review

Review pull request diffs for critical safety, security, and correctness issues.

Updated Jul 21, 2025
One-click install
npx skills add https://github.com/robertzengcn/aiFetchly --skill review-robertzengcn
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: review
Source: https://github.com/robertzengcn/aiFetchly/tree/main/.agents/skills/gstack/review
Command: npx skills add https://github.com/robertzengcn/aiFetchly --skill review-robertzengcn

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill eliminates the risk of merging code with critical safety, security, and correctness issues that manual PR reviews often miss, preventing production incidents, data leaks, and costly rollbacks.

Core Features & Use Cases

  • Two-Pass Critical Review: First pass flags high-severity issues like SQL injection, race conditions, LLM output trust violations, and shell injection; second pass catches informational issues like async/sync mixing, column name mismatches, and dead code.
  • Specialist Subagent Checks: Runs parallel specialist reviews for API contracts, data migrations, maintainability, performance, security, and red team adversarial analysis for diffs over 200 lines.
  • Use Case: For example, if you are merging a PR that adds a new user-facing feature with database queries and LLM-generated content, this Skill will flag unparameterized SQL queries, missing N+1 eager loading, and unvalidated LLM output saved to the database.

Quick Start

Ask the AI to run the review skill on your open PR diff to catch critical bugs and safety issues before you merge.

Frequently Asked Questions about review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate pre-merge code review to catch security and correctness issues?

Automated pre-merge code review identifies critical safety and correctness issues before code is merged to the main branch, preventing production incidents and reducing manual review overhead. It applies to all code diffs against a base branch.

What is the best way to detect SQL injection and race conditions in a pull request?

Detecting SQL injection and race conditions in pull requests is best handled by a two-pass critical review system. The first pass flags high-severity issues like SQL injection, shell injection, and LLM output trust violations.

Can I validate LLM output trust boundaries and unparameterized SQL queries before merging?

You can validate LLM output trust boundaries and unparameterized SQL queries before merging. The review process flags unvalidated LLM output saved to the database and missing N+1 eager loading in database queries.

How does pre-merge validation handle large pull request diffs over 200 lines?

Pre-merge validation handles pull request diffs over 200 lines by running parallel specialist subagent checks. These specialized reviews analyze API contracts, data migrations, maintainability, performance, security, and red team adversarial analysis.

What informational code issues does an automated PR review catch?

Automated PR review catches informational code issues during its second pass. This includes identifying async/sync mixing, column name mismatches, and dead code to improve overall code quality before landing.

When do I need automated pre-merge validation for my engineering team?

You need automated pre-merge validation when manual PR reviews frequently miss critical safety and security issues. It enforces security best practices and prevents production incidents, data leaks, and costly rollbacks before code is merged.