Loading...
Loading...
Found 137 Skills
4-phase code review methodology: UNDERSTAND changes, VERIFY claims against code, ASSESS security/performance/architecture risks, DOCUMENT findings with severity classification. Use when reviewing pull requests, auditing code before release, evaluating external contributions, or pre-merge verification. Use for "review PR", "code review", "audit code", "check this PR", or "review my changes". Do NOT use for writing new code or implementing features.
Audit a codebase for handcrafted code that duplicates functionality already available in the project's dependencies. Reads package.json, launches parallel exploration agents, verifies replacement feasibility, and produces a structured refactor plan. Audit only -- does not execute changes.
System Audit - Proactively identify bug risks, security vulnerabilities, performance issues, maintainability debt, and architecture drift from code, and generate a batch list of findings. Triggers: Users say "review the system", "audit code", "scan for issues", "find bugs", "what can be optimized".
This skill should be used when the user wants to review code, audit a diff, get a second opinion on changes, or run an adversarial review of files in the current working tree. Common triggers include "review this code", "audit this diff", "find issues in", "second opinion on this", "harsh review of", "adversarial review", and "security review of". Picks one or more reviewer personas (adversarial, security, architecture, performance). Reviews local files, `git diff`, or `git diff --staged` only — does not fetch external content. Runs in one of four modes: single-agent (one persona in the current agent), cross-model handoff (independent second opinion via another local AI CLI, with secret-shield preflight + prompt-shield wrap), multi-bg-agent (one persona per parallel background subagent), or agent-team (Claude Code Teams or equivalent on supporting agents). Skip when the user wants formatting fixes (use a linter) or refactoring patterns (use ts-best-practices or ts-best-practices-functional).
Performs a comprehensive security review of code changes in a GitHub PR or issue. Checks out the branch, analyzes changed files against a 9-category security checklist, and produces PASS/WARNING/FAIL verdicts. Use when reviewing pull requests for security vulnerabilities, hardcoded secrets, injection flaws, auth bypasses, or insecure configurations. Trigger keywords - security review, code review, appsec, vulnerability assessment, security audit, review PR security.
Professional Skills and Methodologies for Secure Code Review
Review code for Government of Canada authentication and identity management compliance. Checks OIDC implementations, session security, scope minimization, logout handling, and RBAC integration against ITSG-33 and TBS security standards.
Audits production source code files based on the strategy in workspace/plan.json. Use when a review plan exists and you need to perform static analysis and deep-dive reviews of targeted files. Don't use for planning, deduplicating, or writing patches.
Research-first, evidence-first implementation planning in seven gated phases: frame the task, inventory the real codebase, verify ground truth from vendor source or official docs, adversarially audit existing code, analyze gaps, commit to design decisions, and write a phased plan document with timeline, risks, and verification. Enforces "no claim without evidence, no design before research". Use when the user asks to plan, design, architect, audit, or review before implementing a feature, refactor, migration, or system, or mentions deep-plan, /deep-plan, or Plan mode.
Detect common Python vulnerabilities such as SQL injection, unsafe deserialization, and hardcoded secrets. Use as part of a secure SDLC for Python projects.
Review current branch for blindspots; fix now / needs spec / create issues.
Source code security audit using backward taint analysis, slot type classification, render context verification, and 3-phase parallel review producing an exploitation queue.