Skip to content
Back to skills

Commands

ASecurity

Load the best-matching skill doc from skills/ and apply it to the current task

  • 4 stars
  • 0 votes
  • 0 copies
  • 4 views
  • Added September 2, 2026
ai-agentsbashnode

Security analysis

A100/100

Pro scans all 7 files and shows the line behind each finding

Scanned September 24, 2026

npx -y skills add s977043/river-review --skill commands --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Commands?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Commands
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/s977043-commands/badge)](https://www.skillsdirectory.com/skills/s977043-commands)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
description: Load the best-matching skill doc from skills/ and apply it to the current task
argument-hint: '[keyword-or-skill-id]'
allowed-tools: Bash(node:*), Bash(rg:*), Read
---

Find the best matching review skill for: $ARGUMENTS

The portable dependency key is a **skill ID**, not a physical path. The bundled
skill collection lives under `${CLAUDE_PLUGIN_ROOT:-.}/skills/` in the full plugin
or repository checkout.

Steps:

1. Set `RIVER_ROOT="${CLAUDE_PLUGIN_ROOT:-.}"`.
2. If `$ARGUMENTS` matches the safe skill-ID grammar
   `^[a-z0-9][a-z0-9._-]*$`, try exact resolution first:
   `node "$RIVER_ROOT/scripts/resolve-skill-id.mjs" "$RIVER_ROOT" "$ARGUMENTS"`.
3. On exit 0, use `Read` on the returned `SKILL.md`. The resolver verifies the
   declared ID and rejects ambiguous packages.
4. If this invocation came from another skill's owner-skill delegation and exact
   resolution fails, record the owner as unresolved / `skippedSkills`. Do not
   keyword-fallback or reconstruct the missing specialist knowledge by guess.
5. For an ad-hoc user keyword (not an owner-skill delegation), an unresolved exact
   lookup may fall back to a case-insensitive search across the whole collection:
   `rg -i -l -F -g 'SKILL.md' -- "$ARGUMENTS" "$RIVER_ROOT/skills"`.
6. Inputs containing slash, backslash, `..`, whitespace, or other characters
   outside the ID grammar are never sanitized into another ID. Path-like input
   must not be treated as an owner skill ID.
7. Summarize the selected skill's workflow rules and apply them to the current task.

For `river skills export`, the same resolver contract applies to the export root:
`<export-root>/<skill-id>/SKILL.md`. Exported files carry the canonical ID under
`metadata.rr.id`; the resolver verifies that value before returning a package.

See `docs/development/skill-id-resolution-contract.md` for the full ownership,
resolution, and degradation contract.

Files in this skill

  • challenge.md1.9 KB
  • check.md949 B
  • pr.md1.6 KB
  • review-local.md419 B
  • review-team.md3.5 KB
  • setup-team.md2.9 KB
  • skill.md754 B

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.