What problem does it solve?
Prevents vulnerable, buggy, or low-quality code from being committed by reviewing staged or unstaged changes for security risks, likely defects, and quality regressions.
Core Features & Use Cases
- Two-pass risk review: Performs an initial pass that blocks commits on critical security findings and a second pass for informational issues like test gaps and debug leftovers.
- Risk-tiered file classification: Assigns each changed file a risk tier (CRITICAL/HIGH/MEDIUM/LOW) based on blast radius areas such as auth, crypto, and data access logic.
- Removed-code audit: Investigates deleted lines—especially in Tier 1–2 areas—using git history to determine whether security guards were relaxed or removed.
- Breadth of checks: Looks for secrets, injection vectors (e.g., SQLi), XSS risks, insecure fail-open patterns, concurrency/TOCTOU issues, and boundary validation problems.
Quick Start
Run the review-changes skill to scan your current staged or unstaged git changes and get a risk-tiered report of critical and informational findings before you commit.