Local Review

or

bash scripts/collect_review_context.sh --mode staged

or

bash scripts/collect_review_context.sh --mode branch --base origin/main

3. Analyze for:

• correctness and regressions
• security and data integrity
• performance and scalability
• maintainability and readability
• API or contract compatibility
• test coverage gaps

4. Produce response in the exact output contract below.

Output Contract

Always present sections in this order:

1. Findings

• Findings must come first.
• Order by severity: CRITICAL, HIGH, MEDIUM, LOW.
• Include file and line when available.
• Use this structure for each finding:
  • Severity: <level>
  • Location: <path:line>
  • Issue: <concise problem statement>
  • Risk: <why this matters>
  • Recommended fix: <specific fix>
  • Tests: <missing or required tests>

2. Open Questions / Assumptions

• List unknowns that affect confidence.

3. Change Summary

• Keep short. This is secondary to findings.

4. Residual Risks / Testing Gaps

• Explicitly call out what was not verified.

If there are no meaningful findings, state that explicitly and still include residual risks and test gaps.

Review Depth

• Quick review: small changes and low-risk files.
• Deep review: large diff, sensitive areas (auth, migrations, payments, infra), or user request.
• Trigger deep review automatically when diff is very large (for example, over 20 files or over 500 changed lines).

Commands

# Default: review working tree changes
bash scripts/collect_review_context.sh

# Review only staged changes
bash scripts/collect_review_context.sh --mode staged

# Review branch changes vs base
bash scripts/collect_review_context.sh --mode branch --base origin/main

Command Wrapper

If the harness supports command files, use commands/review.md as the canonical /review wrapper for this skill.

Boundaries

• Do not post reviews to GitHub or call the GitHub API (use gh-review-pr for that)
• Do not modify source code; this skill is read-only analysis
• Do not review files outside the git diff scope

Verification

• All findings reference specific files and line numbers from the diff
• Severity ratings are justified by stated risk
• Residual risks section is present even when no findings exist

Notes

• Prefer precise, evidence-backed findings over broad advice.
• Do not make GitHub review API calls in this skill.