.cursor/skills/review-workflow/SKILL.md
Code review workflow - Review → (optional auto-fix) → Verify. Use when user invokes /review command, before committing, after finishing a feature and before creating a PR, or for a quick sanity check on a specific file or directory.
npx skillsauth add softmg/product-tracker review-workflowInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
Purpose: Run reviewer → optional debugger fix → test-runner verification for targeted code review.
Before running workflow steps:
mcp__serena__check_onboarding_performed.mcp__serena__onboarding.mcp__serena__get_symbols_overview and mcp__serena__find_symbol.mcp__serena__find_referencing_symbols before renames, moves, deletions, or behavior-affecting edits.mcp__serena__safe_delete_symbol.flowchart TD
Scope[Resolve scope] --> Review[reviewer: check code]
Review -->|No issues| Done[Report: clean]
Review -->|Suggestions/Quality only| Ask{User wants to fix?}
Ask -->|No| Report[Report findings]
Ask -->|Yes| Fix[debugger: apply fixes]
Review -->|Critical issues| Fix
Fix --> Verify[test-runner: linter + tests]
Verify -->|Pass| Summary[Report: fixed]
Verify -->|Fail| Debug2[debugger: fix failures]
Debug2 --> Verify
/review # Staged changes (pre-commit)
/review src/components/ # Specific directory
/review src/auth.ts # Single file
/review --staged # Explicitly staged changes only
/review --last-commit # Changes in last commit
If no scope given, default to staged changes (git diff --staged).
If nothing staged, fall back to recent changes (git diff HEAD).
If still nothing, ask the user to specify files.
REQUIRED: Call Task tool with subagent_type="reviewer"
Task(
subagent_type="reviewer",
prompt="Review the following: [scope/files/staged changes].
Check for: bugs, security issues, DRY violations, SOLID violations,
complexity, naming, error handling, TypeScript issues.
Categorize findings as Critical / Quality / Suggestion.
Include specific file paths and line numbers."
)
Wait for completion. Extract findings by category.
If NO issues found → report ✅ to user and stop.
If only Suggestions/Quality (non-critical) → report findings to user, ask:
If Critical issues found → always proceed to Step 2 (ask user first if scope is large).
Only run if: critical issues found, OR user chose to fix quality issues.
REQUIRED: Call Task tool with subagent_type="debugger"
Task(
subagent_type="debugger",
prompt="Fix the following code review issues:
Critical issues: [list from Step 1]
Quality issues (if user approved): [list from Step 1]
Files: [list of files]
Fix each issue. Do NOT refactor beyond what's needed to fix the reported problems.
Do NOT add new features."
)
Wait for completion. Extract what was fixed.
Only run if Step 2 ran (fixes were applied).
REQUIRED: Call Task tool with subagent_type="test-runner"
Task(
subagent_type="test-runner",
prompt="Verify fixes did not break anything.
Files changed: [list from Step 2]
Fixes applied: [summary from Step 2]
Run: linter + tests."
)
Task tool with the correct subagent_typeAfter each subagent call, report to the user:
**Reviewing: staged changes (3 files)**
→ reviewer: ⚠️ Issues found
- 🔴 1 critical: null pointer in user.ts:45
- 🟡 2 quality: DRY violation, magic number
- 🟢 1 suggestion: memoization opportunity
→ debugger: ✅ Fixed critical + quality issues
→ test-runner: ✅ All passing
Summary: 3 issues fixed. 1 suggestion left for later.
Good for:
NOT good for:
/audit)/refactor)/implement or /orchestrate)Good for /review:
git diff --staged before committingNot good for /review (use /audit):
documentation
Task tracking and plan management. Used by planner to create plans and persist tasks, by orchestrator to read tasks and update progress, by documenter to create completion reports, and by any agent to log non-critical issues.
development
Create, edit, evaluate, and package agent skills. Use when building a new skill from scratch, improving an existing skill, running evals to test a skill, benchmarking skill performance, optimizing a skill's description for better triggering, reviewing third-party skills for quality, or packaging skills for distribution. Not for using skills or general coding tasks.
development
Simple implementation workflow - code, test, document. Use when user invokes /implement, wants to create code with automatic testing and documentation, or for simple single-purpose tasks that don't need planning.
development
Security best practices covering authentication, input validation, API security, secrets management, data protection, and OWASP Top 10. Use when implementing auth flows, API endpoints, file uploads, or any feature touching passwords, tokens, PII, or sensitive data. Do NOT use for code style reviews or architecture decisions.