# Review Changes

> >-

- **Type:** Skill
- **Install:** `agentstack add skill-arasz-ai-badger-review-changes`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [Arasz](https://agentstack.voostack.com/s/arasz)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [Arasz](https://github.com/Arasz)
- **Source:** https://github.com/Arasz/ai-badger/tree/main/.ai-badger/skills/review-changes
- **Website:** https://github.com/Arasz/ai-badger

## Install

```sh
agentstack add skill-arasz-ai-badger-review-changes
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Review changes

Rank changed units by blast radius, then check whether the riskiest ones are actually tested. This
skill answers "is this safe to merge" — not "does this follow style", which is
`code-review-checklist`'s job.

The workflow derives from the skill templates the `code-review-graph` project auto-installs
(MIT, © 2026 Tirth Kanani), rewritten here to be tool-agnostic: every step carries a baseline
that needs no graph server.

## Steps

1. **Establish what changed and against which base.**
   Accelerated: a code-graph change-detection call (e.g. `detect_changes`-shaped; discover the
   real tool name from the server's own listing) already carries risk scores. Baseline: `git diff
   ...HEAD --stat` plus `git log ..HEAD --oneline`; if the base is ambiguous, ask, or
   default to the merge base with the trunk branch.

2. **Rank changed units by blast radius**, not diff size — a 3-line change to a shared auth check
   outranks a 200-line change to one leaf component.
   Accelerated: an impact-radius / affected-flows call (e.g. `get_impact_radius`-shaped) returns
   callers, callees, and affected execution paths per unit in one query. Baseline: grep each
   changed symbol for callers (or the IDE's find-references) and note whether any sits on a
   critical path — auth, payment, data-write, public API surface.

3. **Check test coverage for every high-risk unit only** — not the whole diff.
   Accelerated: a tests-for query (e.g. `tests_for`-shaped, via a graph-query call). Baseline:
   search the test tree by the project's own naming convention (`.ai-badger/config.json`'s
   `commands.test` names the runner), then run that command and confirm the relevant test would
   fail if the change were reverted — a test file existing is not coverage.

4. **Report grouped by risk**, high to low. For any high-risk unit with no covering test, name the
   specific missing test case (input, expected behavior) — never write "consider adding tests".
   That sentence is the failure this skill exists to prevent: it reads as review but commits to
   nothing.

## Output format

For each risk tier (high / medium / low): what changed and why it's that tier (the caller/flow
that makes it risky, not "it's core"); test status — covered (name the test), partial (name the
gap), or untested with the specific missing case; overall recommendation — safe to merge / merge
with tracked test debt / block.

## Gotchas

No environment-specific gotchas known.

## Red flags — STOP

- Ranking by diff size instead of blast radius
- "Consider adding tests" without naming the missing case
- Reporting coverage from a test file's existence without having run it
- Skipping step 1's base — reviewing against the wrong diff is worse than not reviewing

Non-vacuous means every high-risk untested unit is named individually with its missing test case
attached — a report that names an untested high-risk item without one has not finished this skill.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [Arasz](https://github.com/Arasz)
- **Source:** [Arasz/ai-badger](https://github.com/Arasz/ai-badger)
- **License:** MIT
- **Homepage:** https://github.com/Arasz/ai-badger

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-arasz-ai-badger-review-changes
- Seller: https://agentstack.voostack.com/s/arasz
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.