Generates a security and quality audit report for repository changes.
Install
mkdir -p .claude/skills/review-change && curl -L -o skill.zip "https://agentskills.codes/api/skills/download/18161" && unzip -o skill.zip -d .claude/skills/review-change && rm skill.zipInstalls to .claude/skills/review-change
Activation
This is the description your AI agent reads to decide when to run this skill — the better it matches your request, the more reliably it fires.
Produces a numbered review report under `docs/reviews/`.Key capabilities
- →Inspect changed files using `git status`, `git diff`, and `git diff --staged`
- →Check for safety issues like dangerous commands or modifications outside the repository
- →Verify privacy by checking for API keys, passwords, or private hostnames
- →Check documentation for correctness, manual step markers, and platform specificity
- →Verify macOS / Arch separation in content and scripts
- →Produce a structured review report with blocking and non-blocking findings
How it works
The skill inspects changed files, performs checks for safety, privacy, documentation, and platform separation, then categorizes findings and produces a review report.
Inputs & outputs
When to use review-change
- →Review repo changes
- →Security audit of scripts
- →Verify safe configuration changes
About this skill
Skill: review-change
Produces a numbered review report under docs/reviews/.
When to use
- Builder has completed a set of changes.
- User wants validation before committing.
- Any significant change to the repository that touches dotfiles, scripts, or config.
Process
Step 1 — Inspect changed files
Run:
git status
git diff
git diff --staged
List every file that was created or modified.
Step 2 — Check safety
For each file, verify:
- No
stow --adoptcommand present as automated behavior. - No
rmtargeting$HOMEor paths outside the repository. - No
mvtargeting$HOMEor paths outside the repository. - No
ln -screating symlinks in$HOMEwithout clear manual-step markers. - No modification of files outside the repository root.
- Risky commands are shown with
⚠️ MANUAL STEPmarkers, not executed automatically.
Step 3 — Check privacy
For each file, verify:
- No API keys, tokens, or access credentials.
- No passwords or passphrases.
- No SSH private key content.
- No private hostnames or internal IP addresses.
- No work-specific secrets or environment variables.
- All examples use placeholder values (
YOUR_API_KEY,your-token-here).
Step 4 — Check documentation
For each documentation file, verify:
- Commands are copy-pasteable and correct.
- Dangerous commands have
⚠️ MANUAL STEPmarkers. - Platform-specific commands clearly specify the target OS.
- PRD, architecture, and plan references are accurate.
Step 5 — Check macOS / Arch separation
Verify:
- macOS-specific content is not placed in Arch directories or docs.
- Arch-specific content is not placed in macOS directories or docs.
- Common packages genuinely work on both platforms.
- Platform detection is used in any multi-platform scripts.
Step 6 — Produce findings
Categorize each finding as:
- Blocking — must be fixed before commit.
- Non-blocking — improvement, does not block commit.
Step 7 — Produce verdicts
Issue explicit verdicts:
- Safety: PASS or FAIL
- Privacy: PASS or FAIL
- Documentation: PASS or FAIL
All three must be PASS before recommending commit.
Step 7a — Mark the Plan Complete (implementation reviews only)
If this is an implementation review (reviewing Builder output) and all three verdicts are PASS:
- Open the plan file referenced in the review (under
docs/plans/). - Change
**Status:** Approvedto**Status:** Complete. - Record the plan number and title in the Summary of the review report.
If any verdict is FAIL, leave the plan status as Approved.
See docs/claude/DOCUMENT-LIFECYCLE.md for the full lifecycle rules.
Step 8 — Produce the review report
Write the report to a numbered file:
docs/reviews/0001-claude-operating-layer-review.md
docs/reviews/0002-zsh-package-review.md
Use the next available number in the sequence.
Review report template
# Review: [Title]
**Number:** 0001
**Status:** Complete
**Date:** YYYY-MM-DD
**Plan reviewed:** [number] — [title]
**Files reviewed:** [list]
## Summary
[What was reviewed — name the Plan completed, e.g. "Plan 0007 — Implement Zsh Configuration Foundation"]
## Blocking Issues
- [issue — file:line if applicable]
## Non-Blocking Suggestions
- [suggestion]
## Safety Verdict
PASS / FAIL — [reason]
## Privacy Verdict
PASS / FAIL — [reason]
## Documentation Verdict
PASS / FAIL — [reason]
## Recommended Next Action
[Fix blocking issues and re-review / Approve and commit]
When not to use it
- →When the user is not asking for a review report
- →When the user is not validating changes before committing
- →When there are no significant changes to dotfiles, scripts, or config
Limitations
- →Review focuses on specific safety, privacy, documentation, and platform separation criteria
- →Requires Git to inspect changed files
- →The skill produces a report but does not automatically fix issues
How it compares
This skill provides a systematic, multi-faceted review process with explicit verdicts and a structured report, ensuring adherence to safety, privacy, and documentation standards, which is more rigorous than a manual code review.
Compared to similar skills
review-change side by side with the closest alternatives in the catalog.
| Skill | Installs | Updated | Safety | Difficulty |
|---|---|---|---|---|
| review-change (this skill) | 0 | 1mo | Review | Intermediate |
| github-code-review | 13 | 2mo | Review | Advanced |
| reviewing-code | 21 | 8mo | No flags | Intermediate |
| reviewing-nextjs-16-patterns | 11 | 8mo | Review | Intermediate |
Try saying
Example prompts that trigger this skill in your AI assistant.
You might also like
github-code-review
ruvnet
Comprehensive GitHub code review with AI-powered swarm coordination
reviewing-code
CaptainCrouton89
Systematically evaluate code changes for security, correctness, performance, and spec alignment. Use when reviewing PRs, assessing code quality, or verifying implementation against requirements.
reviewing-nextjs-16-patterns
djankies
Review code for Next.js 16 compliance - security patterns, caching, breaking changes. Use when reviewing Next.js code, preparing for migration, or auditing for violations.
cookbook-audit
anthropics
Audit an Anthropic Cookbook notebook based on a rubric. Use whenever a notebook review or audit is requested.
pr-review
pytorch
Review PyTorch pull requests for code quality, test coverage, security, and backward compatibility. Use when reviewing PRs, when asked to review code changes, or when the user mentions "review PR", "code review", or "check this PR".
find-bugs
davila7
Find bugs, security vulnerabilities, and code quality issues in local branch changes. Use when asked to review changes, find bugs, security review, or audit code on the current branch.