review-code

Audit code for high-risk defects with S0–S3 severity classification.

1|Updated Jul 9, 2026
One-click install
npx skills add https://github.com/PiercingXX/xx-stack --skill review-code-piercingxx
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: review-code
Source: https://github.com/PiercingXX/xx-stack/tree/main/runtime/skills/review-code
Command: npx skills add https://github.com/PiercingXX/xx-stack --skill review-code-piercingxx

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

It prevents unsafe merges by systematically identifying high-risk defects, verification gaps, and production hazards before code reaches production.

Core Features & Use Cases

  • Security and safety auditing: surfaces injection, auth, data exposure, and template vulnerability risks with evidence and impact.
  • Reliability validation: flags race conditions and missing error handling that can cause runtime failures.
  • Production readiness checks: reviews performance hotspots (e.g., N+1 patterns, inefficiencies) and completeness signals (logging/monitoring/tests) to reduce incident likelihood.
  • Merge gate decisioning: assigns severity (S0–S3) and determines readiness based on blocker/high-count rules.

Quick Start

Ask the assistant to run a production-grade pre-merge review of the current repository state and return a severity-ranked report with a merge readiness decision.

Frequently Asked Questions about review-code

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run a pre-merge code review to catch critical bugs?

Merge gate readiness is determined by assigning S0–S3 severity classifications to evidence-based findings, blocking merges when high-count or blocker-level defects exceed safe thresholds for production release.

What does a production readiness check cover in a pre-merge audit?

A production readiness check covers performance hotspots like N+1 query patterns, reliability validation for race conditions, and completeness signals such as logging, monitoring, and test coverage to reduce incident likelihood.

How are security vulnerabilities evaluated during a code review?

Security vulnerabilities are evaluated by surfacing injection, authentication, data exposure, and template risks with explicit evidence and impact analysis, flagging uncertainty when validation ladders are unavailable.

Can I use this pre-merge audit on a specific target scope within my repository?

Yes, the pre-merge audit applies across the repository surface relevant to your specific target scope, systematically identifying unsafe changes and verification gaps before code reaches production.

What is the best way to identify performance hotspots before merging code?

Identify performance hotspots by reviewing code for inefficiencies like N+1 patterns and missing completeness signals, ensuring evidence-based findings are classified by severity to determine merge readiness.