review-changes

Review uncommitted git diffs for security vulnerabilities and correctness bugs.

Updated Aug 23, 2026
One-click install
npx skills add https://github.com/escotilha/claude-public --skill review-changes-escotilha
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: review-changes
Source: https://github.com/escotilha/claude-public/tree/main/skills/review-changes
Command: npx skills add https://github.com/escotilha/claude-public --skill review-changes-escotilha

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Prevents vulnerable, buggy, or low-quality code from being committed by reviewing staged or unstaged changes for security risks, likely defects, and quality regressions.

Core Features & Use Cases

  • Two-pass risk review: Performs an initial pass that blocks commits on critical security findings and a second pass for informational issues like test gaps and debug leftovers.
  • Risk-tiered file classification: Assigns each changed file a risk tier (CRITICAL/HIGH/MEDIUM/LOW) based on blast radius areas such as auth, crypto, and data access logic.
  • Removed-code audit: Investigates deleted lines—especially in Tier 1–2 areas—using git history to determine whether security guards were relaxed or removed.
  • Breadth of checks: Looks for secrets, injection vectors (e.g., SQLi), XSS risks, insecure fail-open patterns, concurrency/TOCTOU issues, and boundary validation problems.

Quick Start

Run the review-changes skill to scan your current staged or unstaged git changes and get a risk-tiered report of critical and informational findings before you commit.

Frequently Asked Questions about review-changes

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run a security review on my git diff before committing?

Run a pre-commit security review on your git diff to analyze staged, unstaged, and untracked files for vulnerabilities. The review assigns risk tiers to changed files and blocks commits when critical security findings are detected.

What is risk-tiered file classification for uncommitted changes?

Risk-tiered file classification evaluates uncommitted changes by assigning each file a CRITICAL, HIGH, MEDIUM, or LOW tier based on its blast radius across security areas like auth, crypto, and data access logic.

How do I prevent secrets and SQL injection vulnerabilities from being committed?

Prevent secrets and SQL injection vulnerabilities from being committed by running a two-pass review on your git changes. The first pass blocks commits on critical findings like injection vectors and hardcoded secrets.

Can I check removed code in git history for relaxed security guards?

Yes, you can check removed code for relaxed security guards. A removed-code audit investigates deleted lines in high-risk tier areas using git history to determine if security protections were weakened or removed.

Does the code review process catch insecure fail-open patterns and concurrency issues?

The code review process catches insecure fail-open patterns, concurrency issues, and TOCTOU race conditions. It performs a second informational pass to report these breadth checks alongside test gaps and debug leftovers.

When should I use a pre-commit code review instead of a standard linter?

Use a pre-commit code review instead of a standard linter when you need to analyze uncommitted git diffs for deep security vulnerabilities and correctness bugs in critical areas like authorization and boundary validation.