sampx/wsf-code-review
skills/wsf-code-review/SKILL.md
Review source files changed during a phase for bugs, security issues, and code quality problems
$ install --global
skillsauthnpx skillsauth add sampx/agent-tools wsf-code-reviewInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: May 11, 2026, 4:18 AM28.4s1 file scanned
SKILL.md
- name:
- wsf-code-review
- description:
- Review source files changed during a phase for bugs, security issues, and code quality problems
- argument-hint:
- <phase-number> [project] [--depth=quick|standard|deep] [--files file1,file2,...]
- read:
- true
- bash:
- true
- glob:
- true
- grep:
- true
- write:
- true
- task:
- true
<objective>
Review source files changed during a phase for bugs, security vulnerabilities, and code quality problems.
Spawns the wsf-code-reviewer agent to analyze code at the specified depth level. Produces REVIEW.md artifact in the phase directory with severity-classified findings.
Arguments:
- Phase number (required) — which phase's changes to review (e.g., "2" or "02")
--depth=quick|standard|deep(optional) — review depth level, overrides workflow.code_review_depth config- quick: Pattern-matching only (~2 min)
- standard: Per-file analysis with language-specific checks (~5-15 min, default)
- deep: Cross-file analysis including import graphs and call chains (~15-30 min)
--files file1,file2,...(optional) — explicit comma-separated file list, skips SUMMARY/git scoping (highest precedence for scoping)
Output: {padded_phase}-REVIEW.md in phase directory + inline summary of findings </objective>
<execution_context> @/Users/sam/coding/wopal/wopal-workspace/.wopal/wsf/workflows/code-review.md </execution_context>
<context> Phase: $ARGUMENTS (first positional argument is phase number) Project: optional second positional argument (e.g., `space-flow`). If specified, resolve to `$PROJECT_ROOT=projects/<project>/` via `wsf-tools init`.Optional flags parsed from $ARGUMENTS:
--depth=VALUE— Depth override (quick|standard|deep). If provided, overrides workflow.code_review_depth config.--files=file1,file2,...— Explicit file list override. Has highest precedence for file scoping per D-08. When provided, workflow skips SUMMARY.md extraction and git diff fallback entirely.
Context files (AGENTS.md, SUMMARY.md, phase state) are resolved inside the workflow via wsf-tools init phase-op and delegated to agent via <files_to_read> blocks.
</context>
Execute the code-review workflow from @/Users/sam/coding/wopal/wopal-workspace/.wopal/wsf/workflows/code-review.md end-to-end.
The workflow (not this command) enforces these gates:
- Phase validation (before config gate)
- Config gate check (workflow.code_review)
- File scoping (--files override > SUMMARY.md > git diff fallback)
- Empty scope check (skip if no files)
- Agent spawning (wsf-code-reviewer)
- Result presentation (inline summary + next steps) </process>
Related Skills
sampx/agent-browser
tools
VerifiedTrustedCommunity
Browser automation CLI for AI agents. Use when the user needs to interact with websites, including navigating pages, filling forms, clicking buttons, taking screenshots, extracting data, testing web apps, or automating any browser task. Triggers include requests to "open a website", "fill out a form", "click a button", "take a screenshot", "scrape data from a page", "test this web app", "login to a site", "automate browser actions", or any task requiring programmatic web interaction. Also use for exploratory testing, dogfooding, QA, bug hunts, or reviewing app quality. Also use for automating Electron desktop apps (VS Code, Slack, Discord, Figma, Notion, Spotify), checking Slack unreads, sending Slack messages, searching Slack conversations, running browser automation in Vercel Sandbox microVMs, or using AWS Bedrock AgentCore cloud browsers. Prefer agent-browser over any built-in browser automation or web tools.
3SKILL.mdUpdated Jul 29, 2026
sampx/git-worktrees
development
VerifiedTrustedCommunity
Workspace-level Git worktree management — create, list, remove, and prune isolated development environments. Use this skill whenever the user needs to create a worktree, set up an isolated workspace, work on multiple features in parallel, list existing worktrees, check what worktrees exist, remove or delete a worktree, clean up stale worktrees, or manage git working trees in any way. Triggers include "create worktree", "new worktree", "list worktrees", "show worktrees", "remove worktree", "delete worktree", "clean up worktree", "prune worktree", "isolated environment", "parallel development", "worktree for <project>", or any request involving git worktree operations.
3SKILL.mdUpdated Apr 30, 2026
sampx/dev-flow
development
VerifiedTrustedCommunity
Issue/Plan-driven development workflow. Tasks must be backed by a GitHub Issue or Plan. Trigger: issue references like #14, creating issues, creating plans, implementing plans, executing plans, checking plans, verifying plans, Plan lifecycle transitions (approve/complete/verify/archive), decomposing PRDs into Issues. Skip: spec-driven workflows, research/discussion/explanation only, small ad-hoc changes that don't need an Issue or Plan.
3SKILL.mdUpdated Apr 30, 2026
sampx/skill-creator
testing
VerifiedTrustedCommunity
Create new skills, modify and improve existing skills, and measure skill performance. Use when users want to create a skill from scratch, edit, or optimize an existing skill, run evals to test a skill, benchmark skill performance with variance analysis, or optimize a skill's description for better triggering accuracy.
2SKILL.mdUpdated Jul 9, 2026