igmarin/rails-code-review
skills/code-quality/rails-code-review/SKILL.md
Reviews Rails pull requests, focusing on controller/model conventions, migration safety, query performance, and Rails Way compliance. Covers routing, ActiveRecord, security, caching, and background jobs. Use when reviewing existing Rails code for quality, conducting a PR review, or doing a code review on Ruby on Rails (RoR) code.
$ install --global
skillsauthnpx skillsauth add igmarin/rails-agent-skills rails-code-reviewInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: May 7, 2026, 2:55 AM123.2s4 files scanned
SKILL.md
- name:
- rails-code-review
- license:
- MIT
- description:
- >
- version:
- 1.0.0
- user-invocable:
- true
Rails Code Review (The Rails Way)
When reviewing Rails code, analyze it against the following areas. When writing new code, follow rails-code-conventions and rails-stack-conventions.
Core principle: Review early, review often. Self-review before PR. Re-review after significant changes.
HARD-GATE: After implementation (before PR)
After green tests + linters pass + YARD + doc updates:
1. Self-review the full branch diff using the Review Order below.
2. Fix Critical items; resolve or ticket Suggestion items.
3. Only then open the PR.
generate-tasks must include a "Code review before merge" task.
Quick Reference
| Area | Key Checks |
|------|------------|
| Routing | RESTful, shallow nesting, named routes |
| Controllers | Skinny, strong params, scoped before_action |
| Models | Structure order, enums, scopes, inverse_of |
| Queries | N+1 prevention, exists?, find_each batches |
| Migrations | Reversible, concurrent indexes on large tables |
| Security | Strong params, no html_safe on user input |
| Jobs | Idempotent, retriable, appropriate backend |
Review Order
Work through the diff in this sequence. Detailed criteria: REVIEW_CHECKLIST.md.
Configuration → Routing → Controllers → Views → Models → Associations → Queries → Migrations → Validations → I18n → Sessions → Security → Caching → Jobs → Tests
Edge case handling:
- Empty diff: State "No code changes to review" and stop.
- Large diff (>50 files): Prioritize Critical checks first; sample key files for Suggestion items.
- Single file: Apply all relevant review areas to that file.
- Test-only changes: Focus on test quality and organization.
Severity Levels
Use only these labels:
Critical— security, data loss, crash, or Always Critical (see below). Block merge.Suggestion— conventions, performance, or "Thin controller -> fat model" anti-patterns.Nice to have— small style or micro-optimization.
Always Critical (flag every occurrence):
params.require(...).permit!— privilege escalationhtml_safeorrawon user-supplied content — XSS- Business logic inside a controller action — pricing, tax, or domain calculation
- Unparameterized / string-interpolated SQL — injection
- Destructive migration without a safe path on large tables
Output Style
Group findings by severity. See assets/examples.md for JSON/PR comment shapes.
## Review — <PR title or area>
### Critical
- [path/to/file.rb:LINE] (Area) One-line risk. **Mitigation:** concrete next step.
### Suggestion
- [path/to/file.rb:LINE] (Area) ... **Mitigation:** ...
**Actions required:** <one line per severity level found — e.g. Critical -> block merge>
Tag (Area) from: Controllers, Routing, Views, Models, Queries, Migrations, Validations, Security, Caching, Jobs, Tests. Cover ≥4 distinct areas if applicable.
Re-review Criteria
Re-diff the branch after:
- Any Critical fix (mandatory).
- >3 Suggestion fixes or any architecture change.
- Changes affecting queries, auth, or migrations.
Integration
| Skill | When to chain | |-------|---------------| | rails-review-response | When receiving feedback and deciding implementation | | rails-architecture-review | When review reveals structural problems | | rails-migration-safety | When reviewing migrations on large tables |
Assets
- assets/checklist.md
- assets/examples.md
Related Skills
igmarin/rails-agent-skills
development
VerifiedTrustedCommunity
Entry point for Rails development workflows covering TDD, RSpec, Service Objects, DDD, GraphQL, Engines, and Code Quality. Use when the user asks about Ruby on Rails development patterns, needs RSpec test suites generated, wants service objects scaffolded, is setting up GraphQL schemas, performing Rails code review, refactoring .rb files, working with domain-driven design, implementing background jobs, conducting Rails security checks, or building Rails engines. Generates RSpec tests, structures service objects, enforces TDD workflows, configures GraphQL schemas, and coordinates domain-driven design patterns. Trigger keywords: Rails, RSpec, TDD, Rails testing, Rails refactor, Rails API, Rails code review, domain driven design, service objects, GraphQL, Rails engine, Ruby, .rb, background jobs, Rails migrations, Rails security check.
21SKILL.mdUpdated May 18, 2026
igmarin/release-engine
development
VerifiedTrustedCommunity
Use when shipping a Rails engine gem — FIRST run full test suite (`bundle exec rspec`) and fix ALL failures, verify gemspec metadata and dependencies match tested Rails/Ruby versions, dry-run: `gem build *.gemspec && gem push --dry-run *.gem` and verify contents, generate CHANGELOG.md organized by category (added/changed/deprecated/removed/fixed), produce step-by-step upgrade notes with before/after code, set semantic version in `lib/[engine_name]/version.rb`, document deprecations with migration paths, load release assets conditionally and state which one informed the output. Trigger words: version bump, changelog, deprecation, gemspec, upgrade, release, publish gem, ship gem.
21SKILL.mdUpdated May 9, 2026
igmarin/tdd
development
VerifiedTrustedCommunity
Orchestrates the full Rails TDD cycle with hard gates: test MUST exist, be run, and FAIL for the correct reason (e.g. undefined method, not syntax error) before any implementation code — propose minimal implementation and wait for user approval → verify test PASSES → run full suite with rubocop, brakeman, rspec all green → produce YARD documentation and self-reviewed PR; phases context/test design→implementation→iterate→finish. Use when practicing test-driven development, red-green-refactor, TDD workflow, writing tests before code, adding tests first, or building a Rails feature where specs must gate implementation.
19SKILL.mdUpdated Jun 5, 2026
igmarin/setup
development
VerifiedTrustedCommunity
Complete Rails project setup loop with hard gates: verify Ruby version matches .ruby-version, Bundler installed, database connection successful, all env vars loaded, and ALL external CI actions pinned to immutable commit SHAs (never mutable tags like @v4) → configure CI/CD pipeline with linting, testing, and security scanning → validate end-to-end with bundle install, db:create, db:migrate, rspec, and write SETUP_CHECKLIST.md; phases context/onboarding→CI/CD configuration→environment validation. Use when starting a new Rails project, running `rails new`, configuring a Gemfile or .ruby-version, setting up a development environment, or wiring up CI/CD for a Ruby on Rails app. Trigger: setup project, new Rails app, configure CI/CD, dev environment setup, rails new, Gemfile setup, .ruby-version, Ruby on Rails project bootstrap.
19SKILL.mdUpdated Jun 5, 2026