change-review

Review bounded diffs for defects, security regressions, and missing tests with severity-ranked findings.

Updated Aug 1, 2026
One-click install
npx skills add https://github.com/QuyDu/Skills-Orchestrator --skill change-review-quydu
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: change-review
Source: https://github.com/QuyDu/Skills-Orchestrator/tree/main/.github/skills/change-review
Command: npx skills add https://github.com/QuyDu/Skills-Orchestrator --skill change-review-quydu

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Reviewing code changes manually is slow and inconsistent, and it is easy to miss security regressions, requirement gaps, or missing tests hidden inside a diff. This Skill performs a disciplined, read-only review of a precisely bounded change and produces severity-ranked, evidence-backed findings. ## Core Features & Use Cases - Bounded Diff Review: Freezes an exact base/head or working-tree scope and evaluates only that change, never unrelated pre-existing code. - Severity-Ranked Findings: Ranks confirmed issues by user impact and exploitability, each with location, failure scenario, evidence, and remediation direction. - Dual Reports: Emits machine-readable JSON and human-readable Markdown reports with identical finding IDs and ordering. - Use Case: Before merging a pull request, ask for a review of the branch against its merge base and receive a report flagging a high-severity authorization regression with a missing negative test. ## Quick Start Review the current branch against its merge base and report any defects, security regressions, or missing tests with severity rankings.

Frequently Asked Questions about change-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I review a pull request diff for security issues?

Provide the exact base and head revisions of the pull request along with its intent. The review inspects the diff and nearest call sites for security regressions, ranks confirmed findings by exploitability, and cites concrete evidence for each.

How to review code changes before committing?

Scope the review to your working-tree changes or a commit range, state the intended behavior, and run the review. You receive severity-ranked findings with locations, failure scenarios, and minimal remediation directions in JSON and Markdown reports.

What is the difference between change review and a full code audit?

Change review evaluates only a bounded diff against its intent and surrounding code, while a repository-wide audit assesses the entire codebase. Use change review before commit or merge, and a full audit skill for broader assessment.

Does automated code review modify my files?

No. The review is strictly read-only and never edits the reviewed files. It only writes its two owned reports, change-review.json and change-review.md, and requires approval before remote access or privileged validation.

What happens when a code review finds no issues?

A no-findings result still produces both reports and records test gaps, validation coverage, and residual risk. Unconfirmed concerns are listed as questions or risks rather than findings, so nothing is silently dropped.