vellum-change-review

Review Vellum Assistant code diffs for correctness, security risks, and missing validation.

1.2k|166|Updated Feb 7, 2026
One-click install
npx skills add https://github.com/vellum-ai/vellum-assistant --skill vellum-change-review
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: vellum-change-review
Source: https://github.com/vellum-ai/vellum-assistant/tree/main/.cursor/skills/vellum-change-review
Command: npx skills add https://github.com/vellum-ai/vellum-assistant --skill vellum-change-review

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Reviewing changes in a multi-package repository is error-prone: package boundary violations, missing migrations, unregistered feature flags, and untested behavior slip through manual review. This Skill enforces the repository's specific quality rules so every diff gets a consistent, thorough check before merge.

Core Features & Use Cases

  • Package Boundary Enforcement: Verifies that assistant, gateway, skills, and meta packages do not import each other in forbidden ways.
  • Migration and Flag Validation: Checks that schema changes ship with append-only, idempotent migrations and that new feature flags are registered in meta/feature-flags/feature-flag-registry.json.
  • Structured Review Output: Produces findings with severity, open questions, and verification gaps in a consistent Markdown format.
  • Use Case: Before opening a PR that touches the gateway package and adds a database column, run this review to catch a missing migration and a cross-package import before CI or a human reviewer does.

Quick Start

Ask the assistant to review the current diff in this repository using the vellum-change-review checklist before opening a pull request.

Frequently Asked Questions about vellum-change-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I review a diff before opening a pull request?

Run this review on the actual diff before judging the change. It checks package boundaries, migrations, feature flags, user-facing copy, and test coverage, then outputs findings with severity, open questions, and verification gaps.

What package boundary rules does this repository enforce?

The assistant and gateway packages must not import each other by relative path, assistant and skills must not import each other directly, and runtime code must not import from meta. Violations are flagged as review findings.

When are database migrations required for a change?

Any DB schema or data change needs an append-only migration, and workspace path or format changes need append-only workspace migrations. Migrations must be idempotent and registered to pass review.

How should new feature flags be added in this repo?

New assistant flags must be declared in meta/feature-flags/feature-flag-registry.json. Default-disabled or rollout-only features must not ship user-facing release notes, and some flags require a companion platform PR.

What test commands does the review recommend?

The review prefers scoped tests such as bun test path/to/test.ts over broad bun test runs. When type-level risk is broad, it suggests running bunx tsc --noEmit to catch type errors.