More screenshots
Works with the AI Agents you already use
Claude Code
Cursor
Codex CLI
Muse
Dots+22 moreClaude CodeCursorCodex CLIMuseDots
OpenClaw
Manus
Grok
Grok Bot+18 agentsProven Code Review: every serious bug gets a failing test
Same bugs found, far less noise: on Claude Haiku it left 5 nits instead of 25 and proved 76% of its real findings with a test it ran (vs 14%).
Free
Proven Code Review: every serious bug gets a failing test
Example session with this skill installed
Review my current branch before I merge it.
- Read your context and instructions
- Compiled the proven code review
Verdict: BLOCK · 2 findings (2 proven) · Tests: node --test passed (6)
The guard has two holes that turn the login page into an open redirect.
1. [CRITICAL · Proven] src/returnTo.js:3,18: the subdomain regex matches hosts that only start with example.com
What happens: TRUSTED_ORIGIN has no end anchor, so https://example.com.evil.test/… and https://example.com@evil.test/… pass. After login the user lands on an attacker's host.
Evidence:
$ node --test test/review-proof-open-redirect.test.js
https://example.com.evil.test/login -> browser lands on example.com.evil.test
https://example.com@evil.test/login -> browser lands on evil.test
Fix: compare url.hostname against an allowlist instead of regex-matching url.href.
2. [CRITICAL · Proven] src/returnTo.js:15-16: a same-origin URL with a // path becomes a protocol-relative redirect
(Real output from the public benchmark, trimmed.)
Connects securely to your tools. The creator never sees your data.
About this skill
AI code reviews find the bugs. The cost is re-checking every "possible issue" to learn which ones are real.
Blind benchmark, 18 PRs with seeded production bugs, against a prompt-only reviewer on the same model: both found 15/15 bugs. On Claude Haiku this one left 5 nits instead of 25 and backed 76% of its real findings with a test it ran, vs 14% (Claude Opus: 78% vs 43%, zero false positives).
It reads callers outside the diff, drops suspicions it can refute, and hands you the failing test for every Critical and High finding. Read-only on your code.
How it reviews
- Reads beyond the diff. It maps every caller of the changed code, including files the PR never touched: the most expensive bugs live in an unchanged caller that relied on the old behaviour.
- Refutes before reporting. A guard elsewhere, an input that can't reach the code, or intended behaviour means the suspicion is dropped or becomes a question, not a finding.
- Proves the serious ones. The smallest failing test (or one-off command), run, output quoted, then cleaned up and handed to you to keep.
- Clear verdict: BLOCK, REQUEST CHANGES, APPROVE WITH NOTES or APPROVE, plus a "checked and fine" list.
| Blind benchmark | Claude Haiku | Claude Opus |
|---|---|---|
| Real findings backed by a test it ran | 76% (vs 14%) | 78% (vs 43%) |
| Nits | 5 (vs 25) | 9 (vs 18) |
| Precision (real / reported) | 94% (vs 74%) | 100% (vs 98%) |
| Seeded bugs found | 15/15 (tie) | 15/15 (tie) |
Measured on v1.0; v1.1 fixes its one false positive on Haiku. Cases, answer keys, all 72 raw reviews and the blind scores: github.com/Ces107/agent-forge/tree/main/bench/code-review
It also checks the 12 ways coding agents typically go wrong, from "the fix that does not fix" to weakened assertions. Pairs with Proof-of-Done, which stops the agent from saying "done" before the tests pass.
How to use
Skills on Agensi run inside your AI agent. Copy the prompt, paste it into your agent, and it connects to Agensi and installs this skill for you. If a payment is needed, your agent shows it to you first.
Reviews
No reviews yet
Be one of the first to try it. Every listed skill passes our trust checks below.
Security scanned
Passed our 8-point scan before listing
Fresh listing
Recently published to Agensi
Free forever
No account required to browse
Trust & safety
Security scanned
Verified clean today
- Free to download with an account
Requires
Git