Skip to content
Back to skills

Grandpa Review

ASecurity

Review a diff or PR for removable complexity, unnecessary dependencies, fragile patterns, and missed native alternatives. Produces a structured review with specific line-level feedback.

  • 2 stars
  • 0 votes
  • 0 copies
  • 0 views
  • Added October 4, 2026
ai-agentsreactnextjsapi

Works with

  • cli
  • api

Security analysis

A100/100

Scanned October 4, 2026

npx -y skills add bytewhisker/grandpa --skill grandpa-review --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Grandpa Review?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Grandpa Review
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/bytewhisker-grandpa-review/badge)](https://www.skillsdirectory.com/skills/bytewhisker-grandpa-review)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: grandpa-review
description: Review a diff or PR for removable complexity, unnecessary dependencies, fragile patterns, and missed native alternatives. Produces a structured review with specific line-level feedback.
---

# Grandpa Review: PR and Diff Architecture Review

Review the provided diff, PR, or set of changed files. For each change, evaluate:

## Review Criteria

1. **New Dependencies Added**
   - Was a package added that has a native stdlib alternative?
   - Does the new dependency duplicate functionality already in the project?
   - What is the package's maintenance status and dependency tree depth?

2. **Fragile Patterns Introduced**
   - Any `fetch` call missing `res.ok` check or `AbortSignal.timeout`?
   - Any empty catch blocks or swallowed errors?
   - Any unvalidated external input being used directly?

3. **Unnecessary Complexity**
   - Any new abstraction layers (interfaces, factories, base classes) with a single implementation?
   - Any new config files for values that are used in exactly one place?
   - Any wrapper functions that pass through to another function without adding logic?

4. **Missed Native Alternatives**
   - Could a `<dialog>` replace a modal library?
   - Could `<input type="date">` replace a date picker?
   - Could `structuredClone()` replace a deep clone library?
   - Could `crypto.randomUUID()` replace a UUID library?

5. **Framework Safety**
   - React 19: Any `useEffect` + `setState` that could be a Server Component?
   - Next.js: Any `'use client'` on a component that uses no client APIs?
   - Hydration safety: Any imperative DOM manipulation in server-rendered code?

## Output Format

For each file in the diff, provide:

```
FILE: <path>

  Line <n>: [BLOAT] Added `uuid` package -- use `crypto.randomUUID()` instead.
  Line <n>: [FRAGILE] fetch() without AbortSignal.timeout -- add timeout guard.
  Line <n>: [SMELL] New interface with single implementation -- remove interface, use class directly.
  Line <n>: [OK] Clean, minimal, production-safe.

VERDICT: <APPROVE | REQUEST_CHANGES | COMMENT>
```

Keep feedback actionable. Every objection must include a specific fix. No vague "consider simplifying" -- say exactly what to change and why.

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.