cuioss/persona-code-reviewer
marketplace/bundles/plan-marshall/skills/persona-code-reviewer/SKILL.md
Code-review persona that composes other personas as evaluation lenses
$ install --global
skillsauthnpx skillsauth add cuioss/plan-marshall persona-code-reviewerInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Jul 16, 2026, 3:13 AM143.0s2 files scanned
SKILL.md
- name:
- persona-code-reviewer
- description:
- Code-review persona that composes other personas as evaluation lenses
- user-invocable:
- false
- mode:
- knowledge
- implements:
- persona
- composes:
- [plan-marshall:persona-implementer, plan-marshall:persona-module-tester, plan-marshall:persona-integration-tester, plan-marshall:persona-documenter, plan-marshall:persona-security-expert]
- priming_preamble:
- Adopt a reviewer's stance: read for correctness and intent, not authorship.
Persona: Code Reviewer
REFERENCE MODE: This skill is a persona shell. It declares the code-reviewer evaluator identity and the composition it resolves to; it carries no executable workflow of its own.
The code reviewer is a meta/evaluator persona — it has no work-activity profile of its own. Instead it composes other personas as evaluation lenses, reading a change through each composed persona's standards to judge correctness and intent. Because it owns no primary work-activity profile, it omits the profiles: field entirely.
Composition
The persona resolver (manage-personas resolve) flattens this persona's composition DAG into a deduped skills[]:
- Base —
plan-marshall:persona-plan-marshall-agent(the unconditional foundational base every persona inherits). - Composed personas (lenses) — the work personas whose standards the reviewer reads through, declared in the
composes:frontmatter (persona-implementer,persona-module-tester,persona-integration-tester,persona-documenter,persona-security-expert); the resolver recurses into each composed persona's refs and profiles, then dedups.
Profiles
None. A meta/evaluator persona that composes other personas as lenses omits the profiles: field — it is never reverse-looked-up from a task's work-activity profile.
Quality Verify Profile
This persona provides the quality verify profile for the ext-point-verify findings-pipeline stage, mirroring the role persona-security-expert plays for the security profile. The adversarial-refute methodology lives in standards/adversarial-refute.md: when a producer declares metadata.verification_profile: quality, the orchestrator's verify pre-stage resolves that profile key to this persona and loads that standard in-context to refute each candidate quality/structural/documentation finding before triage. Confirmed findings flow on to ext-triage-* unchanged; refuted false positives close rejected and never reach triage. The stage placement and rejected semantics are owned by the ext-point-verify contract — see that document.
Related
standards/adversarial-refute.md— Thequalityverify-profile methodology this persona provides, implementingext-point-verifyas a verify profile (the quality counterpart to the security persona's role)extension-api:ext-point-verify.md— The verify extension-point contract the quality profile implements
Related Skills
cuioss/parse-rewrite-log
development
VerifiedTrustedCommunity
Domain-owned OpenRewrite log-line finding parser for the java-cui domain — parses the
5SKILL.mdUpdated Jul 28, 2026
cuioss/search-markers
development
VerifiedTrustedCommunity
Domain-owned OpenRewrite marker detection for the java-cui domain — scans Java/Kotlin sources for cui-rewrite TODO markers, categorizes them by recipe, and fails the gate on any detected marker
5SKILL.mdUpdated Jul 23, 2026
cuioss/manage-build-server
development
VerifiedTrustedCommunity
Operator control surface for the marshalld build server — enrol/drop a project in the machine-global registry (the opt-in enable signal and anti-laundering wall), manage the daemon lifecycle (start, stop, drain, status, install, upgrade) version-pinned to the verified bundle copy, and inspect the daemon's per-project interaction-audit log (read-only)
5SKILL.mdUpdated Jul 19, 2026
cuioss/build-server-client
tools
VerifiedTrustedCommunity
The tiny build-consumption client for the marshalld build server — submit a build job, bounded long-poll for its result, ping the daemon identity, and preflight registry-plus-liveness in one call; consumption only, never provisioning or enrolment
5SKILL.mdUpdated Jul 19, 2026