Install
$ agentstack add skill-uinaf-agents-review-gang ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
Review Gang
Independently audit existing code by spawning concern-specific reviewer subagents, then synthesize one evidence-backed ship decision.
Contract
- Spawn reviewer personas as separate subagents every time; if subagents are unavailable, the review is
blockedunless the user explicitly allows a sequential fallback - Treat invocation of
review-gang,$review-gang, or the Review Gang tile as the user's explicit request to spawn mandatory reviewer subagents - Before saying subagents are unavailable, discover or load the harness's subagent/multi-agent tool once; only block after the tool is truly absent or unusable
- Always run the default gang:
general,tests,silent-failures, andcode-shape - Keep findings risk-focused, evidence-backed, severity-ordered, and free of low-value nits
- Block when missing context or proof prevents an honest verdict; otherwise name the unverified surface and adjust the verdict
- Do not use this lane to self-check a change you just authored
Before You Start
- Define the scope: file, diff, branch, commit range, or PR
- Load the target repo's guidance files such as
AGENTS.md,CLAUDE.md, or repo rules, when present - Confirm the reviewed base/head or live artifact is current; stale review artifacts are evidence to refresh, not evidence to trust
- Discover or load subagent tooling if it is not already visible in the harness
- Spawn the mandatory default reviewer subagents from [references/reviewer-selection.md](references/reviewer-selection.md)
- Add conditional reviewer subagents when the change shape calls for them
Add conditional personas only when they add a distinct concern; use [references/reviewer-selection.md](references/reviewer-selection.md) for shortcuts and criteria.
Workflow
1. Scope nearby risk
Review the requested code, but inspect adjacent behavior when the risk leaks past the named diff.
Refresh the source of truth before judging branches or PRs: base branch, head SHA, diff, checks, and linked issue or specification when present.
2. Spawn reviewer subagents
Spawn one subagent per selected persona. Run them in parallel when the environment supports it, and keep each persona concern-focused and independent. Do not collapse the gang into one blended self-review pass.
For Codex specifically: if no subagent tool is currently visible, search for multi-agent or subagent tooling before blocking or asking the user to repeat the request. The skill invocation already satisfies Codex's explicit-delegation requirement.
Use this prompt shape for each subagent, filling in the persona and scope:
You are the reviewer. Read the target repo guidance, then review only against your persona concerns from skills/review-gang/reviewers/.md.
Return only material findings with file/line evidence, severity, confidence, and the proof or missing proof that changes the verdict. If you find nothing material, say "none" and name any residual unverified surface.
Concrete starting points:
git diff --stat ...HEADto size the changegit diff ...HEAD --to inspect risky files- targeted tests such as
pnpm test path/to/specwhen behavior claims need proof
3. Collect evidence
- Cite exact file references for static findings
- Run the smallest runtime check that changes the verdict when the repo supports it
- If something is unverified, say so explicitly
- Treat stale CI, stale review artifacts, or moved branch heads as unverified until refreshed
- If legacy or dead code is still present, say whether it should be deleted or why it must stay
- If tests mock the main integrations or boundaries, say that the behavior is still unverified on the real surface
4. Synthesize the verdict
Order findings by severity. If no findings are discovered, say that explicitly and mention any residual risk or testing gap. Choose exactly one verdict: ship it, needs review, or blocked.
Output
After review, report in this compact bullet shape:
- findings:first, only when present; otherwise- findings: none- verdict:exactly one ofship it,needs review, orblocked- evidence:concise explanations of what checks proved, not full commands- unverified:residual risk, readiness gaps, ornone- next:one ofimplementation, runtime verification, readiness setup, documentation cleanup, ornone- notes:only for out-of-scope repo state the user must act on
Use those labels explicitly. Keep the verdict label exact and omit opener, closer, apology, status preface, or conversational recap.
Prefer the active harness's best native review representation instead of a prose-heavy wall of text.
Keep detailed issue text in native findings or fallback finding bullets. Keep the verdict footer to 4 labeled lines or fewer after findings.
See [references/reviewing.md](references/reviewing.md) for stale evidence handling and presentation details.
Example:
- finding: high — src/auth/session.ts:42 fallback returns an anonymous session when token parsing fails
- verdict: needs review
- evidence: session tests exercised token parsing failures
- unverified: malformed OAuth callback runtime behavior
- next: implementation
References
- [references/reviewing.md](references/reviewing.md) — reviewer subagent workflow, evidence expectations, and verdict synthesis
- [references/reviewer-selection.md](references/reviewer-selection.md) — mandatory and conditional reviewer subagents
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: uinaf
- Source: uinaf/agents
- License: MIT
- Homepage: https://tessl.io/registry/uinaf
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.