FrancoStino/debate-review
bundled-skills/debate-review/SKILL.md
Two-model debate review of a GitHub PR, GitLab MR, Azure DevOps PR, or local working tree, posted as inline comments or printed. Use for any PR/MR review request, or a local review before a PR exists.
$ install --global
skillsauthnpx skillsauth add FrancoStino/opencode-skills-antigravity debate-reviewInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Aug 30, 2026, 2:10 AM37.8s6 files scanned
SKILL.md
- name:
- debate-review
- description:
- Two-model debate review of a GitHub PR, GitLab MR, Azure DevOps PR, or
- risk:
- safe
- category:
- code-quality
- source:
- https://github.com/amElnagdy/review-skills
- source_repo:
- amElnagdy/review-skills
- source_type:
- community
- date_added:
- 2026-08-26
- license:
- MIT
- license_source:
- https://github.com/amElnagdy/review-skills/blob/master/LICENSE
- compatibility:
- Requires Node 18+, Git 2.31+ for Azure DevOps, `gh` (GitHub), `glab`
- version:
- 0.2.0
debate-review
When to Use
- You have a GitHub PR or GitLab MR that needs a thorough pre-merge review.
- You want a two-model debate (main reviewer vs. debate reviewer) to catch blind spots before posting inline comments.
Two models argue before anything is posted. A main reviewer finds issues. A debate reviewer tries to
knock them down and may add its own. The main reviewer then makes the final call, and one review with
inline comments lands on the PR or MR. It posts from the user's own gh, glab or az account as a
non-approval review or comment. It never approves and never requests changes.
You are the orchestrator. You run one command and relay the result. You do not review the diff yourself, and you do not touch the PR.
Run it
node "<skill-dir>/scripts/review-pr.mjs" --local [--base <ref>]
node "<skill-dir>/scripts/review-pr.mjs" <pr-url | number> [--dry-run]
- If the user wants a review and there is no PR/MR URL, run
--localfrom the repo (or--repo-dir). Do not invent a URL. Relay stdout.--localnever talks to a forge and rejects non-UTF-8 Git paths rather than decoding them lossily. <pr-url>is a GitHub/pull/N, GitLab/-/merge_requests/N, or Azure DevOps/_git/<repo>/pullrequest/NURL (dev.azure.comor the legacy*.visualstudio.com). A bare number resolves against the cwd'sorigin, including Azure DevOps https andssh.dev.azure.com:v3/remotes.--dry-runprints a live PR review instead of posting it. It does not combine with--local.- Azure DevOps needs
azlogged in (az login) with access to the project. No extension is required, the script talks to the REST API throughaz rest. A review there is N inline comment threads plus one closed summary thread, since Azure DevOps has no single review object; the alert blockquotes render as plain quotes, which still read. - The reviewers are two delegate-skills lanes,
review-mainandreview-debate. If either is missing the script says so. Add them withdelegate-setup. Pick two different implementers, since the debate is only worth something when the second model doesn't share the first one's blind spots (mainclaudeorgrok, debatecodexat high effort is a good pair). For a one-off, pass--main <implementer>or--debate <implementer>. Only implementers whose relay has--read-onlyare accepted. These two lanes belong to the reviewer. Don't point them at a lane you use for other work, such as a plan-debate lane. - Exit code
3means this head sha already has a debate-review. Re-run with--forceto post again. - A run takes minutes, since it is two or three implementer sessions back to back. Run it in the background and report the printed URL when it finishes. Don't poll tightly.
All flags: --help. Contracts: references/schema.md. What gets posted:
references/comment-format.md. The reviewer briefs live in assets/prompts/
and the script fills them in; you don't need to read them.
After it posts
Each posted comment carries a <!-- debate-review:<id> status=... --> marker. babysit-pr handles
GitHub and GitLab rounds (verify, fix blockers, reply, resolve). It cannot harvest Azure DevOps yet,
so relay Azure findings directly to the user. Don't act on the findings yourself unless asked.
Artifacts
~/.cache/debate-review/<owner>__<repo>/<N>/<head>/ holds run.json (all three documents, timings,
what was posted) plus main/, debate/, and final/, each with the brief sent and the relay's
result.json.
--local writes under ~/.cache/debate-review/local/<repo>/<branch>/<head>/ instead.
Limitations
- Requires
delegate-skillswithreview-mainandreview-debatelanes and authenticatedgh/glab. - Docs-only import — executable helpers (
scripts/) not included; see upstream for full runtime. Posts a singleCOMMENTreview only.
Adapted from amElnagdy/review-skills (MIT) — docs-only, runtime not bundled.
Related Skills
FrancoStino/llm-security
tools
VerifiedTrustedCommunity
Authorized security assessment of LLM applications and AI agents: prompt injection, tool abuse, RAG exposure, memory poisoning, system-prompt extraction, and agent-compliance engineering per OWASP LLM/ASI Top 10.
68SKILL.mdUpdated Aug 30, 2026
FrancoStino/liuguang-banlan-ui
development
VerifiedTrustedCommunity
Builds two parameterized UI modes—流光溢彩白 (iridescent white) and 五彩斑斓黑 (colorful black)—with OKLCH, WebGL/CSS fallback, vision gating, screenshot QA, and total/per-color intensity reports. Use when a UI request names either mode or needs measured color parameters.
68SKILL.mdUpdated Aug 30, 2026
FrancoStino/kimi-delegate
tools
VerifiedTrustedCommunity
Delegate coding tasks to the Kimi Code CLI (`kimi`) only when the user explicitly requests it, while the orchestrator retains review and landing responsibility.
68SKILL.mdUpdated Aug 30, 2026
FrancoStino/js-reverse
development
VerifiedTrustedCommunity
Front-end JavaScript reverse engineering: locate signature chains, analyze encrypted request parameters, sample runtime behavior, and reproduce logic locally in Node for evidence-based output.
68SKILL.mdUpdated Aug 30, 2026