Review Code for Bugs and Security Vulnerabilities

This skill reviews changes on the current branch for bugs, security vulnerabilities, and code quality issues via a structured, checklist-driven audit of the branch diff.

Phase 1 (Complete Input Gathering) gets the full diff against the default branch, reading each changed file individually if the diff output is truncated, and lists every modified file before proceeding. Phase 2 (Attack Surface Mapping) identifies, per changed file, all user inputs (request params, headers, body, URL components), database queries, authentication/authorization checks, session/state operations, external calls, and cryptographic operations.

Phase 3 runs an eleven-item security checklist against every file: injection (SQL, command, template, header), XSS (proper output escaping in templates), authentication (checks on all protected operations), authorization/IDOR (access control verified, not just authentication), CSRF (state-changing operations protected), race conditions (TOCTOU in read-then-write patterns), session handling (fixation, expiration, secure flags), cryptography (secure randomness, proper algorithms, no secrets in logs), information disclosure (error messages, logs, timing attacks), DoS (unbounded operations, missing rate limits, resource exhaustion), and business logic (edge cases, state machine violations, numeric overflow).

Phase 4 (Verification) checks whether each potential issue is already handled elsewhere in the changed code, searches for existing tests covering the scenario, and reads surrounding context to confirm the issue is real rather than a false positive. Phase 5 (Pre-Conclusion Audit) requires, before finalizing: listing every file reviewed and confirming it was read completely, listing every checklist item with whether issues were found or it was confirmed clean, and listing any areas that could not be fully verified and why.

Its output format prioritizes security vulnerabilities over bugs over code quality, explicitly skipping stylistic/formatting issues. Each reported issue includes file:line, severity (Critical/High/Medium/Low), the problem, evidence that it's real (not already fixed, no existing test covering it), a concrete fix suggestion, and references (OWASP, RFCs, or other standards) where applicable. If nothing significant is found, it says so rather than inventing issues, and it explicitly reports findings only - it does not make changes, leaving remediation decisions to the user.

git diff $(gh repo view --json defaultBranchRef --jq '.defaultBranchRef.name')...HEAD

Use this skill when you need a review focused on bugs, security issues, or risky code changes, when auditing the current branch diff rather than implementing new behavior, or when you want a structured, checklist-driven review against changed files.

Inputs: the current branch's full diff against the default branch.

Outputs: a prioritized list of findings (security vulnerabilities, then bugs, then code quality) each with file:line, severity, problem description, evidence of realness, a concrete fix, and relevant standards references - or an explicit "nothing significant found" if the review turns up no real issues.

git, GitHub CLI (gh repo view).

Developers and reviewers who want a structured, evidence-based audit of a branch's changes for bugs and security vulnerabilities before merging.