📦

review

Name: review
Author: mattpocock

Content revision r1 Medium Risk ⚙️ External commands

Review Code Changes Against Standards and Specs

Code changes can follow style rules but still miss the requested behavior. This skill compares a diff against repo standards and a source spec in separate reviews.

Supports: Claude Codex Code(CC)

📊 69 Adequate

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "review" from https://skillstore.io/skills/mattpocock-review.md and its manifest at https://skillstore.io/api/skills/mattpocock-review/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/mattpocock-review.md Signed manifest GET /api/skills/mattpocock-review/manifest Signed lockfile GET /api/skills/mattpocock-review/lockfile

Test it

Using "review". Review against main.

Expected outcome:

Standards review reports one missing architecture note. Spec review reports no missing requirement. Summary lists one standards finding and zero spec findings.

Using "review". Review against origin/main using the checkout spec.

Expected outcome:

Standards review finds no documented violations. Spec review identifies a missing refund requirement and one behavior outside the requested scope.

Using "review". Review since v1.8.0 with no available spec.

Expected outcome:

Standards review lists two convention issues. Spec review is skipped because no issue, PRD, or spec was available.

Security Audit

Medium Risk

v4 • 7/5/2026 Open versioned report

Most static findings are false positives caused by Markdown inline-code backticks around filenames, headings, and examples. One external command instruction is confirmed because the skill tells the agent to run git diff and git log, and a semantic finding notes that the user-supplied fixed point should not be passed through without validation.

Files scanned

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (1)

Medium

SKILL.md:21-23

Unsanitized User-Supplied Git Ref In Command

The skill says to pass the user fixed point through, then use it in git diff and git log commands. If executed through a shell, metacharacters in the ref could alter the command.

Lines 21 and 23 directly connect user-provided text with shell-style git command examples. Exploitability depends on how the agent executes the command, so confidence is high but not absolute.

Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

SKILL.md:23

Ruby/shell backtick execution

Capture the diff command once: `git diff <fixed-point>...HEAD` (three-dot, so the comparison is agai

This line instructs the agent to run git diff and git log commands with a user-supplied fixed point. It is legitimate review behavior, but it is still external command execution and needs argument-safety guidance.

Risk Factors

⚙️ External commands (14)

SKILL.md:8 SKILL.md:15 SKILL.md:21 SKILL.md:23 SKILL.md:29 SKILL.md:31 SKILL.md:38 SKILL.md:39 SKILL.md:40 SKILL.md:41 SKILL.md:42 SKILL.md:43 SKILL.md:49 SKILL.md:67

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/mattpocock-review/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/mattpocock-review/security.svg)](https://skillstore.io/skills/mattpocock-review?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/mattpocock-review?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/mattpocock-review/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/mattpocock-review.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

mattpocock. (2026). review security audit report (audit version 4) [Author version unspecified]. Skillstore. https://skillstore.io/skills/mattpocock-review/audits/4

BibTeX citation

@techreport{mattpocock-mattpocock-review-2026,
  author = {mattpocock},
  title = {review security audit report (audit version 4)},
  institution = {Skillstore},
  year = {2026},
  number = {4},
  url = {https://skillstore.io/skills/mattpocock-review/audits/4},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "review security audit report (audit version 4)"
version: "unspecified"
type: report
authors:
  - name: "mattpocock"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/mattpocock-review/audits/4"
identifiers:
  - type: other
    value: "skillstore:mattpocock-review:audit:4"
    description: "Skillstore immutable audit report identifier"

Compare variants

2 installable variants

Each author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.

Why this variant is first

Highest Skillstore Score

Author / source Skillstore Score Evidence Confidence Skillstore usage Updated

Chachamaru127 Recommended

chachamaru127-review

Skillstore Score 79

Evidence Confidence High

Skillstore usage 7

Updated

2026-08-21

mattpocock Current

mattpocock-review

Skillstore Score 69

Evidence Confidence Medium

Skillstore usage 6

Updated

2026-08-21

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Pull Request Readiness

Check a branch against main before requesting review, with standards and spec issues separated.

Spec Compliance Review

Compare implementation details with an issue, PRD, or spec before delivery.

Standards Enforcement

Find places where a change conflicts with documented team conventions.

Try These Prompts

Review Against Main

Review my current branch against main using the review skill.

Review Since Commit

Review changes since commit <commit_sha>. Use the issue or PRD referenced by the commits when available.

Review With Spec Path

Review this branch against origin/main. Use specs/payments-redesign.md as the spec source.

Review Release Branch

Review release/candidate against v2.4.0. Separate documented standards violations from spec gaps, and keep the axes independent.

Best Practices

Provide the fixed point and spec path when you know them.
Keep repository standards documents current and easy to find.
Review the two result sections independently before prioritizing work.

Avoid

Using the skill without a fixed point.
Treating the spec review as a substitute for tests.
Merging the two review axes into one ranked list.

Frequently Asked Questions

What does this skill review?

It reviews changes between HEAD and a fixed point for standards violations and spec mismatches.

Does it require a spec?

No. If no spec is available, the Spec section should say that it was skipped.

Which tools does it support?

It supports Claude, Codex, and Claude Code.

Does it execute tests?

No. It reviews diffs and documents. Run tests separately when needed.

Can it review work in progress?

It is best for committed branch work because the process compares HEAD against a fixed point.

Why are Standards and Spec separated?

A change can satisfy one axis and fail the other. Separate reports make that visible.

Developer Details

Author

mattpocock

License

MIT

Skillstore revision

Version notice

The author did not declare a version.

Repository

https://github.com/mattpocock/skills/tree/main/skills/in-progress/review/

Ref

62e2a730c5cd74eab4c7164309d810de660fcea3

Maintenance freshness

7/18/2026

Usage

2 downloads · 0 views

File structure

📄 SKILL.md