Works with the AI Agents you already use
Claude Code
Cursor
Codex CLI
Muse
Dots+21 moreClaude CodeCursorCodex CLIMuseDots
Manus
Grok
Grok Bot+18 agentsCode Reviewer — Severity-Rated PR Review + Fix Plan
Unlike free code-review prompts: a merge verdict first, findings that quote the exact line, confidence per finding, 6 lenses and a merge checklist.
$3
Code Reviewer — Severity-Rated PR Review + Fix Plan
Example session with this skill installed
intent: Add password reset token endpoint
diff_or_files: |
- router.post('/reset', (req, res) => {
- const token = crypto.randomBytes(20).toString('hex');
- db.query(
UPDATE users SET token = '${token}' WHERE email = '${req.body.email}'); - sendEmail(req.body.email, token);
- res.status(200).send('Sent');
- });
language_stack: Node, Express, Postgres
risk_context: Auth and user data
- Read your context and instructions
- Compiled the code reviewer
Code review: Add password reset token endpoint
Intent: Add password reset token endpoint
Scope: Express router snippet
Stack: Node, Express, Postgres
Risk context: Auth and user data
Base: Not stated
Generated: 2026-10-19 · Draft for human verification
1. Executive readout
- Merge recommendation: hold
- Blockers (critical/high): 2 — SQL Injection and lack of token expiration.
- Notable mediums: 1 — Reset token stored in plain text.
- Confidence in this review: high
- Biggest unknown: Token expiration logic and database schema details.
2. Change map
| Area / file | What appears to change | Notes |
|---|---|---|
router.post | New /reset endpoint | Handles token generation and DB update |
3. Findings
Critical
| ID | Location | Issue | Evidence | Suggested fix / verify | Confidence |
|---|---|---|---|---|---|
| C1 | db.query | SQL Injection | WHERE email = '${req.body.email}' | Use parameterized queries: WHERE email = $1 | High |
High
| ID | Location | Issue | Evidence | Suggested fix / verify | Confidence |
|---|---|---|---|---|---|
| H1 | UPDATE users | No Token Expiry | Token is set without a expires_at timestamp | Add a timestamp column and check it during reset | High |
Medium
| ID | Location | Issue | Evidence | Suggested fix / verify | Confidence |
|---|---|---|---|---|---|
| M1 | UPDATE users SET token | Reset token stored in plain text | SET token = '${token}' | Store only a hash of the token and compare hashes on reset | Medium |
4. Lens summary
| Lens | Status | Top note |
|---|---|---|
| Correctness | mixed | Lacks check if user actually exists |
| Security | risk | Critical SQL injection vulnerability |
| Performance | clear | Single query operation |
| Reliability | risk | No error handling for db.query or sendEmail |
| Tests & observability | not assessed | No tests provided |
| Maintainability | clear | Logic is simple but unsafe |
5. Test and verification gaps
| Gap | Why it matters before merge | Suggested check |
|---|---|---|
No tests in the supplied diff for /reset | Auth change touching user data | Test that the email is passed as a query parameter, not concatenated |
| Token expiry not testable yet | Reset links would stay valid forever | After adding expiry, test that an expired token is rejected |
6. Merge checklist
- Critical/high findings addressed (C1 SQL injection and H1 token expiry still open)
- Secrets not committed
- New behaviour has meaningful checks
- Error paths for external calls handled
- Human reviewer sign-off for Auth changes
Next steps
- Refactor the database query to use placeholders to prevent SQL injection.
- Implement a
token_expiryfield in the database to prevent permanent reset links. - Wrap the database and email operations in a try/catch block for better reliability.
Connects securely to your tools. The creator never sees your data.
About this skill
Commit → PR description → Review
Unlike free code-review prompts that hand back a flat list of comments, this skill opens with a merge verdict (ship as-is / ship after fixes / hold). Every finding quotes the line it comes from and carries a confidence level. It reviews through 6 lenses (correctness, security, performance, reliability, tests, maintainability), lists test gaps and finishes with a merge checklist. It reviews only the diff you supply: no invented line numbers or CVE IDs, and no "safe to merge" guarantees.
Sample output (excerpt; input: a new Express password-reset endpoint diff · Node, Express, Postgres · risk context: auth and user data): Merge recommendation: hold · Blockers (critical/high): 2 — SQL injection and no token expiry · Confidence in this review: high Biggest unknown: token expiration logic and database schema details.
| ID | Location | Issue | Evidence | Suggested fix / verify | Confidence |
|---|---|---|---|---|---|
| C1 | db.query | SQL Injection | WHERE email = '${req.body.email}' | Use parameterized queries: WHERE email = $1 | High |
| H1 | UPDATE users | No Token Expiry | Token is set without a expires_at timestamp | Add a timestamp column and check it during reset | High |
| M1 | UPDATE users SET token | Reset token stored in plain text | SET token = '${token}' | Store only a hash of the token and compare hashes on reset | Medium |
| Lens | Status | Top note |
|---|---|---|
| Security | risk | Critical SQL injection vulnerability |
| Reliability | risk | No error handling for db.query or sendEmail |
| Performance | clear | Single query operation |
Merge checklist: [ ] Critical/high findings addressed (C1 and H1 still open) · [ ] Error paths for external calls handled · [ ] Human reviewer sign-off for Auth changes Next steps: switch the query to placeholders · add a token expiry field · wrap the database and email calls in try/catch.
You get 7 fixed sections every time: executive readout with merge verdict, change map, findings by severity (critical / high / medium / low) with evidence and confidence, 6-lens summary, test and verification gaps, merge checklist, caveat.
Works in Claude Code, Cursor and Codex · tested on real data · no invented line numbers, CVE IDs or "safe to merge" claims · v1.0, updated Oct 2026 · questions answered via Agensi messages within 24h · More Cygnix Labs tools: https://apify.com/cygnix_labs
The problem A generic "review this code" prompt misses the issue that matters. Paste a diff or PR and get a structured, severity-rated review (critical / high / medium) with a merge recommendation, evidence-tied findings and a fix plan, covering correctness, security, performance, reliability, tests, and maintainability. You get evidence-tied findings, suggested fixes, test gaps, and a merge checklist—without fake CVE scores, invented auto-fixes, or “guaranteed safe to merge” claims. Built for developers and small teams who want a sharper first-pass review than a generic chat prompt. Human verification required.
Built by Cygnix Labs · info@cygnixlabs.com · cygnixlabs.com
How to use
- 1
Connect your agent to the Agensi MCP
Copy the prompt and paste it into Claude, ChatGPT, Cursor or any agent that supports MCP. It sets up the connection for you. Manual setup
- 2
Sign in to Agensi
Your agent shows a sign-in link. Sign in and click Allow.
- 3
Ask for what you need
Your agent loads this skill and uses it on your task. It always asks before any payment.
Reviews
No reviews yet
Be one of the first to try it. Every listed skill goes through the trust checks below.
Security scanned
Checked by our 8-point scan before listing
Fresh listing
Recently published to Agensi
Money-back guarantee
Doesn't do what its page promises? You get your money back.
Trust & safety
Security scan
Security scan passed 1 month ago