adversarial-review

Hunts correctness, security, contract, and fake-green defects in pull requests before merge.

1|Updated Aug 14, 2026
One-click install
npx skills add https://github.com/zhiyuan-zhang0206/Ava --skill adversarial-review-zhiyuan-zhang0206
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: adversarial-review
Source: https://github.com/zhiyuan-zhang0206/Ava/tree/main/.agents/skills/adversarial-review
Command: npx skills add https://github.com/zhiyuan-zhang0206/Ava --skill adversarial-review-zhiyuan-zhang0206

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Ordinary code review and green CI routinely miss semantic defects: string-compared watermarks, swallowed exceptions, fail-open checks, and fake-green test runs. This Skill performs a structured adversarial review of every PR before it enters the merge queue, assuming the diff is defective and hunting for what breaks and when. ## Core Features & Use Cases - Nine review dimensions: correctness and data flow, boundary polarity, contracts, silent failure, security, unbounded growth, test quality, design invariants (R1-R4), and documentation sync, each with concrete defect classes drawn from real incidents. - Verification-chain validation: proves CI green is real before reviewing by inspecting run durations, artifacts, coverage gates, and proof-of-work, catching fake-green signatures like seconds-long full suites. - Pattern library matching: matches diffs against a catalog of defect classes the repo has actually shipped, plus adversarial techniques like impact-surface tracing and reverse scenarios. - Use Case: Before enqueueing a PR that touches the event pipeline, run this Skill to verify CI genuinely ran, trace watermark advancement on failure paths, and produce a P0/P1/P2 report posted as a PR comment. ## Quick Start Run an adversarial review on PR number 123 and post the verdict report as a PR comment.

Frequently Asked Questions about adversarial-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I review a pull request for hidden bugs before merging?

Run an adversarial review that assumes the diff is defective: verify CI genuinely ran, then walk nine dimensions covering correctness, polarity, contracts, silent failure, security, growth, test quality, invariants, and docs. Every finding must cite file:line with evidence and a suggested fix.

How to detect fake-green CI runs on GitHub pull requests?

Inspect run durations and artifacts with gh run view rather than trusting the check box. A full backend suite finishing in seconds, missing junitxml artifacts, skipped checks, or NO_WORKFLOW_RUNS are documented fake-green signatures requiring local verification.

What severity levels should a code review report use?

This Skill uses three levels: P0 for production risk like data loss, leaks, or silent failure; P1 for clear bugs, contract breaks, and resource leaks; P2 for hygiene. P0 and P1 block merge, and an empty report on a clean diff is a valid outcome.

Can the PR author perform their own adversarial review?

No. The reviewer must be the repo steward or a dedicated reviewer agent named by the delegator, never the PR author, because reviewing your own diff is self-confirmation and defeats the adversarial stance.

When should adversarial review run in the merge process?

It runs after the PR is open and CI is verified genuinely green, but before the PR is enqueued for merge. Findings loop back to the author for fixes or evidence-based rebuttals, and the reviewer re-checks only changed hunks.