# Dev Ui Review

> Code quality, correctness, and documentation review for UI lessons — run before dev-final-pass

- **Type:** Skill
- **Install:** `agentstack add skill-nebulavenus-forge-gpu-dev-ui-review`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [Nebulavenus](https://agentstack.voostack.com/s/nebulavenus)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** Zlib
- **Upstream author:** [Nebulavenus](https://github.com/Nebulavenus)
- **Source:** https://github.com/Nebulavenus/forge-gpu/tree/main/.claude/skills/dev-ui-review

## Install

```sh
agentstack add skill-nebulavenus-forge-gpu-dev-ui-review
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

Run a UI-specific quality review on a UI lesson before running `/dev-final-pass`.
This skill catches the recurring code quality, correctness, and documentation
issues specific to the `forge_ui` / `forge_ui_ctx` libraries and their callers.
It is not a replacement for `/dev-final-pass` — it covers the UI-domain concerns
that the general final pass does not.

The user provides:

- **Lesson number or name** (e.g. `12` or `auto-widget-layout`)

If missing, infer from the current branch name or most recent UI lesson directory.

## How to run this skill

Work through the three phases below **in order**. Each phase launches parallel
agents. After each phase, validate findings, apply fixes, then have the agents
revalidate. Repeat until no more issues are found.

Use a Task agent (model: haiku) for builds, test runs, and linting — never run
those directly from the main agent.

**Be literal and exhaustive.** This is C — no RAII, no garbage collector. Every
resource you acquire must be released on every exit path, every struct field
must be documented, every error must be handled. Do not rationalize away
findings with "it's probably fine." If the check says every function, check
every function.

---

## Phase 1 — Code correctness sweep

Spawn **one agent per concern** to review every function added or modified in
`common/ui/forge_ui.h`, `common/ui/forge_ui_ctx.h`, the lesson's `main.c`, and
the relevant test files. Each agent works independently and reports findings.

### Agent 1: Memory safety

- Buffer overflows, out-of-bounds access, use-after-free
- Array index bounds relative to capacity/count fields
- Pointer arithmetic that could go out of range
- String operations without length checks

### Agent 2: Parameter validation

- NULL pointer dereference on every function parameter
- Integer overflow or underflow on size/count parameters
- Negative dimensions, zero denominators, empty arrays
- Functions that silently accept invalid state

### Agent 3: Bug detection

- Off-by-one errors in loops and index calculations
- Incorrect operator precedence in compound expressions
- Copy-paste errors (wrong variable name in repeated blocks)
- Incorrect comparison operators (=0, 0-255, NULL if unused)
- **Relationship** to other fields when relevant

Bad: `int count; /* count */`
Good: `int count; /* number of active windows, 0 when no windows are open */`

### Doc check 2: KaTeX consistency

**Scope:** the lesson's `README.md`

Verify that any KaTeX math notation follows the same conventions as previous UI
and GPU lessons:

- Inline math uses `$...$` (single dollar signs)
- Display math uses three-line format:

  ```text
  $$
  formula here
  $$
  ```

- Variable names are consistent with the code (`\text{width}` matches `width`)
- Formulas are correct and match the implementation in `main.c`

### Doc check 3: Matplotlib diagram compliance

**Scope:** any diagram scripts modified or added for this lesson

Verify diagrams adhere to the `/dev-create-diagram` skill guidelines:

- All colors come from `STYLE` dict — no hardcoded colors
- Text uses `path_effects` readability stroke
- Title has `pad >= 12`
- Labels do not overlap each other or lines
- Figure size follows the common size guidelines
- Function is registered in `DIAGRAMS` dict in `__main__.py`
- Diagram passes `ruff check` and `ruff format --check`

### Doc check 4: README-to-code accuracy

**Scope:** the lesson's `README.md` and `main.c`

Verify that every code snippet, function signature, struct definition, and API
example shown in the README **exactly matches** the actual code in `main.c` and
the library headers. Check for:

- Function names that were renamed in code but not updated in the README
- Parameter lists that differ between README examples and actual signatures
- Struct fields shown in the README that don't exist in the code (or vice versa)
- Code flow described in prose that doesn't match the actual execution order
- Return types or error handling described differently than implemented

### Doc check 5: README currency

**Scope:** `README.md` (root), `lessons/ui/README.md`, `common/ui/README.md`,
`CLAUDE.md`, previous lesson's `README.md`

Verify all index files are up to date with the changes from this lesson:

- **Root `README.md`**: UI lessons table has a row for this lesson
- **`lessons/ui/README.md`**: lessons table includes this lesson
- **`common/ui/README.md`**: any new types or functions added to the library
  are documented in the API reference; the lesson appears in "Where It's Used"
- **`CLAUDE.md`**: if the lesson changes project structure, conventions, or
  adds new modules, `CLAUDE.md` reflects those changes
- **Previous lesson's `README.md`**: "What's next" section links to this lesson

After collecting findings from all five doc checks:

1. **Validate** — review each finding to confirm it is a real issue
2. **Fix** — apply corrections to documentation, diagrams, and README files
3. **Revalidate** — have the agents re-check the fixed content
4. **Repeat** until zero findings remain

---

## Reporting

After completing all phases, report a summary table:

```text
UI Review Results — Lesson NN: Name
=====================================

Phase 1 — Code Correctness
  Memory safety        ✅ PASS  (N functions checked)
  Parameter validation ✅ PASS  (N functions checked)
  Bug detection        ✅ PASS
  Undefined behavior   ✅ PASS
  Resource cleanup     ✅ PASS

Phase 2 — Verification Checks
  1. Test assertions   ✅ PASS  (N calls wrapped)
  2. Magic numbers     ⚠️  FIXED (N constants extracted)
  3. Inf/NaN handling  ✅ PASS  (N guards added, N tests written)
  4. State cleanup     ✅ PASS  (N paths checked, N tests written)
  5. Unused variables  ✅ PASS
  6. Comment accuracy  ✅ PASS
  7. Shared state      ✅ PASS  (N tests written)
  8. Setup returns     ✅ PASS

Phase 3 — Documentation
  1. Struct docs       ✅ PASS  (N fields documented)
  2. KaTeX consistency ✅ PASS
  3. Diagram compliance ⏭️  SKIP (no diagrams modified)
  4. README accuracy   ✅ PASS
  5. README currency   ✅ PASS
```

For each WARN, FIXED, or FAIL, list the specific file, line, and issue with
the fix applied (or suggested if not yet applied). Ask the user if they want
to proceed to `/dev-final-pass`.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [Nebulavenus](https://github.com/Nebulavenus)
- **Source:** [Nebulavenus/forge-gpu](https://github.com/Nebulavenus/forge-gpu)
- **License:** Zlib

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-nebulavenus-forge-gpu-dev-ui-review
- Seller: https://agentstack.voostack.com/s/nebulavenus
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.