# Code Review > The review gate — check the changes since a fixed point against the spec and the project's standards, in parallel subagents. - **Type:** Skill - **Install:** `agentstack add skill-toverux-grimoire-code-review` - **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior - **Seller:** [toverux](https://agentstack.voostack.com/s/toverux) - **Installs:** 0 - **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills) - **Latest version:** 0.1.0 - **License:** MIT - **Upstream author:** [toverux](https://github.com/toverux) - **Source:** https://github.com/toverux/grimoire/tree/main/plugins/cantrips/skills/code-review ## Install ```sh agentstack add skill-toverux-grimoire-code-review ``` Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent. ## About Two-axis review of the diff between `HEAD` and a fixed point: - **Standards** — does the code conform to the project's documented standards? - **Spec** — does the code faithfully implement `docs/specs/.md` (or its ticket)? Both axes run as **parallel sub-agents** so they don't pollute each other's context, then this skill aggregates their findings. ## Process ### 1. Pin the fixed point Use the fixed point the user supplied — a commit SHA, branch name, tag, `HEAD~5`, etc. If they didn't supply one, default to the merge-base with the default branch. Capture the diff command once: `git diff ...HEAD` (three-dot, against the merge-base), and the commit list: `git log ..HEAD --oneline`. Confirm the fixed point resolves (`git rev-parse `) and the diff is non-empty — a bad ref or empty diff fails here, not inside the sub-agents. ### 2. Identify the spec source Look for the originating spec, in this order: 1. A file under `docs/specs/` matching the branch name or feature — the spec itself, or the ticket file (e.g. under `docs/specs//`) when the work is ticketed. 2. A path the user passed as an argument. 3. Otherwise, ask the user where the spec is. If there isn't one, the **Spec** sub-agent skips and reports "no spec available". ### 3. Identify the standards sources Anything that documents how this project's code should be written: `AGENTS.md` (or `CLAUDE.md`), project-local rules files if present, `CONTRIBUTING.md`, and the style skills loaded in this session. On top of whatever the project documents, the Standards axis always carries the **smell baseline** below — a fixed set of Fowler code smells (_Refactoring_, ch. 3) that applies even when a project documents nothing. Two rules bind it: - **The project overrides.** A documented standard always wins; where it endorses something the baseline would flag, suppress the smell. - **Always a judgement call.** Each smell is a labelled heuristic ("possible Feature Envy"), never a hard violation — and, like any standard here, skip anything tooling already enforces. Each smell reads _what it is_ → _how to fix_; match it against the diff: - **Mysterious Name** — a function, variable, or type whose name doesn't reveal what it does or holds. → rename it; if no honest name comes, the design's murky. - **Duplicated Code** — the same logic shape appears in more than one hunk or file in the change. → extract the shared shape, call it from both. - **Feature Envy** — a method that reaches into another object's data more than its own. → move the method onto the data it envies. - **Data Clumps** — the same few fields or params keep travelling together (a type wanting to be born). → bundle them into one type, pass that. - **Primitive Obsession** — a primitive or string standing in for a domain concept that deserves its own type. → give the concept its own small type. - **Repeated Switches** — the same `switch`/`if`-cascade on the same type recurs across the change. → replace with polymorphism, or one map both sites share. - **Shotgun Surgery** — one logical change forces scattered edits across many files in the diff. → gather what changes together into one module. - **Divergent Change** — one file or module is edited for several unrelated reasons. → split so each module changes for one reason. - **Speculative Generality** — abstraction, parameters, or hooks added for needs the spec doesn't have. → delete it; inline back until a real need shows. - **Message Chains** — long `a.b().c().d()` navigation the caller shouldn't depend on. → hide the walk behind one method on the first object. - **Middle Man** — a class or function that mostly just delegates onward. → cut it, call the real target direct. - **Refused Bequest** — a subclass or implementer that ignores or overrides most of what it inherits. → drop the inheritance, use composition. ### 4. Search past learnings Search `docs/solutions/` (if present) for learnings that bear on the changed area: match titles, frontmatter, and keywords against the diff's paths and subsystems. Each match is a past root cause or gotcha a reviewer should re-check — pass the matching files to the Standards sub-agent. ### 5. Spawn both sub-agents in parallel Dispatch both sub-agents in parallel where the harness supports it, sequentially otherwise. **Standards sub-agent prompt** — include: - The diff command and commit list. - The standards-source files from step 3, **plus the smell baseline pasted in full** — the sub-agent has no other access to it. - The matching learning files from step 4, if any. - The brief: "Report — per file/hunk where relevant — (a) every place the diff violates a documented standard: cite the standard (file + the rule); (b) any baseline smell you spot: name it and quote the hunk; (c) any past learning the diff re-triggers: cite the learning file. Distinguish hard violations from judgement calls — documented-standard breaches can be hard, but baseline smells are always judgement calls, and a documented standard overrides the baseline. Skip anything tooling enforces. Under 400 words." **Spec sub-agent prompt** — include: - The diff command and commit list. - The path or contents of the spec. - The brief: "Report: (a) requirements the spec asked for that are missing or partial; (b) behaviour in the diff that wasn't asked for (scope creep); (c) requirements that look implemented but where the implementation looks wrong. Quote the spec line for each finding. Under 400 words." If the spec is missing, skip the Spec sub-agent and note this in the final report. ### 6. Aggregate Present the two reports under `## Standards` and `## Spec` headings, verbatim or lightly cleaned, keeping the axes separate (see _Why two axes_). End with a one-line summary: total findings per axis, and the worst issue _within each axis_. For a high-stakes change, offer a cross-model review as an option — a second pass by another vendor's model, where the harness offers one. It is never required. **Next:** fix the findings worth fixing (re-run this review after substantial fixes), then `/commit`. ## Why two axes A change can pass one axis and fail the other: - Code that follows every standard but implements the wrong thing → **Standards pass, Spec fail.** - Code that does exactly what the spec asked but breaks the project's conventions → **Spec pass, Standards fail.** Reporting them separately stops one axis from masking the other. ## Source & license This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code. - **Author:** [toverux](https://github.com/toverux) - **Source:** [toverux/grimoire](https://github.com/toverux/grimoire) - **License:** MIT Install and usage instructions live in the source repository linked above. ## Pricing - **Free** — Free ## Security capabilities Automated source analysis of v0.1.0 — what this tool can access: - **Network access:** no - **Filesystem access:** no - **Shell / process execution:** no - **Environment & secrets:** no - **Dynamic code execution:** no *"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.* ## Versions - **0.1.0** — security scan: passed — Imported from the upstream source. ## Links - Listing page: https://agentstack.voostack.com/l/skill-toverux-grimoire-code-review - Seller: https://agentstack.voostack.com/s/toverux - Browse the marketplace: https://agentstack.voostack.com/browse --- Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.