Code Review
Perform an evidence-backed adversarial review of a diff, commit, branch, pull request, or named files. Use only when the user explicitly requests a fresh code review or findings on implementation quality; do not use merely to fix CI or act on existing review comments.
Install
$ agentstack add skill-zacharygcook-agent-skills-code-review ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Links to your public security report.[](https://agentstack.voostack.com/security/report/skill-zacharygcook-agent-skills-code-review) Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
Code Review
Find real correctness, security, reliability, product, performance, and maintainability risks. Do not implement fixes unless the user also asks for them.
Review Posture
- Assume bugs may exist, but prove claims from code, tests, docs, or deterministic output.
- Review system outcomes and repository invariants, not syntax alone.
- Separate definite findings from open questions and speculative risks.
- Prefer one root-cause finding over several overlapping symptoms.
- Do not pad the report when no issue exists.
Priorities
- P0: catastrophic security, data loss, outage, or broken core workflow; must not ship.
- P1: serious definite correctness, privacy, auth, reliability, migration, or integration bug.
- P2: normal actionable bug, edge case, test gap, performance risk, API/data-model issue, or maintainability problem.
- P3: low-risk inconsistency or polish worth addressing.
Use the lowest priority that honestly matches both impact and confidence.
Workflow
- Read repository instructions and docs relevant to the changed domain.
- Establish the exact target and intent from status, commits, PR text, issues, and tests.
- Read changed files plus nearby code that owns contracts and invariants.
- Run focused repository-native checks without mutating code.
- Inspect auth, data handling, migrations, concurrency, external costs, dependencies, queries, UI states, and operability as applicable.
- Review manually after tool output; scanners are evidence, not conclusions.
- Return findings first with tight file/line references and concrete remediation.
Never run destructive resets, live provider calls, production migrations, or write-mode formatting during a read-only review without explicit authorization.
Deterministic Evidence
Choose proportional checks: formatting check mode, lint, typecheck, focused tests, contract/schema tests, build/bundle analysis, dependency inspection, and existing complexity tooling. Report exact commands and outcomes.
For complexity, report exact cyclomatic/cognitive scores only when tooling supplies them. Treat functions over 10 as prompts for manual inspection, not automatic bugs. State limitations instead of fabricating scores.
Output
- Big picture — whether the direction fits the intended outcome.
- Findings — ordered P0 through P3; include title, location, behavior, impact, and recommendation.
- Checks run — commands, results, complexity evidence, and skipped checks.
- Recommendations — blockers first, then follow-ups.
- Open questions / residual risk — only when useful.
If no findings survive verification, say so plainly while still reporting checks and residual risk.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: zacharygcook
- Source: zacharygcook/agent-skills
- License: MIT
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.