Skip to content
Back to skills

Review It

ASecurity

Pre-PR review: grade a finished change by risk, have another model family review it, and fix the findings. Use before opening or updating a PR.

  • 3 stars
  • 0 votes
  • 0 copies
  • 1 view
  • Added September 29, 2026
ai-agentsgosecurity

Security analysis

A100/100

Pro scans all 18 files and shows the line behind each finding

Scanned October 7, 2026

npx -y skills add hcaiano/skills --skill review-it --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Review It?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Review It
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/hcaiano-review-it/badge)](https://www.skillsdirectory.com/skills/hcaiano-review-it)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: review-it
description: "Pre-PR review: grade a finished change by risk, have another model family review it, and fix the findings. Use before opening or updating a PR."
---

# Review it

## 1. Pin

Run the affected checks, commit everything including new files, fetch the
target branch, and pin `<merge-base with origin/<target>>..HEAD`. HEAD stays fixed while reviewers run.

Write down the intent and acceptance criteria, chat-only ones included, and the
model families that wrote the change, delegated workers included. Unknown
authorship counts as every family that may have written it.

## 2. Grade

- `skip`: only docs, comments or copy; no code that runs and no agent
  instructions.
- `single`: any other change bounded to one subsystem.
- `dual`: security, auth, permissions, payments, migrations, destructive data,
  infrastructure, concurrency, public contracts, cross-subsystem changes,
  ambiguous requirements, or unbounded impact.

When unsure, grade up. A grade the user gives is a floor. `skip` goes straight
to the receipt.

## 3. Review

`single`: one reviewer from a family that did not write the change. Take the
first such seat in the `interrogate reviewers` line of `pstack-models.md` and
resolve it with `t3-capacity`. The brief carries the absolute path of the
[review brief](references/review-brief.md), the worktree, the pinned range, the
intent and acceptance criteria, and the paths of any spec, issue and repo
instruction files.

`dual`: run `interrogate` on the pinned range with the same intent; its Act On
findings are the findings.

Staff every reviewer, `dual` seats and the final review included, through
`delegate_task` in runtime mode `full-access` with the read-only brief: a
headless run has nobody to approve it. A capacity fallback never lands on the
author's family; when no other family has capacity, report a blocker. Only the
user can waive the family rule, and the receipt then names the waiver; an
earlier model choice in the session waives nothing. Where `delegate_task` is
unavailable, as in a subagent (`parent_not_active`), hand the pinned range back
to the parent as a blocker.

A review counts once it returns a substantive verdict on the pinned HEAD; restaff
refusals, quota errors and empty results. A material finding or a `dual` risk
promotes `single` to `dual`.

## 4. Fix

Verify and deduplicate the findings, then apply the valid in-scope ones,
structural simplifications included, in one batch. Out-of-scope ideas become
follow-ups. New contracts, architecture changes or fixes that roughly double
the diff go to the user. Rerun the affected checks and commit.

When the fixes change behavior, scope, security or architecture, run one final
review: a new reviewer on the new HEAD with the prior findings, from a family
that wrote none of the reviewed code, fixes included. Apply, check and commit
its valid findings; anything needing another such change goes to the user.

## 5. Receipt

Return this line for `write-pr`'s Review section, plus any blocker and its next
step:

`**Review.** <skip | single | dual> by <models>; <n> fixed, <n> rejected; reviewed <short SHA>`

Files in this skill

  • SKILL.md6 KB
  • agents/openai.yaml246 B
  • references/review-brief.md4.5 KB
  • references/visible-herdr-runs.md5.7 KB
  • scripts/headless-claude.mjs6.3 KB
  • scripts/headless-claude.test.mjs6 KB
  • scripts/headless-codex.mjs9.3 KB
  • scripts/headless-codex.test.mjs10.9 KB
  • scripts/headless-cursor.mjs5.5 KB
  • scripts/headless-cursor.test.mjs3.1 KB
  • scripts/headless-run.mjs2.3 KB
  • scripts/headless-run.test.mjs4 KB
  • scripts/herdr-visible-run.mjs12.5 KB
  • scripts/herdr-visible-run.test.mjs10.4 KB
  • scripts/run-transport.mjs13 KB
  • scripts/run-transport.test.mjs7.6 KB
  • scripts/skill-contract.test.mjs1.9 KB
  • scripts/transport-lib.mjs2.1 KB

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.