RE

review-change

Generates a security and quality audit report for repository changes.

Install

mkdir -p .claude/skills/review-change && curl -L -o skill.zip "https://agentskills.codes/api/skills/download/18161" && unzip -o skill.zip -d .claude/skills/review-change && rm skill.zip

Installs to .claude/skills/review-change

Activation

This is the description your AI agent reads to decide when to run this skill — the better it matches your request, the more reliably it fires.

Produces a numbered review report under `docs/reviews/`.
56 chars · catalog descriptionno explicit “when” trigger
Intermediate

Key capabilities

  • Inspect changed files using `git status`, `git diff`, and `git diff --staged`
  • Check for safety issues like dangerous commands or modifications outside the repository
  • Verify privacy by checking for API keys, passwords, or private hostnames
  • Check documentation for correctness, manual step markers, and platform specificity
  • Verify macOS / Arch separation in content and scripts
  • Produce a structured review report with blocking and non-blocking findings

How it works

The skill inspects changed files, performs checks for safety, privacy, documentation, and platform separation, then categorizes findings and produces a review report.

Inputs & outputs

You give it
A set of changed files in a Git repository
You get back
A Markdown review report file under `docs/reviews/`

When to use review-change

  • Review repo changes
  • Security audit of scripts
  • Verify safe configuration changes

About this skill

Skill: review-change

Produces a numbered review report under docs/reviews/.

When to use

  • Builder has completed a set of changes.
  • User wants validation before committing.
  • Any significant change to the repository that touches dotfiles, scripts, or config.

Process

Step 1 — Inspect changed files

Run:

git status
git diff
git diff --staged

List every file that was created or modified.

Step 2 — Check safety

For each file, verify:

  • No stow --adopt command present as automated behavior.
  • No rm targeting $HOME or paths outside the repository.
  • No mv targeting $HOME or paths outside the repository.
  • No ln -s creating symlinks in $HOME without clear manual-step markers.
  • No modification of files outside the repository root.
  • Risky commands are shown with ⚠️ MANUAL STEP markers, not executed automatically.

Step 3 — Check privacy

For each file, verify:

  • No API keys, tokens, or access credentials.
  • No passwords or passphrases.
  • No SSH private key content.
  • No private hostnames or internal IP addresses.
  • No work-specific secrets or environment variables.
  • All examples use placeholder values (YOUR_API_KEY, your-token-here).

Step 4 — Check documentation

For each documentation file, verify:

  • Commands are copy-pasteable and correct.
  • Dangerous commands have ⚠️ MANUAL STEP markers.
  • Platform-specific commands clearly specify the target OS.
  • PRD, architecture, and plan references are accurate.

Step 5 — Check macOS / Arch separation

Verify:

  • macOS-specific content is not placed in Arch directories or docs.
  • Arch-specific content is not placed in macOS directories or docs.
  • Common packages genuinely work on both platforms.
  • Platform detection is used in any multi-platform scripts.

Step 6 — Produce findings

Categorize each finding as:

  • Blocking — must be fixed before commit.
  • Non-blocking — improvement, does not block commit.

Step 7 — Produce verdicts

Issue explicit verdicts:

  • Safety: PASS or FAIL
  • Privacy: PASS or FAIL
  • Documentation: PASS or FAIL

All three must be PASS before recommending commit.

Step 7a — Mark the Plan Complete (implementation reviews only)

If this is an implementation review (reviewing Builder output) and all three verdicts are PASS:

  1. Open the plan file referenced in the review (under docs/plans/).
  2. Change **Status:** Approved to **Status:** Complete.
  3. Record the plan number and title in the Summary of the review report.

If any verdict is FAIL, leave the plan status as Approved.

See docs/claude/DOCUMENT-LIFECYCLE.md for the full lifecycle rules.

Step 8 — Produce the review report

Write the report to a numbered file:

docs/reviews/0001-claude-operating-layer-review.md
docs/reviews/0002-zsh-package-review.md

Use the next available number in the sequence.

Review report template

# Review: [Title]

**Number:** 0001
**Status:** Complete
**Date:** YYYY-MM-DD
**Plan reviewed:** [number] — [title]
**Files reviewed:** [list]

## Summary

[What was reviewed — name the Plan completed, e.g. "Plan 0007 — Implement Zsh Configuration Foundation"]

## Blocking Issues

- [issue — file:line if applicable]

## Non-Blocking Suggestions

- [suggestion]

## Safety Verdict

PASS / FAIL — [reason]

## Privacy Verdict

PASS / FAIL — [reason]

## Documentation Verdict

PASS / FAIL — [reason]

## Recommended Next Action

[Fix blocking issues and re-review / Approve and commit]

When not to use it

  • When the user is not asking for a review report
  • When the user is not validating changes before committing
  • When there are no significant changes to dotfiles, scripts, or config

Limitations

  • Review focuses on specific safety, privacy, documentation, and platform separation criteria
  • Requires Git to inspect changed files
  • The skill produces a report but does not automatically fix issues

How it compares

This skill provides a systematic, multi-faceted review process with explicit verdicts and a structured report, ensuring adherence to safety, privacy, and documentation standards, which is more rigorous than a manual code review.

Compared to similar skills

review-change side by side with the closest alternatives in the catalog.

SkillInstallsUpdatedSafetyDifficulty
review-change (this skill)01moReviewIntermediate
github-code-review132moReviewAdvanced
reviewing-code218moNo flagsIntermediate
reviewing-nextjs-16-patterns118moReviewIntermediate

Try saying

Example prompts that trigger this skill in your AI assistant.

Search skills

Search the agent skills registry