# Code Review

> Review code, diffs, or PRs for correctness, plus research/cluster pitfalls — hardcoded scratch paths, resource mismatch, GPFS tiny-file storms, package installs inside arrays. TRIGGER when reviewing code or a diff/PR, or before committing.

- **Type:** Skill
- **Install:** `agentstack add skill-yale-som-hpc-claude-code-marketplace-code-review`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [yale-som-hpc](https://agentstack.voostack.com/s/yale-som-hpc)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** Unlicense
- **Upstream author:** [yale-som-hpc](https://github.com/yale-som-hpc)
- **Source:** https://github.com/yale-som-hpc/claude-code-marketplace/tree/main/plugins/hpc/skills/code-review

## Install

```sh
agentstack add skill-yale-som-hpc-claude-code-marketplace-code-review
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Code Review

Find bugs that affect results, reproducibility, data safety, or cluster use. Skip style nits.

## Findings must be

- New in this change, unless asked for a broad audit.
- Impactful: name the input/scenario.
- Actionable: give the fix.

## Severity

- **P0**: blocks commit/run/merge. Wrong result, lost data, secret leak, cannot rerun, serious cluster misuse.
- **P1**: fix before commit/merge. Realistic failure.
- **P2**: fix later.
- **P3**: nit. Do not report unless asked.

Verdict:

- **LGTM**: no P0/P1.
- **FAIL**: P0/P1 found.

## Always check

- Hardcoded personal paths: `/Users/...`, `C:\Users\...`, `/home/netid/...`, `/gpfs/scratch60/netid/...`.
- Raw data, secrets, env dirs, or large outputs staged.
- Missing seeds in simulation, bootstrap, train/test split, UMAP, random forest, stochastic optimizer.
- Silent data loss: `dropna()`, `na.omit()`, failed joins, duplicate drops, broad filters without counts.
- Lockfile drift: deps changed but `uv.lock` / `renv.lock` not updated.
- Raw data mutation: code writes into `data/raw/` or overwrites inputs.
- HPC resource mismatch: requested 1 CPU but uses all cores; requested GPU but code does not use it.
- GPFS tiny-file storms.
- Package installs inside arrays.
- Scraping/API code without rate limit, cache, retry/backoff.

## Process

1. Read changed files fully.
2. Check `git status --short` and staged files.
3. Run existing checks if practical.
4. Run a small realistic smoke test if practical.
5. For Slurm changes: check resources, thread env vars, paths, logs, resumability.

## Output

```text
## Findings

### [P1] Missing seed makes bootstrap estimates non-reproducible
**File**: scripts/bootstrap.py:42
**Issue**: `np.random.default_rng()` is called without a fixed seed.
**Fix**: create `rng = np.random.default_rng(42)` at the entry point and pass it in.

## Verdict
FAIL
```

If clean:

```text
## Findings
None.

## Verdict
LGTM
```

## Checklist

- [ ] Changed files read
- [ ] Staged/untracked files checked
- [ ] Seeds checked
- [ ] Lockfiles checked
- [ ] Smoke test/check run if practical
- [ ] Slurm/resource behavior checked if relevant

## Further reading

- [Google code review guide](https://google.github.io/eng-practices/review/reviewer/)

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [yale-som-hpc](https://github.com/yale-som-hpc)
- **Source:** [yale-som-hpc/claude-code-marketplace](https://github.com/yale-som-hpc/claude-code-marketplace)
- **License:** Unlicense

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-yale-som-hpc-claude-code-marketplace-code-review
- Seller: https://agentstack.voostack.com/s/yale-som-hpc
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.