Results for “pr-review”

Build, review, and refactor Java backend services (Spring Boot). Use for tasks like REST API design, controllers/services/repositories, PostgreSQL persistence (JPA/MyBatis), migrations, configuration, security (Spring Security), observability, testing, performance tuning, and production hardening.

Runs a comprehensive verification pipeline for Quarkus projects including build, static analysis, tests with coverage, security scans, native compilation, and diff review before PRs or releases.

Analyzes smart contract codebases against Trail of Bits' secure development guidelines, generating documentation, reviewing architecture and upgradeability patterns, assessing implementation quality, identifying pitfalls, and providing prioritized recommendations.

Audits a codebase for production readiness using local evidence, scoring ship/block risk and listing concrete fixes without sending repo data to external services.

Performs security audits, hardening, threat modeling (STRIDE/PASTA), red/blue team exercises, OWASP checks, code review, incident response, and infrastructure security for any project.

Reviews and hardens GitHub Actions workflows against injection, privilege escalation, supply-chain, and token-scoping risks that pattern matchers miss.

Use this skill for SBOM, SCA, lockfile review, provenance, package integrity, supply-chain risk. Trigger when the task involves security work related to Supply Chain SBOM SCA, implementation, audits, debugging, strategy, or validation.

Provides HIPAA-specific decision gates and guardrails for healthcare software, directing users to implementation and review skills for PHI handling, audit logging, and compliance.

Enforces output quality, intellectual honesty, and continuous improvement across security analysis agents with anti-rationalization guards, self-critique loops, retry protocols, and quality gates.

Provides a security checklist and code patterns for authentication, input validation, secrets management, SQL injection prevention, XSS, CSRF, rate limiting, and sensitive data handling.

Systematically reviews an application's use of cryptographic primitives, protocols, and key management to identify vulnerabilities such as weak algorithms, insecure modes, hardcoded keys, insufficient entropy, and protocol misconfigurations.

Audit serverless functions across AWS Lambda, Azure Functions, and GCP Cloud Functions for overly permissive execution roles, insecure environment variables, injection vulnerabilities, and missing runtime protections.

Runs an evidence-first, read-only workflow over large codebases via an external JSONL REPL server, retrieving only minimal file slices and greps to produce cited architecture and audit reports.

Guides through a 5-step secure development workflow for smart contracts, including automated scanning with Slither, special feature validation, visual security diagrams, security property documentation, and manual review.

Live developer experience audit. Uses the browse tool to actually TEST the developer experience: navigates docs, tries the getting started flow, times TTHW, screenshots error messages, evaluates CLI help text. Produces a DX scorecard with evidence. Compares against /plan-devex-review scores if they exist (the boomerang: plan said 3 minutes, reality says 8). Use when asked to "test the DX", "DX audit", "developer experience test", or "try the onboarding". Proactively suggest after shipping a developer-facing feature. (gstack) Voice triggers (speech-to-text aliases): "dx audit", "test the developer experience", "try the onboarding", "developer experience test".

Audits codebases for GDPR and CCPA/CPRA compliance by inventorying PII fields, mapping data collection points, reviewing consent mechanisms, verifying data subject rights, tracing third-party data sharing, and checking retention policies.

Audits OAuth 2.0 permissions across identity providers to identify over-privileged third-party integrations, excessive API scopes, and unused token grants, enforcing least-privilege access.

Audits WordPress plugin or theme PHP code for common security mistakes including missing nonce checks, capability checks, input sanitization, output escaping, SQL preparation, AJAX exposure, file traversal, and unsafe redirects.

Find over-permissive RBAC roles and service-account token abuse paths in Kubernetes using kubectl auth can-i, rbac-police, kubectl-who-can, and rakkess during authorized cluster security reviews.

Use when a paper is complete or near-complete and a holistic pre-submission audit is needed. Cross-cuts text, code, tables, figures, results, citations, and reproducibility in a single pass and produces a persistent audit report. Works standalone on papers written outside the plugin.

Expert HIPAA compliance assistant for healthcare and software contexts. Use this skill whenever the user mentions HIPAA, PHI (Protected Health Information), ePHI, covered entities, business associates, healthcare data privacy, medical records, health information security, BAA (Business Associate Agreements), or any compliance review involving patient data. Also trigger for requests to draft privacy notices, HIPAA policies, consent forms, security risk assessments, or breach notification letters. Use for developers building healthcare software who need technical safeguard guidance (encryption, access controls, audit logs), compliance officers reviewing documents or procedures, and anyone asking "is this HIPAA compliant?" or "what does HIPAA require for X?". When in doubt about whether a healthcare or data privacy question falls under this skill — use it.

VS-Enhanced Academic Style Auditor - Academic Writing Quality Analysis Identifies 24+ writing patterns that reduce scholarly quality, adapted from Wikipedia AI Cleanup guidelines Use when: checking drafts before submission, improving academic writing quality, preparing for style improvement Triggers: writing quality, style audit, pattern check, writing review, academic style check

Use this skill when the user asks about DOT audits, FMCSA compliance reviews, new entrant safety audits (NESA), focused investigations, what auditors actually ask for, audit document checklists, common audit failures, the audit ratings (Satisfactory / Conditional / Unsatisfactory), or how to prepare for an upcoming audit. Cite 49 CFR 385.

Use to audit how payment disputes, chargebacks and unrecognised-transaction claims are handled against scheme deadlines and evidence standards. Trigger for "audit our dispute handling", "chargeback quality review", "are we meeting scheme deadlines", unrecognised transaction claims, provisional credit decisions, or a customer complaining their dispute was rejected unfairly.

Guides SOC 2 Type II Privacy Trust Services Criteria preparation and audit execution. Covers AICPA TSP Section 100 Privacy criteria P1-P8 including notice, choice/consent, collection, use/retention/disposal, access, disclosure, security, and quality. Includes evidence collection, control testing, and report review. Keywords: SOC 2, privacy criteria, TSP, AICPA, Type II, trust services.

Audit, write, or update CHANGELOG.md following Keep a Changelog 1.1.0. Use when creating a CHANGELOG, or reviewing commits to ensure Unreleased reflects user-visible changes. Defers to auto-managed setups (changesets, release-please, git-cliff, semantic-release, towncrier) and applies semver 2.0.0 — or Haskell PVP for Haskell projects.

>- Production Part Approval Process (PPAP) — verify PPAP submission level, audit all 18 elements, check completeness for customer approval, prepare PSW. Use when a supplier needs to submit parts for approval, when reviewing a PPAP package, or when determining which PPAP level is required. Covers AIAG PPAP 4th edition with Ford, BMW, VW, and Stellantis OEM-specific requirements.

Subjects every non-trivial decision to a fresh-context adversarial review before it stands. Use when correctness matters more than speed, when working in unfamiliar code, when stakes are high (production, security-sensitive logic, irreversible operations), or any time a confident output would be cheaper to verify now than to debug later.

Use to compare a support data retention policy against what is actually still stored, and find both over-retention and premature deletion. Trigger for "are we deleting support data on time", "retention audit", "how long do we keep transcripts", "we still have data from 2018", conflicting retention obligations, or preparing for a data protection review.

Use to test whether a support control actually operates, the way an auditor would test it, rather than confirming it exists on paper. Trigger for "test our controls", "does this control actually work", second-line assurance over support, control effectiveness testing, preparing for an internal audit, or a control that passed review and then failed in practice.

Use to design or audit a QA dispute and appeal workflow with timeboxes, adjudication standards, and second-level consistency so appeals improve trust instead of rewriting scores without rules. Trigger for "QA appeal process", "agents disputing scores", "who adjudicates QA disputes", "overturn rate too high", second-level review standards, or calibration erosion from ad-hoc score changes.

Universal code quality principles applicable to all languages. Covers Clean Code, SOLID, complexity metrics, and quality standards. USE WHEN: user mentions "clean code", "SOLID", "code smells", "refactoring", "complexity", asks about "cyclomatic complexity", "cognitive complexity", "code review", "maintainability" DO NOT USE FOR: language-specific linting - use ESLint/Biome skills, security - use OWASP skills, testing - use testing skills

Audit a repository, vet and prioritize evidence-backed findings, write drift-aware implementation plans, delegate bounded work, and independently verify results. Use when asked to improve, audit, modernize, harden, review, plan fixes for, or systematically reduce risk in a codebase. Use native isolated agents for implementation; use OpenRouter/free only for narrow advisory audit slices under its safety limits.

Perform a static audit of an AL workspace for Business Central against the project's copilot-instructions.md contract. Reports findings by class (Compliance, Code quality, Test coverage, Permissions) and severity (Blocker, Major, Minor, Nit) with file:line citations. Never modifies code. Never invents rules. Use when asked to audit a workspace, run a compliance check, review before PR, or diagnose contract drift.

Audit, write, or revise Architecture Decision Records (ADRs), including the decision of whether one is warranted. Use when an architecturally significant decision needs recording, when reviewing an existing ADR collection, or when adding ADRs to a project that has none. Detects existing template (Nygard or MADR) and defaults to Nygard for new repos. Gates comparison ADRs through a decompose-and-verify interview before drafting.

Simplify application code for clarity without changing behavior — refactor after tests pass, reduce nesting and duplication, match project conventions. Load when refactoring for readability, cleaning up after a feature ships, or when code review flags complexity. Also triggers on "simplify this code", "code simplification", "make this easier to read", "reduce complexity", "refactor for clarity". Not for compress/split/prune-skill (skill-library files). Pairs with technical-debt-audit.