AB code-review
Review a code change for correctness, security, maintainability, and test adequacy, and reach a defensible verdict. Use when reviewing a pull request, diff, patch, or AI-generated change; when scoping an oversized review into reviewable units; when writing or triaging review comments; when assigning reviewers or setting review policy; or when investigating why a defect escaped review. Covers change sizing and attention budgets, risk-tiered checklists, severity-labeled comments, verdict and residual-risk records, review metrics that resist gaming, and the measured limits of checklists and AI reviewers. Do not use for implementing the requested change, root-cause debugging of a failing test or incident (use systematic-debugging), security assessment of a whole system (use security-audit-methodology), designing new code securely (use secure-software-engineering), architecture review across systems (use software-architecture), or reverse-engineering an unfamiliar codebase (use software-architecture-analysis).
Review a code change for correctness, security, maintainability, and test adequacy, and reach a defensible verdict.
As a process B 69/100 · Nearly there — weak spots: result and completion, running it twice, progress reporting
How to improve
- A spec.yaml with trigger phrases and assertions — a behaviour contract for CI; `skilltest init` writes a template.
Guard findings · 0
✓ No critical or high findings
Files scanned: 19. Evidence is masked. Grey chips explain why severity was lowered.
Against the Agent Skills spec
✓ No remarks against the Agent Skills spec
Process rating: all ten parameters 69/100
- 0Progress reporting. Says nothing while it works
- 30Running it twice. 1 mutating operations with no state check
- 40Result and completion. Does not say what the result is
- 50When it triggers. No condition that starts the skill
- 50Failures and branches. 0 branches, has a failure section
- 60Tools and files. Uses tools (bash, python) that frontmatter does not declare
- 100Steps. 37 steps
- 100Inputs and preconditions. Inputs and preconditions are listed
- 100Consistency. Name and required fields are in place
- 100Execution cost. Instruction body is 3609 tokens
- low No test case covers injection arriving through data
Everything here is measured from the skill text rather than judged by a model, so the numbers are checkable. A parameter weighs more when it is a more common reason for the process to stall.
Quality signals
- +5Description has no quoted example phrases that should trigger the skill
- +3Description length 1020: 120–800 characters recommended
- +3Output format is not stated: the model decides each time
- +2Single-language instructions
- +4Description says when NOT to use the skill
- +4Structure: 18 headings
- +3Step-by-step instructions: 37 items
- +4Has examples (2 code blocks)
- +4Reference files are cited in the instructions (8 of 8)
- +3All 4 scripts are documented
- +1License stated
Quality base 70; lint remarks subtract, signals add up to 100. Result: 93.