Install
$ agentstack add skill-eai-org-agent-toolkit-fresh-eyes-review ✓ scanned · ✓ verified — works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
About
Fresh-eyes review
A context that produced a change reads its intent, not its text, so same-context review misses what a fresh reader would catch. The fix is procedural: a reviewer whose context holds only the artifacts.
Workflow
- Resolve the inputs. The changeset: the uncommitted git changes by default, or whatever the
invocation names instead — a branch, a commit, a diff range, a draft vs its original. Alongside it, a short statement of what the change is supposed to achieve, when one exists (the task as stated, a PR or ticket description); when this session authored the change, never include the session's own reasoning, plan, or messages — leaked rationale recreates the blindness the fresh context exists to remove. Done when changeset and intent are pinned down and free of authoring context.
- Spawn one fresh-context reviewer (a subagent or equivalent isolated session) with those
inputs, free to read any surrounding project material — except, when this session authored the change, session-authored files that are not part of it (plans, notes, scratch), whose paths the spawn instructions must list, since a fresh context cannot tell them apart. Its mandate, unless the invocation redirects it (e.g. security only): regressions and correctness, including contradictions with surrounding code, rules, or docs; ambiguities a reader without context would trip on; and, when an intent statement was given, whether the change does what it says. Tough but grounded, aimed at mistakes that matter: every finding names its location and a concrete failure scenario; style nits, speculation, and padding are out of scope, and zero findings is a valid outcome. If the harness cannot isolate a context, fall back to an adversarial pass over the same inputs in the main session. Done when an isolated reviewer has returned its findings, or the fallback pass ran and its result is flagged as same-context (weaker).
- Report back. Relay every finding intact — location and failure scenario included; add the
session's own assessment when useful, but never silently drop or soften a finding. What to do with the findings is the caller's decision, not this skill's. Done when every reviewer finding appears in the report.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: eai-org
- Source: eai-org/agent-toolkit
- License: MIT
- Homepage: https://medium.com/engineering-in-the-age-of-ai
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet — be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.