Install
$ agentstack add skill-sergeyklay-agents-review-impl ✓ scanned · ✓ verified — works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
About
Implementation Review
Task
What was implemented: Provided by the user as a task description or task tracker reference.
Process
Step 1: Resolve Task Reference
- If the invoker has already quoted the issue title and body in this prompt (typical when an orchestrator fetched the tracker in an earlier phase and passed the context forward), use those values as the canonical task description for all subsequent steps and do not re-fetch.
- Otherwise, if the task description above contains a GitHub issue URL (e.g.
https://github.com/owner/repo/issues/123) or a shorthand reference (e.g.owner/repo#123or#123), rungh issue view --json title,bodyto fetch the issue title and body. Use the fetched title and body as the canonical task description for all subsequent steps. - Otherwise, if the task description above contains a Jira issue URL (e.g.
https://yourcompany.atlassian.net/browse/PROJ-123), use appropriate Agent Skills and/or MCP tools to fetch the issue summary and description, and use those as the canonical task description for all subsequent steps. - If the task description is plain text and no issue context was provided, skip this step.
Step 2: Understand the Project
Before evaluating any changes, build a mental model of the system:
- Read project context files:
CLAUDE.md,AGENTS.md,GEMINI.md,README.md,ARCHITECTURE.md, and anything indocs/. - List the project root and key subdirectories to understand module structure and layering.
- Read build/dependency manifests to understand the tech stack.
- Search for code review standards or guidelines the project defines.
Step 3: Understand the Task
Analyze the task description to determine:
- What problem is being solved or what capability is being added?
- Which architectural layers and modules should be affected?
- What quality attributes matter most for this change (correctness, performance, security, maintainability)?
Step 4: Discover What Changed
Identify the implementation changes using all available signals:
- Run
git diff HEAD~1(andgit log --oneline -5for context). If the change spans multiple commits, widen the range to capture the full scope. - If the diff is inconclusive, search for files recently modified that relate to the task description.
- Read every changed file completely - not just the diff hunks. You need surrounding context to evaluate whether the change fits.
Build a change inventory:
| File | Change type | Lines changed | Module/Layer | |---|---|---|---|
Step 5: Evaluate the Implementation
For each changed file, assess:
- Correctness - Does the code do what the task requires? Are edge cases handled? Are there logic errors?
- Architectural fit - Does the change respect module boundaries, dependency direction, and the project's established patterns? Does it put logic in the right layer?
- Regression risk - Could this change break existing behavior? Are callers of modified interfaces updated? Are assumptions still valid?
- Error handling - Are errors handled consistently with the project's patterns? Are failure modes explicit?
- Naming and contracts - Do new identifiers communicate intent? Are public API contracts clear?
- Completeness - Is anything missing that the task implies? Migrations, config changes, documentation updates, test coverage?
- Simplicity - Is the solution the simplest that works, or is there unnecessary complexity, indirection, or premature abstraction?
Step 6: Produce the Review
Output Format
## Implementation Review: [task description, shortened]
### Change Summary
[2-3 sentences: what changed, across which modules, and the overall approach taken]
### Findings
#### [Finding title]
- **Severity:** Critical | High | Medium | Low
- **File:** `path/to/file` (lines N-M)
- **Issue:** [what is wrong, with code evidence]
- **Recommendation:** [concrete fix - not vague advice]
### What Works Well
[Brief - 1-3 sentences acknowledging sound decisions. Do not pad.]
### Verdict
- **Risk level:** Critical | High | Moderate | Low
- **Decision:** Block | Request changes | Approve with notes | Approve
- **Key actions:**
1. …
2. …
3. …
Severity Criteria
- Critical - Data loss, security vulnerability, correctness bug that affects users. Must fix before merge.
- High - Behavioral bug, broken contract, architectural violation that will cause pain. Should fix before merge.
- Medium - Maintainability concern, missing edge case in non-critical path, suboptimal but working approach. Fix soon.
- Low - Minor naming issue, opportunity for simplification, style inconsistency. Fix if convenient.
Rules
- Every finding must cite specific code. No finding without a file path and line reference.
- Do not comment on formatting, whitespace, or style unless it signals a real problem.
- Do not suggest refactors beyond the scope of the task. Review what was changed, not what was not.
- If the change is clean and correct, say so briefly. A short review of good code is more valuable than a long review searching for problems that are not there.
Save the Review
Write the review to .reviews/Review-impl-{slug}.md, where {slug} is a short kebab-case slug derived from the task description (3-5 words max).
Create the .reviews/ directory if it does not exist. If the file already exists, append a numeric index: -2, -3, etc.
After writing, print the path to the created file.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: sergeyklay
- Source: sergeyklay/.agents
- License: Apache-2.0
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet — be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.