review-full

Name: review-full
Author: faizkhairi

61stars19forks

How to install review-full?

faizkhairi/claude-code-blueprint/review-full

$npx -y skills add faizkhairi/claude-code-blueprint --skill review-full

Installs into the current project.

Summary

Run a comprehensive multi-perspective code review on recent changes. Also triggers on 'is this secure?', 'security review', 'check for vulnerabilities', 'could this be exploited?' for security-focused review. Produces: GO/NO-GO verdict + findings table (Severity | Category | File

Files · 1

View on GitHub

SKILL.md

1	This is a COMPREHENSIVE multi-agent code review. For quick anti-pattern scanning (seconds, not minutes), use review-diff instead.
2
3	## Step 0: Detect scope and project
4
5	- If `$ARGUMENTS` is empty: review uncommitted changes (staged + unstaged via `git diff` + `git diff --cached`)
6	- If `$ARGUMENTS` is a file path: review that file only
7	- If `$ARGUMENTS` is a branch or range: review diff against that ref
8	- If `$ARGUMENTS` is "security": run security-only review (skip to step 3)
9	- Detect project type from cwd/CLAUDE.md and the project manifest (any language/framework), or fall back to inspecting the file structure
10
11	## Step 1: Spawn review agents in parallel
12
13	Launch up to 4 agents based on what the changes touch:
14
15	\| Changes Touch \| Agent to Spawn \| Focus \|
16	\|--------------\|----------------\|-------\|
17	\| Any code \| `code-reviewer` \| Quality, patterns, naming, DRY, error handling, consistency \|
18	\| API endpoints, auth, user input \| `security-reviewer` \| OWASP Top 10, injection, auth gaps, secrets, CORS \|
19	\| Database queries, ORM models, migrations \| `db-analyst` \| N+1, undefined vs null, missing models, query performance \|
20	\| New modules, moved files, cross-layer imports, large refactors \| `architecture-reviewer` \| Dependency direction, circular deps, god files, dead code, modularity \|
21
22	If changes are small (<50 lines), run code-reviewer only. If security argument, run security-reviewer only. Add `architecture-reviewer` when the change reshapes structure (new module boundaries, files moved across layers, a refactor spanning several directories) rather than editing within existing files.
23
24	## Step 2: Code quality review (via code-reviewer agent)
25
26	The agent checks:
27	- Readability and naming conventions (matches project patterns?)
28	- DRY: duplicated logic that should be extracted
29	- Error handling: all async paths covered? Consistent error shapes?
30	- Component/function size: single responsibility?
31	- Static-typing discipline where the language has it: no unchecked escapes (TypeScript `any`, Java raw `Object`, Go `interface{}`, etc.)
32
33	## Step 3: Security review (via security-reviewer agent)
34
35	The agent checks OWASP Top 10 plus project-specific patterns (read from `CLAUDE.md`):
36	- Injection: SQL injection (raw queries without parameterization), command injection, XSS (unsanitized user input in templates)
37	- Auth gaps: New endpoints/handlers without auth middleware (@UseGuards, defineMiddleware, session check)
38	- Soft-delete violations: Hard DELETE/destroy used instead of soft-delete pattern (check `CLAUDE.md` for convention, e.g., `is_active=false + deleted_at=new Date()`)
39	- Secrets exposure: Hardcoded tokens, passwords, API keys in code (not .env)
40	- API call patterns: Direct low-level fetch calls instead of the project's API composable (check `CLAUDE.md`)
41	- Navigation patterns: Raw router calls instead of the framework-specific navigation function (check `CLAUDE.md`)
42	- CORS/headers: Missing security headers, overly permissive CORS
43	- Dependency CVEs: Check for known vulnerabilities in changed dependencies
44
45	## Step 4: Database review (via db-analyst agent, if applicable)
46
47	The agent checks:
48	- ORM null-handling: many ORMs distinguish "skip field" from "set NULL" (e.g. Prisma's `undefined` vs `null`); mixing them causes bugs
49	- Schema/code drift: unmodeled tables can be dropped by destructive sync commands (e.g. `prisma db push`); verify every table is represented
50	- N+1 queries: findMany/findFirst inside loops; should use `include` or batch queries
51	- Relation loading: Missing `include` for needed relations, or over-fetching with deep includes
52	- Migration safety: Schema changes that could drop data, rename columns, or break existing queries
53
54	## Step 4b: Structural review (via architecture-reviewer agent, if applicable)
55
56	Run only when the change reshapes structure (new modules, files moved across layers, a multi-directory refactor). The agent checks:
57	- Dependency direction: do inner layers avoid importing outer ones? (domain/core should not depend on UI/framework)
58	- Circular dependencies: modules that import each other, directly or through a cycle
59	- God files/modules: single files accumulating unrelated responsibilities
60	- Dead code: exports/modules no longer imported anywhere
61	- Modularity: are boundaries between feat

People who liked this also viewed

6 picks

Type

review-full

61stars19forks

View on GitHub

How to install review-full?

faizkhairi/claude-code-blueprint/review-full

$npx -y skills add faizkhairi/claude-code-blueprint --skill review-full

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	This is a COMPREHENSIVE multi-agent code review. For quick anti-pattern scanning (seconds, not minutes), use review-diff instead.
2
3	## Step 0: Detect scope and project
4
5	- If `$ARGUMENTS` is empty: review uncommitted changes (staged + unstaged via `git diff` + `git diff --cached`)
6	- If `$ARGUMENTS` is a file path: review that file only
7	- If `$ARGUMENTS` is a branch or range: review diff against that ref
8	- If `$ARGUMENTS` is "security": run security-only review (skip to step 3)
9	- Detect project type from cwd/CLAUDE.md and the project manifest (any language/framework), or fall back to inspecting the file structure
10
11	## Step 1: Spawn review agents in parallel
12
13	Launch up to 4 agents based on what the changes touch:
14
15	\| Changes Touch \| Agent to Spawn \| Focus \|
16	\|--------------\|----------------\|-------\|
17	\| Any code \| `code-reviewer` \| Quality, patterns, naming, DRY, error handling, consistency \|
18	\| API endpoints, auth, user input \| `security-reviewer` \| OWASP Top 10, injection, auth gaps, secrets, CORS \|
19	\| Database queries, ORM models, migrations \| `db-analyst` \| N+1, undefined vs null, missing models, query performance \|
20	\| New modules, moved files, cross-layer imports, large refactors \| `architecture-reviewer` \| Dependency direction, circular deps, god files, dead code, modularity \|
21
22	If changes are small (<50 lines), run code-reviewer only. If security argument, run security-reviewer only. Add `architecture-reviewer` when the change reshapes structure (new module boundaries, files moved across layers, a refactor spanning several directories) rather than editing within existing files.
23
24	## Step 2: Code quality review (via code-reviewer agent)
25
26	The agent checks:
27	- Readability and naming conventions (matches project patterns?)
28	- DRY: duplicated logic that should be extracted
29	- Error handling: all async paths covered? Consistent error shapes?
30	- Component/function size: single responsibility?
31	- Static-typing discipline where the language has it: no unchecked escapes (TypeScript `any`, Java raw `Object`, Go `interface{}`, etc.)
32
33	## Step 3: Security review (via security-reviewer agent)
34
35	The agent checks OWASP Top 10 plus project-specific patterns (read from `CLAUDE.md`):
36	- Injection: SQL injection (raw queries without parameterization), command injection, XSS (unsanitized user input in templates)
37	- Auth gaps: New endpoints/handlers without auth middleware (@UseGuards, defineMiddleware, session check)
38	- Soft-delete violations: Hard DELETE/destroy used instead of soft-delete pattern (check `CLAUDE.md` for convention, e.g., `is_active=false + deleted_at=new Date()`)
39	- Secrets exposure: Hardcoded tokens, passwords, API keys in code (not .env)
40	- API call patterns: Direct low-level fetch calls instead of the project's API composable (check `CLAUDE.md`)
41	- Navigation patterns: Raw router calls instead of the framework-specific navigation function (check `CLAUDE.md`)
42	- CORS/headers: Missing security headers, overly permissive CORS
43	- Dependency CVEs: Check for known vulnerabilities in changed dependencies
44
45	## Step 4: Database review (via db-analyst agent, if applicable)
46
47	The agent checks:
48	- ORM null-handling: many ORMs distinguish "skip field" from "set NULL" (e.g. Prisma's `undefined` vs `null`); mixing them causes bugs
49	- Schema/code drift: unmodeled tables can be dropped by destructive sync commands (e.g. `prisma db push`); verify every table is represented
50	- N+1 queries: findMany/findFirst inside loops; should use `include` or batch queries
51	- Relation loading: Missing `include` for needed relations, or over-fetching with deep includes
52	- Migration safety: Schema changes that could drop data, rename columns, or break existing queries
53
54	## Step 4b: Structural review (via architecture-reviewer agent, if applicable)
55
56	Run only when the change reshapes structure (new modules, files moved across layers, a multi-directory refactor). The agent checks:
57	- Dependency direction: do inner layers avoid importing outer ones? (domain/core should not depend on UI/framework)
58	- Circular dependencies: modules that import each other, directly or through a cycle
59	- God files/modules: single files accumulating unrelated responsibilities
60	- Dead code: exports/modules no longer imported anywhere
61	- Modularity: are boundaries between feat

People who liked this also viewed

6 picks

Type