sergeytkachenko/llm-skills (code-review)

Use this skill when the user asks to "code review", "/code-review", "review my changes", "review this diff/PR", "code review <path>", or "code review <pull-request-url>". Reviews the working diff, a given path, or a pull request (checked out into an isolated git worktree) across eight tracks — architecture, clean-code, naming, comments, readability, regression (static risk), security (taint/secrets/SCA backed by OSS analyzers), and regression-check (runs the test/lint/typecheck suite). Runs deterministic open-source analyzers (Semgrep, Gitleaks, Trivy, LSP find-references) and feeds their findings into the LLM to triage — catching what reading a diff misses. For a PR it also verifies the description's factual claims against reality (real test counts, cited ADRs/docs exist, "fixed X" is actually in the code) and follows paired/dependency PRs when a correctness contract spans repos. Adds a context-free adversarial pass (a "Blind Hunter" that sees only the diff, no PR description or intent, to catch what a context-aware read rationalizes away), then dedupes findings across the tracks/analyzers/blind layers and buckets each into decision-needed / patch / defer / dismiss. Resolves the review target by cascade (explicit arg → recent conversation → current git state → default working changes). Fans out to parallel subagents for large diffs. Accepts mode(s) to scope which tracks run, an optional path, an optional PR URL, and `--fix` to apply minimal fixes. Checks are language-agnostic (examples lean toward NestJS + Vue 3 + TypeScript, but the rubrics apply to Java/Spring, Go, Python, Rust, .NET, etc.); the dynamic track detects the actual stack (Maven/Java, Gradle, Go, Python, .NET).

Claude Skills are markdown + scripts loaded into Claude Code; scanned with the same pipeline.

Source:

github.com/sergeytkachenko/llm-skills

Version:

0.5.0

Provenance:

Found by crawling (provenance, not a security rating)

We found this by crawling public sources and nobody has attested to it. That is how most of the registry gets here, and it is not a mark against the artifact — it only means no authenticated act of publication is on record. An artifact can be the vendor's own and still appear here.

2 critical findings reported by cisco-skill-scanner. The composite score alone does not reflect this — read the per-scanner reports below.