review

Reviews pull request diffs for SQL safety, race conditions, and structural issues.

2|Updated Mar 26, 2026
One-click install
npx skills add https://github.com/westkite1201/garden-engine --skill review-westkite1201
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: review
Source: https://github.com/westkite1201/garden-engine/tree/main/.claude/skills/gstack/review
Command: npx skills add https://github.com/westkite1201/garden-engine --skill review-westkite1201

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Code review before merging often misses structural issues that tests don't catch, such as SQL injection risks, race conditions, unvalidated LLM output, and incomplete enum handling. This Skill analyzes your branch's diff against the base branch and surfaces these problems before code lands. ## Core Features & Use Cases - Two-Pass Diff Review: Runs a critical pass (SQL & data safety, race conditions, LLM trust boundaries, enum completeness) followed by an informational pass (dead code, test gaps, performance, CI/CD issues). - Scope Drift & Plan Completion Audit: Compares the diff against TODOS.md, PR descriptions, and plan files to detect scope creep and missing requirements. - Fix-First Workflow: Automatically applies mechanical fixes (dead code, magic numbers, N+1 queries) and asks the user only about judgment calls like security or design decisions. - Greptile & Design Review Integration: Triages Greptile bot comments on the PR and runs a conditional design checklist when frontend files change. - Use Case: Before merging a feature branch, ask for a pre-landing review to get a report of critical and informational issues with auto-applied fixes and cited file:line references. ## Quick Start Ask the assistant to review this PR or run a pre-landing review of my current branch against the base branch.

Frequently Asked Questions about review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I review a PR diff for security issues before merging?

Run the review workflow on your feature branch; it fetches the base branch, generates the full diff, and applies a checklist covering SQL injection, XSS, race conditions, and unvalidated LLM output. Findings are cited with file:line references and suggested fixes.

What does the pre-landing review check that tests don't catch?

It catches structural issues like TOCTOU race conditions, missing eager loading, enum values not handled in all consumers, conditional side effects, magic numbers, and CI/CD pipeline misconfigurations. These are categorized into critical and informational severity passes.

Does the review automatically fix the issues it finds?

Yes, mechanical fixes like dead code removal, magic number extraction, and stale comment updates are auto-applied. Riskier changes involving security, race conditions, or user-visible behavior are batched into a question for your judgment.

Can the review detect scope creep against my plan?

Yes, it reads TODOS.md, PR descriptions, commit messages, and plan files to extract actionable items, then cross-references them against the diff. Items are classified as DONE, PARTIAL, NOT DONE, or CHANGED, and out-of-scope changes are flagged as drift.

Does the review work with Greptile bot comments on GitHub PRs?

Yes, it fetches Greptile line-level and top-level comments via the GitHub API, classifies them as valid, already fixed, false positive, or suppressed, and posts evidence-based replies. This step is skipped silently if no PR or comments exist.

When is the design review checklist triggered?

The design review runs only when the diff touches frontend files, detected via a scope script. It checks for AI-slop patterns, typography issues, missing focus states, and DESIGN.md violations, and skips silently for backend-only changes.