agentleFS
Sign inStart free
surajvermasurajverma/homehub/.github/skills/code-review/SKILL.md

code-review

Skill1.2k starsChanged 22 days agoMITView on GitHub

Review pull requests to HomeHub, a self-hosted Flask + SQLAlchemy + Jinja + Tailwind 3 family app run in Docker. Use when reviewing any PR or diff in this repository.

  • Reads credentials

We split this skill into the rules it gives an agent

1 rule. 0 are common, 0 are distinctive, and 1 is very specific to this project.

  • 0

    Common

    Most of the 184 edited versions we read keep these.

  • 0

    Distinctive

    This author's own choices. Worth a look.

  • 1

    Very specific

    Tied to their project's names, files or tools. Probably skip.

  • Common
  • Distinctive
  • Very specific
  1. Very specific:

    Prefer db.session.get(Model, id) over the legacy Model.query.get(id) in new code.

    line 36

“Common” is measured: kept by at least 6 in 10 of the 184 edited versions of this file we could read. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.

Keep what fits and drop the rest. Your version, ready for your agents.
Files
SKILL.md

HomeHub code review

HomeHub is a small self-hosted family app (Flask, SQLAlchemy on SQLite, Jinja templates, Tailwind 3, Docker). It runs on a home network for one household, and people upgrade it by pulling a new image over their existing data. Review for real bugs and for breaks in the conventions below. Skip style nits where the surrounding code already does the same thing.

Upgrades must not break existing installs

  • There is no Alembic. Existing databases are upgraded at startup by app/migrations.py, which create_app calls. New columns go in its COLUMNS or LATE_COLUMNS lists.
  • A new column on an existing table needs both the model field and an entry in COLUMNS or LATE_COLUMNS in app/migrations.py. Without it, existing installs crash with "no such column". Check that the default makes sense for old rows.
  • A new table needs a CREATE TABLE IF NOT EXISTS in TABLES there, or must be safe to create through db.create_all().
  • Startup migrations must be idempotent and additive. Flag column renames, drops or type changes, since they break existing data/app.db files.
  • New config.yml keys must have a default in code, and should be added to config-example.yml. An existing config.yml without the key must keep working.

Permissions

  • Family members pick their name from a switcher; there are no per-member accounts. The acting user arrives as a user form or query field and should go through sanitize_text.
  • Admin checks go through the single is_admin(user) helper in app/admin.py. Flag code that compares a name to admin_name, 'Administrator' or 'admin' directly, or reads admin_name from config to decide permissions. A direct comparison bypasses whatever protection the helper adds.
  • The usual permission shape is is_admin(user) or user == <owner field> (for example creator or payer). Flag a route that edits or deletes someone's data without an owner/admin check.
  • Secrets (passwords, hashes, SECRET_KEY) must never be logged, flashed, rendered or returned in JSON. Password checks must fail closed.
  • The site password in config.yml is a separate gate and must keep working.
  • There are no CSRF tokens, on purpose. Don't ask for CSRF tokens on individual forms; do flag state changes made through GET requests.

Input and output safety

  • User text goes through sanitize_text, and rich text through sanitize_html (app/security.py), before it is stored.
  • Server-side fetches of user-supplied URLs must go through is_url_safe_for_fetch.
  • Jinja autoescaping is on. Flag new |safe unless the value was cleaned with sanitize_html.
  • Uploaded filenames go through secure_filename, and files are served with send_from_directory, so a name can't escape its folder.

Data and money

  • Prefer db.session.get(Model, id) over the legacy Model.query.get(id) in new code.
  • Money must add up exactly after rounding. Flag code that splits an amount with plain float division and rounds each part on its own; reuse the existing split helper in app/blueprints/expenses.py instead.
  • Changes to recurring items (expenses, reminders, chores) must not rewrite past occurrences unless that is the stated intent.

Front end

  • Tailwind 3 with darkMode: 'class'. New UI should include dark: variants matching the neighbouring markup, and should work at phone width.
  • static/output.css is built with npm run build:css and is gitignored. Flag a PR that commits it.

Files that must not be committed

  • compose.yml is the published config and points at ghcr.io/surajverma/homehub:latest. Flag any change that switches it to a local build (for example uncommenting build: .).
  • config.yml, .env, data/app.db, uploads/, media/ and pdfs/ are local data. Flag any of them in a diff.

Tests

  • Tests are pytest files in tests/. Each file builds its own app with create_app(test_config) and an in-memory SQLite database ('sqlite://'). New tests should follow that pattern, not use a real database.
  • Changes to permissions, money calculations or startup migrations should come with tests.
  • The suite needs a config.yml in the repo root to start (copy config-example.yml).
  • A few tests already fail on main. Judge a PR by whether it adds failures compared with its base branch, not by whether the whole suite is green.

How to write comments

  • Lead with the concrete failure: what input or state goes wrong, and what happens.
  • One comment per issue, on the line that causes it.
  • Mark optional suggestions clearly as optional.

Download now (ZIP)

Trending

More talk lately.thin dataabout the whole repository

Dec 2025: 0 mentionsJan 2026: 0 mentionsFeb 2026: 1 mentionMar 2026: 0 mentionsApr 2026: 0 mentionsMay 2026: 0 mentionsJun 2026: 0 mentionsJul 2026: 0 mentionsAug 2026: 0 mentionsSep 2026: 0 mentionsOct 2026: 2 mentionsNov 2026: 0 mentions
Dec 2025Jun 2026Nov 2026
Mentions a month of the surajverma/homehub repository that our weekly crawl found: only 3 in all, so this is a hint, not a trend. There is no adoption data for this file yet.

Who's talking about surajverma/homehub

The biggest 3 of 3 mentions linking to the repository that our crawl found. Each line is their own headline.

  • Other versions194 projects use a version of this.

    Word for word · 0

    None found.

    Edited · 0

    None found.

    Wrote their own version · 194

    1. mattpocock/skills★ 309ksame name
    2. TheAlgorithms/Python★ 226ksame name
    3. microsoft/vscode★ 194ksame name
    4. github/spec-kit★ 145ksame name
    5. ggml-org/llama.cpp★ 133ksame name
    6. shareAI-lab/learn-claude-code★ 80ksame name
    7. shareAI-lab/analysis_claude_code★ 78ksame name
    8. vectorize-io/hindsight★ 57ksame name
    9. dbeaver/dbeaver★ 52ksame name
    10. roboflow/supervision★ 51ksame name

    184 more not listed

    How matches are found. Word for word: the exact same text. Edited: shares passages with this file (“99% same” means 99% of its five-word phrases also appear here; 10% or more counts). Their own version: similar meaning, or, weakest, the same name. We can’t tell which project had it first. Projects are counted among the 200 most-starred candidates, and mentions are links to the repository we found, up to 50 per site, so both counts are a floor.

  • Used alongsideProjects with it also use add-new-model, azsdk-common-sdk-breaking-change and 9 more.

    Other files people use alongside this one.

    Files found in the same public projects as a version of this one, more often than they turn up anywhere else. Each project counts once, large collections count for less, and this file's own repository is left out.
    • PydanticSkill

      add-new-model

      Add support for a newly-released language or image generation model in pydantic-ai (e.g. openai:gpt-5.6, anthropic:claude-sonnet-5, openai:gpt-image-2). Use when a provider ships a new model id and you need to wire literals, profile flags, adapters, and tests to recognize it. Handles SDK-lag, gateway list conventions, capability probing, and direct image-model geometry.

      Also in 9 projects that use this

    • Microsoft AzureSkill

      azsdk-common-sdk-breaking-change

      Detect and mitigate SDK Breaking changes for an SDK package which is generated from TypeSpec. WHEN: "Detect SDK breaking changes for a service", "Detect SDK breaking changes for an SDK package", "Detect and mitigate SDK breaking changes for a service", "Detect and mitigate SDK breaking changes for an SDK package". INVOKES: skill: azsdk-common-generate-sdk-locally; MCP tools: azure-sdk-mcp:azsdk_customized_code_update, azure-sdk-mcp:azsdk_package_detect_breaking_change.

      Also in 4 projects that use this

    • ww-w-aiSkill

      bkend-auth

      bkend.ai authentication guide. Signup, login, JWT tokens, sessions, role-based access control, and password management with bkend.ai BaaS. Triggers: bkend auth, bkend login, bkend signup, JWT, session, RBAC, password, bkend 인증, 로그인, 회원가입, bkend認証, ログイン, 新規登録, bkend认证, 登录, 注册, autenticacion bkend, authentification bkend, bkend-Auth Do NOT use for: data operations (use $bkend-data), file storage (use $bkend-storage).

      Also in 4 projects that use this

    • ww-w-aiSkill

      bkend-cookbook

      bkend.ai cookbook with step-by-step tutorials and example projects. Build a todo app, blog, e-commerce store, and more with bkend.ai BaaS. Triggers: bkend cookbook, bkend tutorial, bkend example, todo app, blog app, bkend 쿡북, bkend 튜토리얼, 예제 프로젝트, bkendクックブック, チュートリアル, bkend教程, 示例项目, tutorial bkend, tutoriel bkend, bkend-Tutorial, ricettario Do NOT use for: initial setup (use $bkend-quickstart), specific features (use $bkend-data/auth/storage).

      Also in 4 projects that use this

    • dzhngSkill

      close-spec

      When a spec under specs/<feature>/ is done shipping (a write-spec build, or any planned task that produced a spec), archive it to specs/done/ and rewrite it from a build-plan into a durable rationale — the why, the principles, the invariants — pointing back to the real code for the how. Use when implementation has landed and the plan no longer matches what shipped, or the user says a feature/spec is finished. Pairs with [write-spec](../write-spec/SKILL.md) (the plan this closes) and [review](../review/SKILL.md) (run before closing).

      Also in 4 projects that use this

    • dzhngSkill

      design-with-images

      Explore UI and visual design with image generation, then iterate the real implementation against the user-selected concept. Use when brainstorming visual directions, offering mockup variants, or implementing an approved generated design; do not stop at the mockups or the first code approximation.

      Also in 4 projects that use this

    • +5 more from ww-w-ai

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

No reviews yet

People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.

  • It worked
  • Partly
  • It didn't
What did you use it for? e.g. Reviewing pull requests in a Rails app

Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

Check your setup, free