AgentStack
SKILL verified MIT Self-run

Code Review

skill-toverux-grimoire-code-review · by toverux

The review gate — check the changes since a fixed point against the spec and the project's standards, in parallel subagents.

No reviews yet
0 installs
0 views
view→install

Install

$ agentstack add skill-toverux-grimoire-code-review

✓ scanned · ✓ verified — works with Claude Code, Cursor, and more.

Security review

✓ Passed

No issues found. Passed automated security review. · v0.1.0 How review works →

  • Prompt-injection patterns
  • Secret / credential exfiltration
  • Dangerous shell & filesystem operations
  • Untrusted network calls
  • Known-malicious package signatures

What it can access

  • Network access No
  • Filesystem access No
  • Shell / process execution No
  • Environment & secrets No
  • Dynamic code execution No

From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.

Are you the author of Code Review? Claim this listing to set pricing, connect Stripe payouts, and keep 70% of every sale.
Sign up to claim

About

Two-axis review of the diff between HEAD and a fixed point:

  • Standards — does the code conform to the project's documented standards?
  • Spec — does the code faithfully implement docs/specs/.md (or its ticket)?

Both axes run as parallel sub-agents so they don't pollute each other's context, then this skill aggregates their findings.

Process

1. Pin the fixed point

Use the fixed point the user supplied — a commit SHA, branch name, tag, HEAD~5, etc. If they didn't supply one, default to the merge-base with the default branch.

Capture the diff command once: git diff ...HEAD (three-dot, against the merge-base), and the commit list: git log ..HEAD --oneline.

Confirm the fixed point resolves (git rev-parse ) and the diff is non-empty — a bad ref or empty diff fails here, not inside the sub-agents.

2. Identify the spec source

Look for the originating spec, in this order:

  1. A file under docs/specs/ matching the branch name or feature — the spec itself, or the ticket file (e.g. under docs/specs//) when the work is ticketed.
  2. A path the user passed as an argument.
  3. Otherwise, ask the user where the spec is.

If there isn't one, the Spec sub-agent skips and reports "no spec available".

3. Identify the standards sources

Anything that documents how this project's code should be written: AGENTS.md (or CLAUDE.md), project-local rules files if present, CONTRIBUTING.md, and the style skills loaded in this session.

On top of whatever the project documents, the Standards axis always carries the smell baseline below — a fixed set of Fowler code smells (Refactoring, ch. 3) that applies even when a project documents nothing. Two rules bind it:

  • The project overrides.

A documented standard always wins; where it endorses something the baseline would flag, suppress the smell.

  • Always a judgement call.

Each smell is a labelled heuristic ("possible Feature Envy"), never a hard violation — and, like any standard here, skip anything tooling already enforces.

Each smell reads what it ishow to fix; match it against the diff:

  • Mysterious Name — a function, variable, or type whose name doesn't reveal what it does or holds. → rename it; if no honest name comes, the design's murky.
  • Duplicated Code — the same logic shape appears in more than one hunk or file in the change. → extract the shared shape, call it from both.
  • Feature Envy — a method that reaches into another object's data more than its own. → move the method onto the data it envies.
  • Data Clumps — the same few fields or params keep travelling together (a type wanting to be born). → bundle them into one type, pass that.
  • Primitive Obsession — a primitive or string standing in for a domain concept that deserves its own type. → give the concept its own small type.
  • Repeated Switches — the same switch/if-cascade on the same type recurs across the change. → replace with polymorphism, or one map both sites share.
  • Shotgun Surgery — one logical change forces scattered edits across many files in the diff. → gather what changes together into one module.
  • Divergent Change — one file or module is edited for several unrelated reasons. → split so each module changes for one reason.
  • Speculative Generality — abstraction, parameters, or hooks added for needs the spec doesn't have. → delete it; inline back until a real need shows.
  • Message Chains — long a.b().c().d() navigation the caller shouldn't depend on. → hide the walk behind one method on the first object.
  • Middle Man — a class or function that mostly just delegates onward. → cut it, call the real target direct.
  • Refused Bequest — a subclass or implementer that ignores or overrides most of what it inherits. → drop the inheritance, use composition.

4. Search past learnings

Search docs/solutions/ (if present) for learnings that bear on the changed area: match titles, frontmatter, and keywords against the diff's paths and subsystems. Each match is a past root cause or gotcha a reviewer should re-check — pass the matching files to the Standards sub-agent.

5. Spawn both sub-agents in parallel

Dispatch both sub-agents in parallel where the harness supports it, sequentially otherwise.

Standards sub-agent prompt — include:

  • The diff command and commit list.
  • The standards-source files from step 3, plus the smell baseline pasted in full — the sub-agent has no other access to it.
  • The matching learning files from step 4, if any.
  • The brief: "Report — per file/hunk where relevant — (a) every place the diff violates a documented standard: cite the standard (file + the rule); (b) any baseline smell you spot: name it and quote the hunk; (c) any past learning the diff re-triggers: cite the learning file.

Distinguish hard violations from judgement calls — documented-standard breaches can be hard, but baseline smells are always judgement calls, and a documented standard overrides the baseline. Skip anything tooling enforces. Under 400 words."

Spec sub-agent prompt — include:

  • The diff command and commit list.
  • The path or contents of the spec.
  • The brief: "Report: (a) requirements the spec asked for that are missing or partial; (b) behaviour in the diff that wasn't asked for (scope creep); (c) requirements that look implemented but where the implementation looks wrong.

Quote the spec line for each finding. Under 400 words."

If the spec is missing, skip the Spec sub-agent and note this in the final report.

6. Aggregate

Present the two reports under ## Standards and ## Spec headings, verbatim or lightly cleaned, keeping the axes separate (see Why two axes). End with a one-line summary: total findings per axis, and the worst issue within each axis.

For a high-stakes change, offer a cross-model review as an option — a second pass by another vendor's model, where the harness offers one. It is never required.

Next: fix the findings worth fixing (re-run this review after substantial fixes), then /commit.

Why two axes

A change can pass one axis and fail the other:

  • Code that follows every standard but implements the wrong thing → Standards pass, Spec fail.
  • Code that does exactly what the spec asked but breaks the project's conventions → Spec pass, Standards fail.

Reporting them separately stops one axis from masking the other.

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

Install and usage instructions live in the source repository linked above.

Reviews

No reviews yet — be the first.

Versions

  • v0.1.0 Imported from the upstream source.