The problem

Automated CI tests and linters catch syntax errors and regressions, but they cannot identify architectural risks. Developers often ship breaking API changes, security vulnerabilities, or untested logic because these require human-like judgment to spot in a diff.

What it does

• Identifies breaking changes in public Python APIs, such as altered function signatures, renamed symbols, or changed return types.
• Flags security-sensitive code modifications involving authentication, secret handling, raw SQL construction, and unsafe deserialization.
• Audits dependency changes for new third-party packages, major version bumps, or unpinned requirements that introduce supply-chain risk.
• Detects test coverage gaps by cross-referencing changed production logic against the presence of corresponding new or updated test files.
• Performs deep-dive inspections for Django and FastAPI projects, specifically checking migrations, serializers, Pydantic schemas, and dependency injection.

Frameworks & tools

Python, Django, FastAPI, Pydantic, Django REST Framework, and standard dependency managers like Poetry, Pipenv, or requirements.txt.

Why this beats prompting it yourself

General-purpose LLM reviews often focus on stylistic nits or generic advice. This skill uses a structured multi-step methodology to enforce specific checks for breaking changes and security patterns that generic prompts miss. It ensures framework-specific hazards, like Django migration risks or FastAPI permission bypasses, are consistently surfaced.

Use cases

• Reviewing a git diff before opening a pull request to ensure no public APIs are broken.
• Auditing a contributor's PR for hidden security risks in auth or database logic.
• Checking if a bug fix includes the necessary test case to prevent future regressions.
• Verifying that new dependencies meet basic project standards for version pinning and maintenance.

Known limitations

This skill requires a diff (before/after) to function correctly and cannot review files in isolation. It does not execute code, run tests, or perform actual static analysis.