review

Reviews pull request diffs for SQL safety, race conditions, and LLM trust boundary violations.

Updated Sep 13, 2026
One-click install
npx skills add https://github.com/abdulazeezoj/monovella-poc --skill review-abdulazeezoj
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: review
Source: https://github.com/abdulazeezoj/monovella-poc/tree/main/.agents/skills/gstack/review
Command: npx skills add https://github.com/abdulazeezoj/monovella-poc --skill review-abdulazeezoj

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Catching structural defects before code lands is hard: SQL injection, race conditions, unsafe LLM output handling, and enum gaps slip through manual review. This Skill runs a structured pre-landing review of your branch diff so real problems surface with file:line citations before merge. ## Core Features & Use Cases - Two-pass checklist review: Pass 1 flags critical issues (SQL safety, race conditions, LLM trust boundaries, shell injection, enum completeness); Pass 2 covers informational findings like async/sync mixing, type coercion, and CI/CD pipeline issues. - Adversarial multi-model review: Dispatches a Claude adversarial subagent plus optional Codex passes (adversarial challenge and structured review with a P1 gate on diffs over 200 lines), then synthesizes cross-model findings. - Fix-First workflow: Mechanical fixes (dead code, N+1 queries, magic numbers) are auto-applied; judgment calls (security, race conditions, large fixes) are batched into a single decision question. - Greptile triage and design review: Classifies Greptile bot comments as valid, fixed, or false positive with evidence-based replies, and runs a frontend design checklist when the diff touches UI files. - Use Case: Before merging a feature branch, ask for a pre-landing review; the Skill diffs against the base branch, runs all passes, auto-fixes mechanical issues, and reports remaining findings with recommended fixes. ## Quick Start Ask the assistant to review this PR against the base branch before merging.

Frequently Asked Questions about review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I review a PR diff before merging?

Invoke the review skill on your feature branch; it computes the diff against the base branch and runs a two-pass checklist covering SQL safety, race conditions, LLM trust boundaries, and informational categories. Findings are reported with file:line references and recommended fixes.

What does a pre-landing code review check for?

It checks critical categories first: SQL injection, TOCTOU races, unsafe HTML rendering, LLM output written without validation, and shell injection. A second pass covers async/sync mixing, column name safety, type coercion at boundaries, time window bugs, and CI/CD pipeline issues.

Does the review skill auto-fix the issues it finds?

Yes, mechanical fixes like dead code, N+1 queries, magic numbers, and missing eager loading are applied automatically. Riskier findings such as security issues, race conditions, and changes over 20 lines are batched into a single question for your judgment.

Can I use Codex for a second opinion on my diff?

Yes, when the Codex CLI is installed and authenticated, the skill runs an adversarial Codex pass on every diff and a structured review with a P1 gate on diffs of 200 or more lines. Without Codex, a Claude adversarial subagent still runs on every review.

Why does the review skip the design checklist on some branches?

The design checklist only runs when the diff touches frontend files, detected via the gstack-diff-scope tool. If SCOPE_FRONTEND is false, the design review is skipped silently and only code-level categories are evaluated.

How are Greptile bot comments handled during review?

Greptile comments are fetched via the GitHub API, filtered against per-project suppression history, and classified as valid, already fixed, or false positive. Replies use tiered templates with concrete evidence, and outcomes are logged to a history file for future suppression.