Works with the AI tools you already use

    Claude CodeClaude CodeCursorCursorCodex CLICodex CLIGitHub CopilotGitHub CopilotGemini CLIGemini CLI+20 more

    Code Review

    1

    A strict security and quality gate that scans diffs for secrets, injections, and regressions with zero "vibe" tolerance.

    $5

    Secure checkout via Stripe

    30-day refund guarantee

    Converts to your local currency at checkout

    0 installsSecurity scanned
    Code Review

    Code Review

    Example session with this skill installed

    Review the staged changes in src/auth.ts. The test command is 'npm test' and the linter is 'eslint src/auth.ts'. Goal is to ensure no credentials leaked in the new login flow.

    • Read your context and instructions
    • Compiled the code review

    I have completed the security and quality gate for the auth module. The review identified one critical security finding and two non-blocking suggestions.

    Code Review Run: Auth Service

    MetricValue
    ProductAuth Service
    StatusFAILED
    Diff Commandgit diff --cached
    Security Scan1 hit (Hardcoded Secret)
    Quality (Tests)0 new failures (Baseline: 0, Current: 0)
    Independent ReviewerFAILED

    Verification Findings

    • Security [src/auth.ts:42]: Hardcoded assignment to api_key using a string literal.
    • Logic [src/auth.ts:12]: Missing error handling for the identity provider network request.
    • Suggestion: Consider moving the session timeout value to a configuration file.

    Reviewer Verdict

    {
  "passed": false,
  "security_concerns": ["src/auth.ts:42 — Hardcoded api_key literal detected"],
  "logic_errors": ["src/auth.ts:12 — Potential unhandled promise rejection in login sequence"],
  "suggestions": ["Extract timeout constants"],
  "summary": "Review failed due to hardcoded credentials and missing error boundaries."
}

    Next steps

    1. Remove the hardcoded API key from src/auth.ts and use an environment variable.
    2. Wrap the authentication network call in a try/catch block.
    3. Re-run the review once the fixes are staged.

    Connects securely to your tools. The creator never sees your data.

    What you get

    Perform a security-first audit of staged git changes before committing.Identify new test regressions by comparing current state against a baseline.Detect hardcoded secrets and shell injection risks in added lines.Generate a formal findings report citing specific file paths and line numbers.

    About this skill

    The problem

    Vague "looks good to me" reviews miss critical security vulnerabilities and regressions. Developers often lack a structured way to enforce hard gates on secrets, injection risks, and new test failures before a commit lands.

    What it does

    • Scans added lines specifically for secrets, shell injections, unsafe evals, and SQLi.
    • Calculates a quality baseline to distinguish between pre-existing failures and new regressions.
    • Orchestrates an independent reviewer session to eliminate implementation bias.
    • Generates a structured findings report with exact file paths, line numbers, and evidence.
    • Enforces a strict "no vibe" policy by failing reviews that lack concrete technical evidence.

    Frameworks & tools

    Works with any stack providing a CLI interface. Integrates with git, npm test, pytest, ruff, or any buyer-specified test and lint runners.

    Why this beats prompting it yourself

    Standard prompts often result in chatty, non-deterministic feedback or attempts to fix code mid-review. This skill follows a rigid execution order that prevents "vibe-based" approvals and ensures a fresh context for every review to catch errors the implementer might overlook.

    Use cases

    • Pre-commit security gating for sensitive modules.
    • Automated regression checking against a baseline state.
    • Formalizing code quality standards in local development workflows.
    • Identifying hardcoded credentials before they reach the remote repository.

    Known limitations

    Requires the user to provide explicit test and diff commands. Does not support glob patterns for source paths or automated application of suggested fixes.

    How to install

    Works the same in every agent - Claude, Cursor, Codex, Copilot and 20+ more.

    ~30 seconds
    1. 1

      Download the ZIP

      Free skills download straight away. Paid skills unlock right after purchase.

    2. 2

      Unzip into your skills folder

      Every agent reads skills from one folder on your machine. Drop the unzipped folder in there.

    3. 3

      Ask your agent to use it

      Restart the agent if it was already running. It picks the skill up automatically - no config needed.

    Skills folder by agent

    Click the path to copy it. Create the folder if it does not exist yet.

    Reviews

    No reviews yet

    Be one of the first to try it. Every listed skill passes our trust checks below.

    Security scanned

    Passed our 8-point scan before listing

    Fresh listing

    Recently published to Agensi

    30-day refund

    Not a fit? Get your money back

    Trust & safety

    Security scanned

    Verified clean 1 day ago

    • Passed all security checks, Safe to install

    Listed1 day ago

    Frequently Asked Questions