ck:code-review

Review diffs, commits, and pull requests for security and correctness issues.

Updated Apr 2, 2026
One-click install
npx skills add https://github.com/hidonguyen/trade-ops --skill ck-code-review-hidonguyen
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: ck:code-review
Source: https://github.com/hidonguyen/trade-ops/tree/main/.opencode/skills/code-review
Command: npx skills add https://github.com/hidonguyen/trade-ops --skill ck-code-review-hidonguyen

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill identifies security holes, false assumptions, and failure modes in diffs, commits, PRs, and full codebases so teams can block risky merges and prioritize fixes with evidence rather than opinions.

Core Features & Use Cases

  • Multi-mode input: Accepts PR numbers/URLs, commit hashes, --pending changes, or full codebase scans and resolves the appropriate diff and context.
  • Three-stage workflow: Runs spec compliance, code quality, and always-on adversarial (red-team) review with scope gates, adjudication, and re-review optimizations.
  • Actionable outputs: Produces findings with severity, category, location, attack, impact, and fix guidance plus Accept/Reject/Defer verdicts and integration points for task pipelines and re-verification.
  • Use case: Audit a merge-ready PR to surface critical security issues that must be fixed before merging, convert medium findings into tracked tasks, and verify fixes with targeted diffs.

Quick Start

Run an adversarial review on PR #123 and return a concise, evidence-based report listing accepted, rejected, and deferred findings with suggested fixes.

Frequently Asked Questions about ck:code-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
What is adversarial code review and how does it find security holes in pull requests?

Adversarial code review red-teams pull requests to find security holes, false assumptions, and race conditions. It runs spec compliance, code quality, and adversarial stages, then adjudicates findings with Accept, Reject, or Defer verdicts.

How do I run a security audit on pending git changes before merging?

Run a security audit on pending git changes by providing --pending changes, commit hashes, or PR numbers. The review fetches diffs, applies scope gates, and produces actionable reports containing severity, attack vectors, and remediation guidance.

Can I use diff analysis to check spec compliance and code readiness for a full codebase scan?

Diff analysis supports full codebase scans to check spec compliance and readiness for merge. It resolves appropriate context, runs multi-stage reviews, and returns evidence-based findings to block risky merges and prioritize fixes.

What is the best way to review a pull request for race conditions and failure modes?

The best way to review a pull request for race conditions and failure modes is applying an adversarial red-team review. It surfaces critical security issues with specific locations, impacts, and fix guidance, converting medium findings into tracked tasks.

How do I verify remediation fixes after an initial security audit?

Verify remediation fixes by running a targeted re-review on updated diffs. The adjudication process re-evaluates previous findings, confirms whether security holes and false assumptions are resolved, and outputs integration points for re-verification.