jacobpevans/review-standards
code-standards/skills/review-standards/SKILL.md
Use when performing formal code review on PRs
$ install --global
skillsauthnpx skillsauth add jacobpevans/claude-code-plugins review-standardsInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 22, 2026, 7:48 PM42.1s1 file scanned
SKILL.md
- name:
- review-standards
- description:
- Use when performing formal code review on PRs
Code Review Standards
Review Focus Areas
When reviewing code, prioritize:
- Security vulnerabilities and hardcoded secrets
- Performance implications of algorithmic choices
- Maintainability and code clarity
- Test coverage and TDD compliance
- Documentation accuracy and completeness
- DRY violations and code duplication
- Standards compliance per code-quality-standards
PR Review Principles
- Be pragmatic: Perfect security that blocks all work is worse than reasonable security that enables productivity.
- Trust context: If a permission is requested for a legitimate workflow, assume good faith.
- Quantify risk: Ask "how often would this actually cause harm?" not "could this ever cause harm?"
Permission & Configuration Reviews
Focus on likely failures, not theoretical edge cases. Do not reject based on contrived scenarios unlikely in practice. Balance security with usability — overly restrictive permissions that impede workflows are themselves a failure.
Related Skills
- code-quality-standards (code-standards) — Use when writing or reviewing code and documentation
- pr-standards (git-standards) — PR & issue standards, PR guards, issue linking
- finalize-pr (github-workflows) — Manage your PR through the full author flow
Related Skills
jacobpevans/self-hosted-runners
documentation
VerifiedTrustedCommunity
Use when editing GitHub Actions workflow files (.github/workflows/*.yml) in JacobPEvans repos. Documents when to target self-hosted RunsOn runners vs GitHub-hosted runners, the v3 label catalog used across the org, the required github.run_id segment, and the GitHub App allowlist prereq.
2SKILL.mdUpdated May 16, 2026
jacobpevans/refresh-repo
testing
VerifiedTrustedCommunity
Check PR merge readiness, sync local repo, cleanup stale worktrees; optional cross-repo sweep and stale-branch prune modes
2SKILL.mdUpdated Apr 28, 2026
jacobpevans/rebase-pr
tools
VerifiedTrustedCommunity
Local rebase-merge workflow for pull requests with signed commits
2SKILL.mdUpdated Apr 28, 2026
jacobpevans/gh-cli-patterns
tools
VerifiedTrustedCommunity
Canonical reference for all gh CLI command shapes used by skills in this plugin. Defines the placeholder convention, allowed --json fields, GraphQL fallback rules, -f/-F/--raw-field flag semantics, the PR-readiness gate, code-scanning alert query, review-thread fetch/count/resolve mutations, and heredoc bodies. Prevents Unknown JSON field errors and divergent query shapes.
2SKILL.mdUpdated Apr 28, 2026