Works with the AI Agents you already use

    Claude CodeClaude CodeCursorCursorCodex CLICodex CLIMuseMuseDotsDots+21 more

    Code Review Gate: Severity-Ranked Pre-Merge Review

    1

    Reviews a branch before merge in four passes, ranks each finding by severity with file and line, checks every finding against the real diff and ends with PASS, REVIEW or BLOCK.

    $5

    Secure checkout via Stripe

    Money-back guarantee

    Converts to your local currency at checkout

    Security scanned
    Code Review Gate: Severity-Ranked Pre-Merge Review

    Code Review Gate: Severity-Ranked Pre-Merge Review

    Example session with this skill installed

    The coding agent finished the feature. Is it ready to merge, and what would block it?

    • Read your context and instructions
    • Compiled the code review gate

    I ran the gate on the bundled demo branch: a small change, of the kind a coding agent might write, that adds a password-reset endpoint.

    Step 1: diff risk map

    • Base: 6b3382f35ba3
    • Size: 4 file(s), +18 −0 line(s) (small; this skill's own thresholds: under 200 changed lines small, under 600 medium)
    filestatus+−sensitive
    app/auth/__init__.pyadded00auth
    app/auth/reset.pyadded160auth
    migrations/0003_reset_tokens.sqladded10auth, migration
    requirements.txtmodified10dependencies

    Lines that may hold a credential (matched by name or as a password in a URL)

    These matches are often ordinary code (a type, a URL template, a UI text). Check each one.

    • app/auth/reset.py line 8: password-named value (20 chars). The value is not shown.

    Dependency changes (reviewed tip compared with the base)

    • requirements.txt: added requests

    Imports it could not match to a declared dependency

    The import name can differ from the package name, and packages of a monorepo or workspace are not known to this check. Confirm each one before you call it missing.

    • app/auth/reset.py line 3: python import flask_mail_sender

    Areas to read closely

    • app/auth/__init__.py: touches authentication, sessions, tokens or permissions
    • app/auth/reset.py: touches authentication, sessions, tokens or permissions
    • migrations/0003_reset_tokens.sql: touches authentication, sessions, tokens or permissions
    • migrations/0003_reset_tokens.sql: touches a database migration
    • requirements.txt: touches a dependency manifest or lockfile
    • Code changed, but no test file changed.

    Step 2: review in four passes (correctness, security, tests, maintainability)

    idseverityfile:linefinding
    F1highapp/auth/reset.py:14Reset token is the user's id, so anyone can guess another user's link
    F2highapp/auth/reset.py:13Unknown email crashes the endpoint (user is None)
    F3highapp/auth/reset.py:8SMTP password is hard-coded (password-named value, 20 chars)
    F4mediumapp/auth/reset.py:3Imports a package that is not declared
    F5lowapp/auth/reset.py:1Unused import
    F6mediumapp/auth/reset.py:40Example of a finding that cites a line outside the diff

    F6 is a deliberate test: it cites a line that is not in the diff.

    Step 3: findings check against the real diff

    findingseverityresult
    F1highverified
    F2highverified
    F3highverified
    F4mediumverified
    F5lowverified
    F6mediumdropped: line is not in the diff on that side

    Verdict: BLOCK

    Blocked by: a verified critical or high finding.

    What this means

    The risk map caught the hard-coded password-named value (shown as type and length only), the undeclared flask_mail_sender import, the auth and migration files and the missing tests.

    • Only the reading caught the guessable reset token and the crash on an unknown email.

    BLOCK means at least one verified high finding: fix F1–F3 before merging. F6 was dropped because its line is not in the diff.

    Want me to review your own branch? I capture the range from the merge base to HEAD first, and I do not post the review anywhere unless you ask.

    Connects securely to your tools. The creator never sees your data.

    About this skill

    Use when a branch or pull request should be reviewed before it is merged and you want findings you can act on and a clear verdict. A standard-library Python script reads the diff from Git® (git's own output) and builds a risk map: the size of the change, the sensitive areas it touches (authentication, migrations, CI, dependency files, secret files), the dependencies it adds to package.json and the Python manifests, the Python and JavaScript/TypeScript imports it could not match to a declared dependency (code models can suggest packages that do not exist, and an undeclared import is easy to miss), and added lines that look like a credential, shown as type and length only. The agent then reviews the diff for correctness, security, tests and maintainability. Before the verdict, the same script checks that every finding points to a line that is really in the diff, with a quote from that line, and drops the ones that do not. The verdict follows fixed rules: BLOCK for a verified critical or high finding, an added key in a known format, or an added or changed secret file; REVIEW for a verified medium finding or any risk flag, including a line that only looks like a credential by its name; PASS otherwise. The scripts print no value they recognise as a credential. It is not a security audit and does not promise to find every bug. Do not use when you want a full security audit, a style-only lint pass or help writing new code.

    Example prompts

    1. "Review this branch before I merge it into main."
    2. "The coding agent finished the feature. Is it ready to merge, and what would block it?"
    3. "Gate this pull request: list what must be fixed first."

    Requires

    Python 3.9+ (standard library only), git, and an agent that can run terminal commands in your repository. On claude.ai the demo runs with code execution enabled; reviewing your own branch needs a local agent with terminal access.

    Compatibility

    Written for SKILL.md-compatible agents, for example Claude Code, Claude.ai skills, Codex CLI, Cursor or Gemini CLI. Each documents the SKILL.md format; not every agent was tested. The seller suggests Claude Sonnet 4.5 or later.

    Limits

    Reviews the committed range from the merge base to HEAD. The import check reads manifests at the top of the repository only, so monorepo and workspace packages show up as unmatched, and an import name can differ from its package name. Credential detection covers common formats only. Needs a POSIX shell (bash or zsh) for the capture block. Thresholds and severity rules are the skill's own heuristics.

    Independence

    Git® is a registered trademark of Software Freedom Conservancy. Not affiliated with or endorsed by the Git project, Software Freedom Conservancy, Anthropic, OpenAI, Anysphere (Cursor) or Google. Other product names are used only to describe compatibility.

    Reviews the committed range from the merge base to HEAD. The import check reads manifests at the top of the repository only, so monorepo and workspace packages show up as unmatched, and an import name can differ from its package name. Credential detection covers common formats only. Needs a POSIX shell (bash or zsh) for the capture block. Thresholds and severity rules are the skill's own heuristics. It is not a security audit.

    How to use

    1. 1

      Connect your agent to the Agensi MCP

      Copy the prompt and paste it into Claude, ChatGPT, Cursor or any agent that supports MCP. It sets up the connection for you. Manual setup

    2. 2

      Sign in to Agensi

      Your agent shows a sign-in link. Sign in and click Allow.

    3. 3

      Ask for what you need

      Your agent loads this skill and uses it on your task. It always asks before any payment.

    Reviews

    No reviews yet

    Be one of the first to try it. Every listed skill goes through the trust checks below.

    Security scanned

    Checked by our 8-point scan before listing

    Fresh listing

    Recently published to Agensi

    Money-back guarantee

    Doesn't do what its page promises? You get your money back.

    Trust & safety

    Security scan

    Security scan passed 9 days ago

    Requires

    Python 3.9+ (standard library only)
    git
    bash or zsh (for the capture block)
    Python
    Node.js

    Permissions

    Terminal / Shell
    Read Files
    Write Files
    Listed9 days ago
    Updated8 days ago

    What's inside

    Frequently Asked Questions

    Before the verdict, a script checks that every finding points to a line that is really in the diff, with a quote from that line. Findings that do not match are dropped and do not count toward the verdict.

    Fixed rules. BLOCK for a verified critical or high finding, an added key in a known format, or an added or changed secret file. REVIEW for a verified medium finding or any risk flag, including a line that only looks like a credential by its name. PASS otherwise.

    No. Lines that look like a credential are shown as a type and a length only. The scripts print no value they recognise as a credential.

    No. The review stays in your session. It is posted to a pull request or a chat only if you ask for that.

    No. It is a pre-merge review of one branch in four passes (correctness, security, tests, maintainability) and it does not promise to find every bug. Use a dedicated audit for that.