Install
$ agentstack add skill-toverux-grimoire-code-review ✓ scanned · ✓ verified — works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
About
Two-axis review of the diff between HEAD and a fixed point:
- Standards — does the code conform to the project's documented standards?
- Spec — does the code faithfully implement
docs/specs/.md(or its ticket)?
Both axes run as parallel sub-agents so they don't pollute each other's context, then this skill aggregates their findings.
Process
1. Pin the fixed point
Use the fixed point the user supplied — a commit SHA, branch name, tag, HEAD~5, etc. If they didn't supply one, default to the merge-base with the default branch.
Capture the diff command once: git diff ...HEAD (three-dot, against the merge-base), and the commit list: git log ..HEAD --oneline.
Confirm the fixed point resolves (git rev-parse ) and the diff is non-empty — a bad ref or empty diff fails here, not inside the sub-agents.
2. Identify the spec source
Look for the originating spec, in this order:
- A file under
docs/specs/matching the branch name or feature — the spec itself, or the ticket file (e.g. underdocs/specs//) when the work is ticketed. - A path the user passed as an argument.
- Otherwise, ask the user where the spec is.
If there isn't one, the Spec sub-agent skips and reports "no spec available".
3. Identify the standards sources
Anything that documents how this project's code should be written: AGENTS.md (or CLAUDE.md), project-local rules files if present, CONTRIBUTING.md, and the style skills loaded in this session.
On top of whatever the project documents, the Standards axis always carries the smell baseline below — a fixed set of Fowler code smells (Refactoring, ch. 3) that applies even when a project documents nothing. Two rules bind it:
- The project overrides.
A documented standard always wins; where it endorses something the baseline would flag, suppress the smell.
- Always a judgement call.
Each smell is a labelled heuristic ("possible Feature Envy"), never a hard violation — and, like any standard here, skip anything tooling already enforces.
Each smell reads what it is → how to fix; match it against the diff:
- Mysterious Name — a function, variable, or type whose name doesn't reveal what it does or holds. → rename it; if no honest name comes, the design's murky.
- Duplicated Code — the same logic shape appears in more than one hunk or file in the change. → extract the shared shape, call it from both.
- Feature Envy — a method that reaches into another object's data more than its own. → move the method onto the data it envies.
- Data Clumps — the same few fields or params keep travelling together (a type wanting to be born). → bundle them into one type, pass that.
- Primitive Obsession — a primitive or string standing in for a domain concept that deserves its own type. → give the concept its own small type.
- Repeated Switches — the same
switch/if-cascade on the same type recurs across the change. → replace with polymorphism, or one map both sites share. - Shotgun Surgery — one logical change forces scattered edits across many files in the diff. → gather what changes together into one module.
- Divergent Change — one file or module is edited for several unrelated reasons. → split so each module changes for one reason.
- Speculative Generality — abstraction, parameters, or hooks added for needs the spec doesn't have. → delete it; inline back until a real need shows.
- Message Chains — long
a.b().c().d()navigation the caller shouldn't depend on. → hide the walk behind one method on the first object. - Middle Man — a class or function that mostly just delegates onward. → cut it, call the real target direct.
- Refused Bequest — a subclass or implementer that ignores or overrides most of what it inherits. → drop the inheritance, use composition.
4. Search past learnings
Search docs/solutions/ (if present) for learnings that bear on the changed area: match titles, frontmatter, and keywords against the diff's paths and subsystems. Each match is a past root cause or gotcha a reviewer should re-check — pass the matching files to the Standards sub-agent.
5. Spawn both sub-agents in parallel
Dispatch both sub-agents in parallel where the harness supports it, sequentially otherwise.
Standards sub-agent prompt — include:
- The diff command and commit list.
- The standards-source files from step 3, plus the smell baseline pasted in full — the sub-agent has no other access to it.
- The matching learning files from step 4, if any.
- The brief: "Report — per file/hunk where relevant — (a) every place the diff violates a documented standard: cite the standard (file + the rule); (b) any baseline smell you spot: name it and quote the hunk; (c) any past learning the diff re-triggers: cite the learning file.
Distinguish hard violations from judgement calls — documented-standard breaches can be hard, but baseline smells are always judgement calls, and a documented standard overrides the baseline. Skip anything tooling enforces. Under 400 words."
Spec sub-agent prompt — include:
- The diff command and commit list.
- The path or contents of the spec.
- The brief: "Report: (a) requirements the spec asked for that are missing or partial; (b) behaviour in the diff that wasn't asked for (scope creep); (c) requirements that look implemented but where the implementation looks wrong.
Quote the spec line for each finding. Under 400 words."
If the spec is missing, skip the Spec sub-agent and note this in the final report.
6. Aggregate
Present the two reports under ## Standards and ## Spec headings, verbatim or lightly cleaned, keeping the axes separate (see Why two axes). End with a one-line summary: total findings per axis, and the worst issue within each axis.
For a high-stakes change, offer a cross-model review as an option — a second pass by another vendor's model, where the harness offers one. It is never required.
Next: fix the findings worth fixing (re-run this review after substantial fixes), then /commit.
Why two axes
A change can pass one axis and fail the other:
- Code that follows every standard but implements the wrong thing → Standards pass, Spec fail.
- Code that does exactly what the spec asked but breaks the project's conventions → Spec pass, Standards fail.
Reporting them separately stops one axis from masking the other.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: toverux
- Source: toverux/grimoire
- License: MIT
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet — be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.