suede-code

Review code changes and assign an A-F ship grade with evidence-based findings.

123|10|Updated May 24, 2026
One-click install
npx skills add https://github.com/JasonColapietro/suede-creator-skills --skill suede-code-jasoncolapietro
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: suede-code
Source: https://github.com/JasonColapietro/suede-creator-skills/tree/main/skills/suede-code
Command: npx skills add https://github.com/JasonColapietro/suede-creator-skills --skill suede-code-jasoncolapietro

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Code review often splits into two disconnected activities: finding bugs and deciding whether to ship. This Skill combines both in one pass, producing file:line-evidenced findings alongside a blunt A-F grade, a deploy-safety gate, and a commit-hygiene scan, so reviewers get a complete ship decision without juggling separate tools. ## Core Features & Use Cases - Combined review and grading: Runs Instant-F security triggers, language-specific trap checks (TypeScript, React, Next.js, Drizzle/Prisma, Swift/iOS), and OWASP Top 10 analysis, then scores seven lanes from Correctness to Deploy Readiness into one overall A-F grade. - Deploy Safety and Commit Dirt gates: Evaluates breaking changes, rollback safety, blast radius, and environment readiness, plus scans every added diff line for secrets, debug artifacts, conflict markers, and accidentally staged files. - Threat mitigation verification: A --threat-verify mode checks that mitigations declared in a threat model are actually implemented, classifying each as CLOSED, OPEN, or UNREGISTERED. - Use Case: Before merging a PR that touches payment webhook handling, invoke the skill to get P0-P3 findings with fix paths, a grade capped by the payment-surface rules, and a ship/hold recommendation. ## Quick Start Use the suede-code skill to review and grade this pull request, including security checks and a deploy-safety verdict.

Frequently Asked Questions about suede-code

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I review and grade a pull request before merging?

Invoke the skill explicitly with a request like "review and grade this PR." It returns severity-ordered findings with file:line evidence and fix paths, seven lane grades combined into an overall A-F grade, and a ship, ship-with-caveats, or hold recommendation.

What security checks does an automated code review run?

The skill runs Instant-F triggers for hardcoded secrets, injection, auth bypass, payment flaws, and plaintext sensitive data, plus the full OWASP Top 10 when auth, API, middleware, crypto, session, or payment code is detected. Each finding cites the OWASP category.

Does this code review skill support Swift and iOS projects?

Yes, it includes Swift/iOS language traps such as force unwraps, strong self captures in escaping closures, main-thread UI mutations, actor reentrancy, and unstable ForEach identifiers. It also covers TypeScript, React, Next.js, and Drizzle/Prisma patterns.

Can the skill auto-fix the issues it finds?

Only with the --fix flag or an explicit request. It auto-applies local P2/P3 fixes as individual commits, but P0/P1 fixes are presented as briefs first and never auto-applied to auth, payment, or data-migration code without explicit confirmation.

When should I not use the combined review and grade skill?

Use suede-code-review when you want findings only with accessibility and SEO lanes, suede-code-grader for the letter grade alone, suede-ci-gate to enforce verdicts in CI, and suede-ai-eval for LLM, RAG, or agent behavior coverage.