skills.rest
a2mus
a2musCOMMUNITY
Explore all skills by this author →
GitHub

speckit-code-review

Review uncommitted code diffs for security and quality issues.

Updated Apr 7, 2026
Search Tags:#security#pre-commit#vulnerabilities#code-quality#static-analysis#code-review#secrets-detection
One-click install
npx skills add https://github.com/a2mus/smart-da3m --skill speckit-code-review
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: speckit-code-review
Source: https://github.com/a2mus/smart-da3m/tree/main/.agents/skills/speckit-code-review
Command: npx skills add https://github.com/a2mus/smart-da3m --skill speckit-code-review

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill automates a focused security and quality review of uncommitted changes and diffs to detect high-risk issues early in the development workflow, reducing the chance of shipping vulnerabilities or low-quality code.

Core Features & Use Cases

  • Security checks: Detects hardcoded credentials, API keys, tokens, SQL injection, XSS, missing input validation, insecure dependencies, and path traversal risks.
  • Code quality rules: Flags overly long functions, very large files, deep nesting, missing error handling, console/log statements, and TODO/FIXME comments.
  • Reporting & remediation: Produces a Markdown report with severity (CRITICAL, HIGH, MEDIUM, LOW), file locations, line numbers, descriptions, and suggested fixes and attempts to fix CRITICAL/HIGH issues immediately.
  • Use Cases: Pre-commit or pre-merge checks, CI gating for pull requests, security triage during code review, and automated remediation of the most severe findings.

Quick Start

Run a speckit code review on the repository to scan uncommitted changes and generate a prioritized security and quality report.

Frequently Asked Questions about speckit-code-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run a security code review on uncommitted git changes before committing?▼

To run a security code review on uncommitted changes, apply a scanning skill to your repository diff to detect hardcoded credentials, injection vectors, and missing validation. This generates a severity-ranked Markdown report with file locations, line numbers, and suggested fixes.

What security vulnerabilities and code quality issues can pre-commit static analysis detect?▼

Pre-commit static analysis can detect hardcoded credentials, SQL injection, XSS, path traversal, insecure dependencies, and missing input validation. It also flags code quality issues like overly long functions, deep nesting, missing error handling, and TODO comments.

How do I automatically fix critical security findings detected in my pre-commit diff?▼

To automatically fix critical security findings, run a code review on your uncommitted changes that includes remediation capabilities. The review will immediately attempt to resolve critical and high severity issues while generating a Markdown report for the remaining findings.

Does this security code review require a specific project structure to function?▼

Yes, this security code review requires a spec-kit project structure featuring a .specify/ directory. You must have this specific directory layout in your repository to perform the automated security and quality analysis on your uncommitted changes.

Can I use this static analysis to gate pull requests in CI pipelines?▼

Yes, you can use this static analysis to gate pull requests in CI pipelines by applying it to repository diffs. It produces a severity-ranked report identifying vulnerabilities and code-quality issues across changed files to block unsafe merges.

Related Skills

Explore More Software Engineering Skills→
igmo71igmo71

speckit-git-commit

Automatically commit uncommitted changes after Spec Kit commands complete.

Community
Intermediate
pilotspacepilotspace
2

unsafe-audit

Audit unsafe blocks in the Moon codebase for soundness and safety comments.

Official
Advanced
saitarrunsaitarrun
4

setup-pre-commit

Configure Husky pre-commit hooks with lint-staged and Prettier for JavaScript and TypeScript repositories.

Community
Intermediate
inbharataiinbharatai
22

secret-scanner

Detect hardcoded secrets, API keys, and credentials in code repositories.

Community
Intermediate