Code Review Deep
Full code review for large or security-sensitive changes. Gathers requirements first, loads all relevant language references, runs the linter where applicable, applies the full review checklist with security as the top priority.
Install
$ agentstack add skill-gsarig-skills-code-review-deep ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Links to your public security report.[](https://agentstack.voostack.com/security/report/skill-gsarig-skills-code-review-deep) Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
Steps
1. Source and diff
Read ~/.claude/skills/code-review/references/review-shared.md and follow its source detection and diff fetching sections. If --source and the corresponding identifier args were passed, use those and skip any prompting.
2. Gather requirements
If --requirements=... was passed, use that text as the requirements. Otherwise ask:
> "Do you have specific requirements I should keep in mind? (e.g. a ticket description, acceptance criteria, or expected behaviour)"
Wait for the response. If declined, proceed without requirements but note in the final output that correctness was assessed against inferred intent only.
3. Lint (conditional)
Skip the linter when source mode is pr and --lint was not passed (CI runs the linter on the PR).
Otherwise run the linter per the linter detection section of the shared doc.
4. Load language references (conditional)
If any changed path matches \.(js|jsx|ts|tsx|mjs|cjs)$, read ~/.claude/skills/code-review/references/js-security.md.
5. GitHub Actions hash verification (conditional)
If the diff contains any line matching ^\+\s*uses:\s+\S+@[0-9a-f]{40}, run the verification per the shared doc.
6. Review
Read ~/.claude/skills/code-review/references/review-checklist.md and apply every principle.
Priorities in order:
- Security: always flag, even if unrelated to the change. Include unrelated findings in the dedicated section of the output.
- Correctness: does it fulfil the supplied requirements? If no requirements were supplied, assess against inferred intent and say so.
- Best practices.
- Reusability and extensibility.
- Simplicity: flag overengineering as well as under-engineering.
Apply the common review rules from the shared doc (review only changed lines, surface project-wide patterns separately, never run tests, never run auto-fixers).
7. Output
Format per the output section of ~/.claude/skills/code-review/references/review-shared.md.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: gsarig
- Source: gsarig/skills
- License: MIT
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.