Install
$ agentstack add skill-nebulavenus-forge-gpu-dev-ui-review ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
Run a UI-specific quality review on a UI lesson before running /dev-final-pass. This skill catches the recurring code quality, correctness, and documentation issues specific to the forge_ui / forge_ui_ctx libraries and their callers. It is not a replacement for /dev-final-pass — it covers the UI-domain concerns that the general final pass does not.
The user provides:
- Lesson number or name (e.g.
12orauto-widget-layout)
If missing, infer from the current branch name or most recent UI lesson directory.
How to run this skill
Work through the three phases below in order. Each phase launches parallel agents. After each phase, validate findings, apply fixes, then have the agents revalidate. Repeat until no more issues are found.
Use a Task agent (model: haiku) for builds, test runs, and linting — never run those directly from the main agent.
Be literal and exhaustive. This is C — no RAII, no garbage collector. Every resource you acquire must be released on every exit path, every struct field must be documented, every error must be handled. Do not rationalize away findings with "it's probably fine." If the check says every function, check every function.
Phase 1 — Code correctness sweep
Spawn one agent per concern to review every function added or modified in common/ui/forge_ui.h, common/ui/forge_ui_ctx.h, the lesson's main.c, and the relevant test files. Each agent works independently and reports findings.
Agent 1: Memory safety
- Buffer overflows, out-of-bounds access, use-after-free
- Array index bounds relative to capacity/count fields
- Pointer arithmetic that could go out of range
- String operations without length checks
Agent 2: Parameter validation
- NULL pointer dereference on every function parameter
- Integer overflow or underflow on size/count parameters
- Negative dimensions, zero denominators, empty arrays
- Functions that silently accept invalid state
Agent 3: Bug detection
- Off-by-one errors in loops and index calculations
- Incorrect operator precedence in compound expressions
- Copy-paste errors (wrong variable name in repeated blocks)
- Incorrect comparison operators (=0, 0-255, NULL if unused)
- Relationship to other fields when relevant
Bad: int count; /* count */ Good: int count; /* number of active windows, 0 when no windows are open */
Doc check 2: KaTeX consistency
Scope: the lesson's README.md
Verify that any KaTeX math notation follows the same conventions as previous UI and GPU lessons:
- Inline math uses
$...$(single dollar signs) - Display math uses three-line format:
``text $$ formula here $$ ``
- Variable names are consistent with the code (
\text{width}matcheswidth) - Formulas are correct and match the implementation in
main.c
Doc check 3: Matplotlib diagram compliance
Scope: any diagram scripts modified or added for this lesson
Verify diagrams adhere to the /dev-create-diagram skill guidelines:
- All colors come from
STYLEdict — no hardcoded colors - Text uses
path_effectsreadability stroke - Title has
pad >= 12 - Labels do not overlap each other or lines
- Figure size follows the common size guidelines
- Function is registered in
DIAGRAMSdict in__main__.py - Diagram passes
ruff checkandruff format --check
Doc check 4: README-to-code accuracy
Scope: the lesson's README.md and main.c
Verify that every code snippet, function signature, struct definition, and API example shown in the README exactly matches the actual code in main.c and the library headers. Check for:
- Function names that were renamed in code but not updated in the README
- Parameter lists that differ between README examples and actual signatures
- Struct fields shown in the README that don't exist in the code (or vice versa)
- Code flow described in prose that doesn't match the actual execution order
- Return types or error handling described differently than implemented
Doc check 5: README currency
Scope: README.md (root), lessons/ui/README.md, common/ui/README.md, CLAUDE.md, previous lesson's README.md
Verify all index files are up to date with the changes from this lesson:
- Root
README.md: UI lessons table has a row for this lesson lessons/ui/README.md: lessons table includes this lessoncommon/ui/README.md: any new types or functions added to the library
are documented in the API reference; the lesson appears in "Where It's Used"
CLAUDE.md: if the lesson changes project structure, conventions, or
adds new modules, CLAUDE.md reflects those changes
- Previous lesson's
README.md: "What's next" section links to this lesson
After collecting findings from all five doc checks:
- Validate — review each finding to confirm it is a real issue
- Fix — apply corrections to documentation, diagrams, and README files
- Revalidate — have the agents re-check the fixed content
- Repeat until zero findings remain
Reporting
After completing all phases, report a summary table:
UI Review Results — Lesson NN: Name
=====================================
Phase 1 — Code Correctness
Memory safety ✅ PASS (N functions checked)
Parameter validation ✅ PASS (N functions checked)
Bug detection ✅ PASS
Undefined behavior ✅ PASS
Resource cleanup ✅ PASS
Phase 2 — Verification Checks
1. Test assertions ✅ PASS (N calls wrapped)
2. Magic numbers ⚠️ FIXED (N constants extracted)
3. Inf/NaN handling ✅ PASS (N guards added, N tests written)
4. State cleanup ✅ PASS (N paths checked, N tests written)
5. Unused variables ✅ PASS
6. Comment accuracy ✅ PASS
7. Shared state ✅ PASS (N tests written)
8. Setup returns ✅ PASS
Phase 3 — Documentation
1. Struct docs ✅ PASS (N fields documented)
2. KaTeX consistency ✅ PASS
3. Diagram compliance ⏭️ SKIP (no diagrams modified)
4. README accuracy ✅ PASS
5. README currency ✅ PASS
For each WARN, FIXED, or FAIL, list the specific file, line, and issue with the fix applied (or suggested if not yet applied). Ask the user if they want to proceed to /dev-final-pass.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: Nebulavenus
- Source: Nebulavenus/forge-gpu
- License: Zlib
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.