alexei-led/reviewing-code
dist/claude/dev-flow/skills/reviewing-code/SKILL.md
Use when reviewing changed code, PRs, diffs, or specific files. Finds evidence-backed defects in security, correctness, tests, reliability, performance, maintainability, and docs. Supports quick, standard, deep, team, and external-review modes. NOT for repo-wide architecture review, general codebase exploration, fixing issues (use fixing-code), improving tests without a code review (use improving-tests), or applying refactors (use refactoring-code).
$ install --global
skillsauthnpx skillsauth add alexei-led/claude-code-config reviewing-codeInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Jul 18, 2026, 3:50 AM83.8s1 file scanned
SKILL.md
- {"allowed-tools":
- ["Task","TaskOutput","TaskCreate","TaskUpdate","TaskList","AskUserQuestion","Read","Grep","Glob","LS","Bash(git *)","Bash(gh pr *)","Bash(gh api *)"],"argument-hint":"[deep] [team] [external]","context":"fork","description":"Use when reviewing changed code, PRs, diffs, or specific files. Finds evidence-backed defects in security, correctness, tests, reliability, performance, maintainability, and docs. Supports quick, standard, deep, team, and external-review modes. NOT for repo-wide architecture review, general codebase exploration, fixing issues (use fixing-code), improving tests without a code review (use improving-tests), or applying refactors (use refactoring-code).","name":"reviewing-code","user-invocable":true}
Code Review
Platform workflow additions
Track phases with TaskCreate and TaskUpdate when available:
- Scope resolved.
- References loaded.
- Evidence gathered.
- Findings consolidated.
- Report emitted.
Arguments
If $ARGUMENTS is passed, interpret these keywords:
quick: changed lines plus direct context; security and correctness only.deep: all dimensions from the host skill.team: parallel reviewer sub-tasks, then one consolidated report.external: second-model or external-AI review; only when explicitly requested.
Default is standard. Never run external implicitly.
Scope prompt
When scope is missing, use AskUserQuestion with header Review scope and these options:
- Uncommitted changes.
- Branch compared to default branch.
- Specific files or PR diff supplied by the user.
Team mode
Run sub-tasks as the read-only reviewer role. Split by review dimension or file group. Each sub-task must use the host skill's severity rubric and return only evidence-backed findings.
Consolidate before reporting:
- Deduplicate by
file:lineplus claim. - Keep the highest severity only when the evidence matches the rubric.
- Move unsupported or disputed claims to Needs review.
- Prefix confirmed findings with
[Flagged by: <dimension or file group>]only when it helps explain coverage.
External mode
When external is requested, spawn configured external reviewer bridges in parallel if available. Do not depend on a specific bridge or model.
Report the result explicitly:
External review: completedwhen it ran.External review: unavailablewhen no bridge exists.External review: skippedwhen privacy, missing scope, or tooling prevents it.
Apply the host severity rubric to external output. Do not include external claims as confirmed findings unless the local review can verify the evidence.
Historical context
If memory search is available, query past observations for files in scope. Use it only to avoid repeating already-litigated findings. Do not treat memory as evidence for a new finding.
Related Skills
alexei-led/spec-flow
tools
VerifiedTrustedCommunity
Use when planning, executing, checkpointing, finishing, or inspecting lightweight spec-driven work. Runs one task at a time using `.spec/` markdown files and the bundled `specctl` helper. NOT for broad product discovery beyond a short requirement interview. NOT for generic implementation planning that does not read or write `.spec/` files.
35SKILL.mdUpdated Jul 18, 2026
alexei-led/writing-web
development
VerifiedTrustedCommunity
Simple web development with HTML, CSS, JS, and HTMX. Use when working with .html, .css, or .htmx files, web templates, stylesheets, or vanilla JS scripts. NOT for React/Vue/Angular (use writing-typescript) or Node.js backends.
35SKILL.mdUpdated Jul 18, 2026
alexei-led/writing-typescript
tools
VerifiedTrustedCommunity
Idiomatic TypeScript development. Use when writing TypeScript code, Node.js services, React apps, or TypeScript design advice. Emphasizes strict typing, boundary validation, composition, fast feedback, behavior tests, and project-configured tooling. NOT for Go, Python, Rust, plain HTML/CSS/JS, or server-rendered templates (use writing-web).
35SKILL.mdUpdated Jul 18, 2026
alexei-led/writing-shell
tools
VerifiedTrustedCommunity
Idiomatic shell development for POSIX sh, Bash, Zsh, Fish, hooks, CI shell steps, and scriptable CLI glue. Use when writing or changing `.sh`, `.bash`, `.zsh`, `.fish`, `.bats`, shell functions, shell pipelines, CI `run:` shell bodies, or command-runner recipes. Emphasizes portability, quoting, safe filesystem/process handling, non-TUI CLI tools, ShellCheck, shfmt, Bats, and ShellSpec. NOT for Python, Rust, TypeScript, Go, web code, or GitHub Actions workflow/job/permissions semantics; use operating-infra.
35SKILL.mdUpdated Jul 18, 2026