don't pollute each other, then aggregated side by side.
Process
1. Pin the fixed point
Whatever the user said is the fixed point — a commit SHA, branch name, tag, main, HEAD~5, etc. If they didn't specify one, ask for it.
Capture the diff command once: git diff <fixed-point>...HEAD (three-dot, so the comparison is against the merge-base). Also note the list of commits via git log <fixed-point>..HEAD --oneline.
Before going further, confirm the fixed point resolves (git rev-parse <fixed-point>) and the diff is non-empty. A bad ref or empty diff should fail here — not inside the two reviews.
2. Identify the spec source
Look for the originating spec, in this order:
- A path the user passed as an argument.
- A spec under
.plan/— typically.plan/<slug>/spec.md, matching the branch name or feature. - A PRD/spec file elsewhere in the repo (
docs/,specs/, or similar) matching the branch name or feature. - Issue references in the commit messages (
#123,Closes #45, etc.) — if the environment has a way to fetch them (e.g. the repo host's CLI), fetch the referenced issue. - If nothing is found, ask the user where the spec is. If they say there isn't one, the Spec axis will skip and report "no spec available".
3. Identify the standards sources
Anything in the repo that documents how code should be written, such as CODING_STANDARDS.md or CONTRIBUTING.md.
On top of whatever the repo documents, the Standards axis always carries the smell baseline below — a fixed set of Fowler code smells (Refactoring, ch.3) that applies even when a repo documents nothing. Three rules bind it:
- The repo overrides. A documented repo standard always wins; where it endorses something the baseline would flag, suppress the smell.
- The language's paradigm applies. Skip smells that don't fit the language being reviewed — e.g. Refused Bequest in a language without inheritance, Feature Envy where there are no objects to envy.
- Always a judgement call. Each smell is a labelled heuristic ("possible Feature Envy"), never a hard violation — and, like any standard here, skip anything tooling already enforces.
Each smell reads what it is → how to fix; match it against the diff:
- Mysterious Name — a function, variable, or type whose name doesn't reveal what it does or holds. → rename it; if no honest name comes, the design's murky.
- Duplicated Code — the same logic shape appears in more than one hunk or file in the change. → extract the shared shape, call it from both.
- Feature Envy — a method that reaches into another object's data more than its own. → move the method onto the data it envies.
- Data Clumps — the same few fields or params keep travelling together (a type wanting to be born). → bundle them into one type, pass that.
- Primitive Obsession — a primitive or string standing in for a domain concept that deserves its own type. → give the concept its own small type.
- Repeated Switches — the same
switch/if-cascade/pattern-match on the same type recurs across the change. → replace with polymorphism, a dispatch table, or one match site both callers share. - Shotgun Surgery — one logical change forces scattered edits across many files in the diff. → gather what changes together into one module.
- Divergent Change — one file or module is edited for several unrelated reasons. → split so each module changes for one reason.
- Speculative Generality — abstraction, parameters, or hooks added for needs the spec doesn't have. → delete it; inline back until a real need shows.
- Message Chains — long
a.b().c().d()navigation the caller shouldn't depend on. → hide the walk behind one method on the first object. - Middle Man — a class or function that mostly just delegates onward. → cut it, call the real target direct.
- Refused Bequest — a subclass or implementer that ignores or overrides most of what it inherits. → drop the inheritance, use composition.
4. Run both reviews in isolation
If your environment supports spawning subagents, send a single message with two subagent calls (use a general-purpose subagent for both) so the axes run in parallel with isolated context.
Otherwise, run the two axes as sequential, self-contained passes in this session: complete the Standards pass in full and write its findings down before starting the Spec pass, then re-read the diff fresh with only the spec in mind. Don't let one pass's findings leak into the other's brief.
Either way, each axis gets exactly the brief below and nothing else.
Standards brief — include:
- The full diff command and commit list.
- The list of standards-source files you found in step 3, plus the smell baseline from step 3 pasted in full — a subagent has no other access to it.
- The instruction: "Report — per file/hunk where relevant — (a) every place the diff violates a documented standard: cite the standard (file + the rule); and (b) any baseline smell you spot: name it and quote the hunk. Distinguish hard violations from judgement calls — documented-standard breaches can be hard, but baseline smells are always judgement calls, and a documented repo standard overrides the baseline. Skip anything tooling enforces, and skip smells that don't apply to the language's paradigm. Under 400 words."
Spec brief — include:
- The diff command and commit list.
- The path or fetched contents of the spec.
- The instruction: "Report: (a) requirements the spec asked for that are missing or partial; (b) behaviour in the diff that wasn't asked for (scope creep); (c) requirements that look implemented but where the implementation looks wrong. Quote the spec line for each finding. Under 400 words."
If the spec is missing, skip the Spec axis and note this in the final report.
5. Aggregate
Present the two reports under ## Standards and ## Spec headings, verbatim or lightly cleaned. Do not merge or rerank findings — the two axes are deliberately separate (see Why two axes).
End with a one-line summary: total findings per axis, and the worst issue within each axis (if any). Don't pick a single winner across axes — that's the reranking the separation exists to prevent.
Why two axes
A change can pass one axis and fail the other:
- Code that follows every standard but implements the wrong thing → Standards pass, Spec fail.
- Code that does exactly what the issue asked but breaks the project's conventions → Spec pass, Standards fail.
Reporting them separately stops one axis from masking the other.
Other versions66 projects use a version of this.
Word for word · 0
None found.
Edited · 1
- nhhthong/skills★ 123% same
Wrote their own version · 65
- penpot/penpot★ 62ksame name
- pnpm/pnpm★ 37ksame name
- verdaccio/verdaccio★ 18ksame name
- NVIDIA-NeMo/DataDesigner★ 2.4ksame name
- OpenAEV-Platform/openaev★ 1.8ksame name
- bazel-contrib/rules_python★ 687same name
- wataru-maeda/react-native-boilerplate★ 521same name
- ankitvgupta/exo★ 496same name
- ankitvgupta/mail-app★ 496same name
- ninehills/skills★ 280same name
55 more not listed
How matches are found. Word for word: the exact same text. Edited: shares passages with this file (“99% same” means 99% of its five-word phrases also appear here; 10% or more counts). Their own version: similar meaning, or, weakest, the same name. We can’t tell which project had it first. Projects are counted among the 200 most-starred candidates, and mentions are links to the repository we found, up to 50 per site, so both counts are a floor.
Used alongsideProjects with it also use clear-caches, electron-devtools-testing and 10 more.
Other files people use alongside this one.
Files found in the same public projects as a version of this one, more often than they turn up anywhere else. Each project counts once, large collections count for less, and this file's own repository is left out.
mrdulasolutionsSkillclear-caches
Clear extension caches, analysis data, and drafts from the database. Use when testing sender lookups, analysis, or draft generation from a clean state.
Also in 3 projects that use this
mrdulasolutionsSkillelectron-devtools-testing
Test the Electron app interactively using Chrome DevTools Protocol. Use when the user asks to test, verify, or interact with the running app via browser automation.
Also in 3 projects that use this
ba0918Skillreview-deps
A focused read-only review that treats manifests, lockfiles, and dependency diffs as first-class input and evaluates known vulnerabilities and supply chain signals. Use when the user says "review the dependencies", "look at the dependency vulnerabilities", "check the lockfile", "supply chain risk", "organize the npm audit output", "detect typosquats", "dependency health", or "review-deps". Its subject is the health of the dependencies, not test quality or code quality.
Also in 3 projects that use this
fabianbothSkillreviewloop
Run the autonomous review loop to address PR comments, fix issues, and push changes iteratively until all comments are resolved.
Also in 3 projects that use this
sarfraznawaz2005Skilltake-screenshots
A Windows screenshot skill that provides both programmatic full-screen capture and interactive region selection.
Also in 3 projects that use this
PydanticSkillreview-security
Security review of the current branch against its merge base — sandbox escapes, memory errors, panics and resource-limit bypasses. Use when reviewing changes for security risk, or before merging anything touching the heap/ module, path_security.rs, the wire protocol or the pool.
Also in 6 projects that use this
- +1 more from mrdulasolutions
In this repository13 other files it gives its agents.
- verifySkill
- domain-modelingSkill
- grill-meSkill
- codebase-designSkill
- grill-with-docsSkill
- handoffSkill
- improve-codebase-architectureSkill
- to-specSkill
- to-ticketsSkill
- writing-great-skillsSkill
- prototypeSkill
- researchSkill
- wayfinder-mapsSkill
Does it work?
Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.
No reviews yet
People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.
- It worked
- Partly
- It didn't
Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.
Your trail
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Now do this for your own.
Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

