review-code
Skill521 starsChanged 15 days agoMITView on GitHub
Review a branch diff against repository rules, with required security and license reviews. Report cited violations and offer scoped fixes when the user requests a code review.
We split this skill into the rules it gives an agent
12 rules. 0 are common, 10 are distinctive, and 2 are very specific to this project.
0
Common
Most of the 55 edited versions we read keep these.
10
Distinctive
This author's own choices. Worth a look.
2
Very specific
Tied to their project's names, files or tools. Probably skip.
- Common
- Distinctive
- Very specific
- Very specific: line 14
Read git diff --name-only <base>...HEAD and git diff <base>...HEAD.
- Distinctive: line 15
Read AGENTS.md, including Git rules.
- Distinctive: line 20
Check required utilities, file placement, names, imports, and types.
- Very specific: line 21
Check testIDs and Maestro flows for new screens, and tests beside new components.
- Distinctive: line 22
Check branch names and commit messages against Git rules.
- Distinctive: line 28
Read and run the security review.
- Distinctive: line 29
Read and run the license review.
- Distinctive: line 30
Use the same base and head as this review for both.
- Distinctive: line 35
Do not treat a missing or incomplete review as a pass.
- Distinctive: line 47
Do not claim unrun checks passed.
- Distinctive: line 54
Run relevant checks for non-trivial edits.
- Distinctive: line 58
Do not commit, push, or open a PR unless requested.
“Common” is measured: kept by at least 6 in 10 of the 55 edited versions of this file we could read. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.
Files
Review Code
Review the branch diff against repository rules. A review request does not authorize edits.
Inspect
- Choose the base from the branch table:
devfor work branches,mainfor hotfixes. Ask when the branch prefix does not identify one. - Read
git diff --name-only <base>...HEADandgit diff <base>...HEAD. - Read
AGENTS.md, including Git rules. - Exclude
package-lock.json,node_modules/,ios/,android/,dist/, andcoverage/from this rules review. Report excluded scope.
Review
- Check required utilities, file placement, names, imports, and types.
- Check
testIDs and Maestro flows for new screens, and tests beside new components. - Check branch names and commit messages against Git rules.
- Report only issues introduced by the diff. Do not flag unrelated existing code.
- Cite a rule for each violation. Label uncertainty as advisory. Label any personal suggestion as outside the rules.
Required Reviews
- Read and run the security review.
- Read and run the license review.
- Use the same base and head as this review for both. Exclude unrelated uncommitted work.
- Include both review results in the report. Record findings, limitations, and any dependencies or assets that could not be checked. If license review finds no relevant changes, state that explicitly.
- Recheck affected findings if the diff changes after review. Do not reuse results from an older diff.
Complete both reviews before reporting. Do not treat a missing or incomplete review as a pass.
Report
Lead with the important findings. For each finding, give the file and line, rule heading, observed behavior, required behavior, and suggested fix.
- Separate violations from advisories.
- State the number of files reviewed and findings.
- Say explicitly when no violations were found.
- Include at most two useful examples of compliance.
- Do not claim unrun checks passed.
Fix
- Offer to fix violations one at a time. Do not auto-apply advisories.
- For “yes,” make the smallest approved edit. For “no,” leave it.
- For “skip rest,” stop offering fixes.
- Run relevant checks for non-trivial edits. Check that the chosen fix works without restarting the full review.
- Report fixed and skipped violations, remaining advisories, and the next action.
Respect an explicit request to fix a defined set without repeating approval. Do not commit, push, or open a PR unless requested.
Other versions66 projects use a version of this.
Word for word · 0
None found.
Edited · 0
None found.
Wrote their own version · 66
- penpot/penpot★ 62ksame name
- pnpm/pnpm★ 37ksame name
- verdaccio/verdaccio★ 18ksame name
- NVIDIA-NeMo/DataDesigner★ 2.4ksame name
- OpenAEV-Platform/openaev★ 1.8ksame name
- bazel-contrib/rules_python★ 687same name
- ankitvgupta/exo★ 496same name
- ankitvgupta/mail-app★ 496same name
- ninehills/skills★ 280same name
- hmislk/hmis★ 236same name
56 more not listed
How matches are found. Word for word: the exact same text. Edited: shares passages with this file (“99% same” means 99% of its five-word phrases also appear here; 10% or more counts). Their own version: similar meaning, or, weakest, the same name. We can’t tell which project had it first. Projects are counted among the 200 most-starred candidates, and mentions are links to the repository we found, up to 50 per site, so both counts are a floor.
Used alongsideProjects with it also use clear-caches, electron-devtools-testing and 10 more.
Other files people use alongside this one.
Files found in the same public projects as a version of this one, more often than they turn up anywhere else. Each project counts once, large collections count for less, and this file's own repository is left out.
mrdulasolutionsSkillclear-caches
Clear extension caches, analysis data, and drafts from the database. Use when testing sender lookups, analysis, or draft generation from a clean state.
Also in 3 projects that use this
mrdulasolutionsSkillelectron-devtools-testing
Test the Electron app interactively using Chrome DevTools Protocol. Use when the user asks to test, verify, or interact with the running app via browser automation.
Also in 3 projects that use this
ba0918Skillreview-deps
A focused read-only review that treats manifests, lockfiles, and dependency diffs as first-class input and evaluates known vulnerabilities and supply chain signals. Use when the user says "review the dependencies", "look at the dependency vulnerabilities", "check the lockfile", "supply chain risk", "organize the npm audit output", "detect typosquats", "dependency health", or "review-deps". Its subject is the health of the dependencies, not test quality or code quality.
Also in 3 projects that use this
fabianbothSkillreviewloop
Run the autonomous review loop to address PR comments, fix issues, and push changes iteratively until all comments are resolved.
Also in 3 projects that use this
sarfraznawaz2005Skilltake-screenshots
A Windows screenshot skill that provides both programmatic full-screen capture and interactive region selection.
Also in 3 projects that use this
PydanticSkillreview-security
Security review of the current branch against its merge base — sandbox escapes, memory errors, panics and resource-limit bypasses. Use when reviewing changes for security risk, or before merging anything touching the heap/ module, path_security.rs, the wire protocol or the pool.
Also in 6 projects that use this
- +1 more from mrdulasolutions
In this repository5 other files it gives its agents.
- AGENTS.mdAGENTS.md
- CLAUDE.mdCLAUDE.md
- init-projectSkill
- manage-docsSkill
- manage-prsSkill
Does it work?
Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.
Reviews can't be read right now.
Your trail
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Now do this for your own.
Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

