How do I install the Review Diff skill?

Run npx skillmds@latest add bhangeef16/review-diff in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Review Diff safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Review Diff?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Review Diff free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Review Diff?

BhangeeF16 (@bhangeef16) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Review Diff by bhangeef16 — Agent Skill

Name: Review Diff
Author: BhangeeF16

Review Diff

Use when a delivery run dispatches a diff-review action: the correctness/simplification/convention pass (diff_review, code-reviewer persona) or the security-pattern pass (security_pattern_review, security-reviewer persona) over an implementation diff. One shared procedure — findings tied to specific files/lines with concrete failure or exploit scenarios, or an explicit no-findings record — parameterized by the action id passed as the first skill argument and the persona dispatched. Replaces the retired diff-review and security-pattern-review skills.

BhangeeF16 e59d787 2.4 KB Updated Sep 17, 2026

File contents

Review Diff — $action

One procedure for reviewing a diff. The dispatched persona carries the lens — the code reviewer judges correctness and conventions, the security reviewer judges exploitability — and neither reviews against an idealized rewrite: the diff is judged against the plan it claims to satisfy.

Your contract

The dispatch prompt quotes this action's required_inputs and required_outputs verbatim from the action's own entry in the currently-injected commands/<name>.process.yaml. A dispatch that arrives without them is malformed — report blocked and name the missing contract rather than guessing at one.

Procedure (every action)

Read the diff and the plan/scope it claims to satisfy.
Every finding needs a concrete scenario behind it — a failure (wrong output, crash, data corruption) or an exploit (who gets in, what they reach) — never a style preference.
Tie each finding to specific files/lines, tagged must-fix or worth-noting; an explicit no-findings record is a valid, complete output.
Scope creep found in the diff is escalated as a planning matter, never resolved inline.

Action-specific rules

diff_review — db-administrator is the supporting lens when the diff contains schema, migration, or query changes. Security-sensitive patterns are flagged for the security pass, never adjudicated here.
security_pattern_review — adjudicate what diff_review flagged plus your own scan of the diff; every finding carries a concrete exploit scenario; a missing authorization check on a sensitive route is a stop-condition finding, never a note.

Result

Report each required output produced (with its location), the result (pass / pass_with_risks / blocked / failure), and blocking questions as an explicit list (empty list stated explicitly).

---name: review-diffdescription: Use when a delivery run dispatches a diff-review action: the correctness/simplification/convention pass (diff_review, code-reviewer persona) or the security-pattern pass (security_pattern_review, security-reviewer persona) over an implementation diff. One shared procedure — findings tied to specific files/lines with concrete failure or exploit scenarios, or an explicit no-findings record — parameterized by the action id passed as the first skill argument and the persona dispatched. Replaces the retired diff-review and security-pattern-review skills.---# Review Diff — $actionOne procedure for reviewing a diff. The dispatched persona carries the lens — the code reviewer judges correctness and conventions, the security reviewer judges exploitability — and neither reviews against an idealized rewrite: the diff is judged against the plan it claims to satisfy.## Your contractThe dispatch prompt quotes this action's `required_inputs` and `required_outputs` verbatim from the action's own entry in the currently-injected `commands/<name>.process.yaml`. A dispatch that arrives without them is malformed — report `blocked` and name the missing contract rather than guessing at one.## Procedure (every action)1. Read the diff and the plan/scope it claims to satisfy.2. Every finding needs a concrete scenario behind it — a failure (wrong output, crash, data corruption) or an exploit (who gets in, what they reach) — never a style preference.3. Tie each finding to specific files/lines, tagged must-fix or worth-noting; an explicit no-findings record is a valid, complete output.4. Scope creep found in the diff is escalated as a planning matter, never resolved inline.## Action-specific rules- `diff_review` — `db-administrator` is the supporting lens when the diff contains schema, migration, or query changes. Security-sensitive patterns are flagged for the security pass, never adjudicated here.- `security_pattern_review` — adjudicate what `diff_review` flagged plus your own scan of the diff; every finding carries a concrete exploit scenario; a missing authorization check on a sensitive route is a stop-condition finding, never a note.## ResultReport each required output produced (with its location), the result (pass / pass_with_risks / blocked / failure), and blocking questions as an explicit list (empty list stated explicitly).

Frequently asked questions