AgentStack
Browse Sign in
Browse Why AgentStack Sell Docs
Sign in
SKILL verified Zlib Self-run

Dev Ui Review

skill-nebulavenus-forge-gpu-dev-ui-review · by Nebulavenus

Code quality, correctness, and documentation review for UI lessons — run before dev-final-pass

No reviews yet
0 installs
22 views
0.0% view→install

Install

$ agentstack add skill-nebulavenus-forge-gpu-dev-ui-review

✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.

Security review

✓ Passed

No issues found. Passed automated security review. · v0.1.0 How review works →

  • Prompt-injection patterns
  • Secret / credential exfiltration
  • Dangerous shell & filesystem operations
  • Untrusted network calls
  • Known-malicious package signatures

What it can access

  • Network access No
  • Filesystem access No
  • Shell / process execution No
  • Environment & secrets No
  • Dynamic code execution No

From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.

View the full security report →

Verified badge

Passed review? Show it. Paste this badge into your README, it links to the public security report.

AgentStack Verified badge Links to your public security report.
[![AgentStack Verified](https://agentstack.voostack.com/badges/verified.svg)](https://agentstack.voostack.com/security/report/skill-nebulavenus-forge-gpu-dev-ui-review)

Reliability & compatibility

Security review passed
0 installs to date
no reviews yet
5mo ago

Declared compatibility

Claude CodeClaude Desktop

Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.

Preview Execution monitoring

We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.

How agent discovery & health will work →
Are you the author of Dev Ui Review? Claim this listing to set pricing, connect Stripe payouts, and keep 70% of every sale.
Sign up to claim

About

Run a UI-specific quality review on a UI lesson before running /dev-final-pass. This skill catches the recurring code quality, correctness, and documentation issues specific to the forge_ui / forge_ui_ctx libraries and their callers. It is not a replacement for /dev-final-pass — it covers the UI-domain concerns that the general final pass does not.

The user provides:

  • Lesson number or name (e.g. 12 or auto-widget-layout)

If missing, infer from the current branch name or most recent UI lesson directory.

How to run this skill

Work through the three phases below in order. Each phase launches parallel agents. After each phase, validate findings, apply fixes, then have the agents revalidate. Repeat until no more issues are found.

Use a Task agent (model: haiku) for builds, test runs, and linting — never run those directly from the main agent.

Be literal and exhaustive. This is C — no RAII, no garbage collector. Every resource you acquire must be released on every exit path, every struct field must be documented, every error must be handled. Do not rationalize away findings with "it's probably fine." If the check says every function, check every function.


Phase 1 — Code correctness sweep

Spawn one agent per concern to review every function added or modified in common/ui/forge_ui.h, common/ui/forge_ui_ctx.h, the lesson's main.c, and the relevant test files. Each agent works independently and reports findings.

Agent 1: Memory safety

  • Buffer overflows, out-of-bounds access, use-after-free
  • Array index bounds relative to capacity/count fields
  • Pointer arithmetic that could go out of range
  • String operations without length checks

Agent 2: Parameter validation

  • NULL pointer dereference on every function parameter
  • Integer overflow or underflow on size/count parameters
  • Negative dimensions, zero denominators, empty arrays
  • Functions that silently accept invalid state

Agent 3: Bug detection

  • Off-by-one errors in loops and index calculations
  • Incorrect operator precedence in compound expressions
  • Copy-paste errors (wrong variable name in repeated blocks)
  • Incorrect comparison operators (=0, 0-255, NULL if unused)
  • Relationship to other fields when relevant

Bad: int count; /* count */ Good: int count; /* number of active windows, 0 when no windows are open */

Doc check 2: KaTeX consistency

Scope: the lesson's README.md

Verify that any KaTeX math notation follows the same conventions as previous UI and GPU lessons:

  • Inline math uses $...$ (single dollar signs)
  • Display math uses three-line format:

``text $$ formula here $$ ``

  • Variable names are consistent with the code (\text{width} matches width)
  • Formulas are correct and match the implementation in main.c

Doc check 3: Matplotlib diagram compliance

Scope: any diagram scripts modified or added for this lesson

Verify diagrams adhere to the /dev-create-diagram skill guidelines:

  • All colors come from STYLE dict — no hardcoded colors
  • Text uses path_effects readability stroke
  • Title has pad >= 12
  • Labels do not overlap each other or lines
  • Figure size follows the common size guidelines
  • Function is registered in DIAGRAMS dict in __main__.py
  • Diagram passes ruff check and ruff format --check

Doc check 4: README-to-code accuracy

Scope: the lesson's README.md and main.c

Verify that every code snippet, function signature, struct definition, and API example shown in the README exactly matches the actual code in main.c and the library headers. Check for:

  • Function names that were renamed in code but not updated in the README
  • Parameter lists that differ between README examples and actual signatures
  • Struct fields shown in the README that don't exist in the code (or vice versa)
  • Code flow described in prose that doesn't match the actual execution order
  • Return types or error handling described differently than implemented

Doc check 5: README currency

Scope: README.md (root), lessons/ui/README.md, common/ui/README.md, CLAUDE.md, previous lesson's README.md

Verify all index files are up to date with the changes from this lesson:

  • Root README.md: UI lessons table has a row for this lesson
  • lessons/ui/README.md: lessons table includes this lesson
  • common/ui/README.md: any new types or functions added to the library

are documented in the API reference; the lesson appears in "Where It's Used"

  • CLAUDE.md: if the lesson changes project structure, conventions, or

adds new modules, CLAUDE.md reflects those changes

  • Previous lesson's README.md: "What's next" section links to this lesson

After collecting findings from all five doc checks:

  1. Validate — review each finding to confirm it is a real issue
  2. Fix — apply corrections to documentation, diagrams, and README files
  3. Revalidate — have the agents re-check the fixed content
  4. Repeat until zero findings remain

Reporting

After completing all phases, report a summary table:

UI Review Results — Lesson NN: Name
=====================================

Phase 1 — Code Correctness
  Memory safety        ✅ PASS  (N functions checked)
  Parameter validation ✅ PASS  (N functions checked)
  Bug detection        ✅ PASS
  Undefined behavior   ✅ PASS
  Resource cleanup     ✅ PASS

Phase 2 — Verification Checks
  1. Test assertions   ✅ PASS  (N calls wrapped)
  2. Magic numbers     ⚠️  FIXED (N constants extracted)
  3. Inf/NaN handling  ✅ PASS  (N guards added, N tests written)
  4. State cleanup     ✅ PASS  (N paths checked, N tests written)
  5. Unused variables  ✅ PASS
  6. Comment accuracy  ✅ PASS
  7. Shared state      ✅ PASS  (N tests written)
  8. Setup returns     ✅ PASS

Phase 3 — Documentation
  1. Struct docs       ✅ PASS  (N fields documented)
  2. KaTeX consistency ✅ PASS
  3. Diagram compliance ⏭️  SKIP (no diagrams modified)
  4. README accuracy   ✅ PASS
  5. README currency   ✅ PASS

For each WARN, FIXED, or FAIL, list the specific file, line, and issue with the fix applied (or suggested if not yet applied). Ask the user if they want to proceed to /dev-final-pass.

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

Install and usage instructions live in the source repository linked above.

Reviews

No reviews yet, be the first.

Versions

  • v0.1.0 Imported from the upstream source.