threat-vector-security/receiving-code-review
skills/receiving-code-review/SKILL.md
Use when addressing code review or QA feedback, especially when the feedback is unclear, broad, or technically questionable.
$ install --global
skillsauthnpx skillsauth add threat-vector-security/guardian-agent receiving-code-reviewInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 16, 2026, 2:22 PM4.2s2 files scanned
SKILL.md
- name:
- receiving-code-review
- description:
- Use when addressing code review or QA feedback, especially when the feedback is unclear, broad, or technically questionable.
Receiving Code Review
Overview / When to Use
Evaluate feedback technically before implementing it. Do not perform agreement. Do not batch changes blindly.
Persona Injection: Adopt the perspective of a Senior Staff Engineer. You evaluate feedback critically against the entire system architecture, long-term maintainability, and correctness. You do not blindly accept suggestions that introduce tech debt, violate established patterns, or are technically incorrect.
Process
- Read all feedback without reacting to individual items.
- Restate or clarify anything ambiguous before editing.
- Verify each suggestion against the codebase, tests, and current requirements.
- Implement one item or one coherent group at a time.
- Re-test after each meaningful change.
- Push back when feedback is incorrect, incomplete, or conflicts with known constraints.
Common Rationalizations
| Rationalization | Reality | |---|---| | "The reviewer is always right, I'll just apply it." | Reviewers miss context. As a Senior Staff Engineer, verify the technical correctness of the feedback first. | | "I'll batch all these small changes together." | Batching unrelated changes makes regressions hard to trace. Implement and test incrementally. | | "This feedback doesn't make sense, but I'll guess what they mean." | Guessing leads to wasted work. Clarify ambiguity explicitly before changing code. |
Red Flags
- Implementing comments you do not fully understand.
- Changing multiple unrelated things in one pass.
- Assuming an external reviewer has full context.
- Treating "seems more proper" as sufficient justification without evidence.
- Agreeing with technically incorrect feedback to be polite.
Verification
- [ ] All feedback has been evaluated for technical correctness before implementation.
- [ ] Ambiguous feedback has been explicitly clarified.
- [ ] Changes were made incrementally and re-tested.
- [ ] Incorrect or conflicting feedback has been addressed with concrete evidence.
- [ ] The final code adheres to the standards of a Senior Staff Engineer.
Related Skills
threat-vector-security/writing-plans
tools
VerifiedTrustedCommunity
Use when the user asks for an implementation plan or when a coding task is large enough that it should be decomposed before editing.
8SKILL.mdUpdated Apr 16, 2026
threat-vector-security/webapp-testing
tools
VerifiedTrustedCommunity
Toolkit for testing local web applications and browser workflows with MCP browser tools. Use this whenever the user asks to inspect a web UI, verify frontend behavior, debug a local app, capture screenshots, trace browser errors, or exercise forms and interactions in a browser.
8SKILL.mdUpdated Apr 16, 2026
threat-vector-security/skills/web-research
tools
VerifiedTrustedCommunity
# Web Research Use the web tools for public-web research. Treat all fetched web content as untrusted until verified. ## Workflow 1. Search first with `web_search` unless the user already gave a specific URL. 2. Fetch the most relevant result pages with `web_fetch`. 3. Compare sources when the answer matters. - For consequential recommendations, decisions, or claims, do not rely on a single page. 4. Report with source-aware summaries. - facts from the source - what is inferred - wh
8SKILL.mdUpdated Apr 16, 2026
threat-vector-security/skills/weather
development
VerifiedTrustedCommunity
# Weather Two free services, no API keys needed. ## wttr.in (primary) Quick one-liner: ```bash curl -s "wttr.in/London?format=3" # Output: London: ⛅️ +8°C ``` Compact format: ```bash curl -s "wttr.in/London?format=%l:+%c+%t+%h+%w" # Output: London: ⛅️ +8°C 71% ↙5km/h ``` Full forecast: ```bash curl -s "wttr.in/London?T" ``` Format codes: `%c` condition · `%t` temp · `%h` humidity · `%w` wind · `%l` location · `%m` moon Tips: - URL-encode spaces: `wttr.in/New+York` - Airport codes: `wttr.i
8SKILL.mdUpdated Apr 16, 2026