ck:code-review

Review code changes for security vulnerabilities, race conditions, and failure modes.

1|Updated Mar 6, 2026

Search Tags:#security #code-review #adversarial #pr-review #commit-review #codebase-scan

Ready to run

npx skills add https://github.com/quanganh208/cookmate --skill ck-code-review-quanganh208

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: ck:code-review
Source: https://github.com/quanganh208/cookmate/tree/main/.opencode/skills/code-review
Command: npx skills add https://github.com/quanganh208/cookmate --skill ck-code-review-quanganh208

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Provides adversarial, evidence-first code reviews that detect security vulnerabilities, false assumptions, race conditions, resource exhaustion, and other failure modes that typical style or checklist reviews miss, preventing risky merges and regressions.

Core Features & Use Cases

Multi-mode input: resolve review targets from PR numbers, commit hashes, --pending diffs, or full codebase scans.
Three-stage pipeline: spec compliance, code quality review, and an always-on adversarial (red-team) stage that actively tries to break the changes.
Actionable, verifiable output: structured findings with severity, category, file:line locations, exploitation steps, impact, and recommended fixes; integrates with task-managed review pipelines and re-review optimization.

Quick Start

Review PR #123 with adversarial rigor focusing on security, failure modes, and concrete remediation guidance.

Frequently Asked Questions about ck:code-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I run an adversarial code review on a pull request?▼

To run an adversarial code review on a pull request, provide the PR number to trigger a three-stage pipeline: spec compliance, code quality review, and a red-team stage that actively tries to break the changes to expose security vulnerabilities and failure modes.

What security vulnerabilities can a red-team code review expose?▼

A red-team code review exposes critical security vulnerabilities, false assumptions, race conditions, resource exhaustion, and other failure modes that typical style or checklist reviews miss, preventing risky merges and regressions.

Can I review staged or unstaged pending diffs before committing?▼

Yes, you can review staged or unstaged pending diffs by using the --pending input mode, applying the full adversarial review pipeline to identify security vulnerabilities and failure modes in your local changes before they are committed.

How do I scan an entire codebase for security flaws?▼

You can scan an entire codebase for security flaws by triggering a full codebase scan, which performs an engineer-led audit using the adversarial review pipeline to detect vulnerabilities, false assumptions, and resource exhaustion across the project.

What is included in structured code review findings?▼

Structured code review findings include severity, category, file:line locations, attack descriptions, impact assessments, and remediation guidance, providing actionable and verifiable evidence for identified security vulnerabilities and failure modes.

Does adversarial code review work with specific commit hashes?▼

Yes, adversarial code review works with specific commit hashes by resolving the review target from the hash and applying the three-stage pipeline to expose security vulnerabilities, race conditions, and false assumptions introduced in that commit.