# Review Diff

> Use when a delivery run dispatches a diff-review action: the correctness/simplification/convention pass (diff_review, code-reviewer persona) or the security-pattern pass (security_pattern_review, security-reviewer persona) over an implementation diff. One shared procedure — findings tied to specific files/lines with concrete failure or exploit scenarios, or an explicit no-findings record — parameterized by the action id passed as the first skill argument and the persona dispatched. Replaces the retired diff-review and security-pattern-review skills.

- Skill: `bhangeef16/review-diff` (Agent Skill)
- Install (CLI): `npx skillmds@latest add bhangeef16/review-diff`
- Raw SKILL.md: https://api.skillmd.com/api/skills/bhangeef16/review-diff/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: BhangeeF16 (https://skillmd.com/u/bhangeef16)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/bhangeef16/review-diff

---


# Review Diff — $action

One procedure for reviewing a diff. The dispatched persona carries the lens — the code reviewer judges correctness and conventions, the security reviewer judges exploitability — and neither reviews against an idealized rewrite: the diff is judged against the plan it claims to satisfy.

## Your contract

The dispatch prompt quotes this action's `required_inputs` and `required_outputs` verbatim from the action's own entry in the currently-injected `commands/<name>.process.yaml`. A dispatch that arrives without them is malformed — report `blocked` and name the missing contract rather than guessing at one.

## Procedure (every action)

1. Read the diff and the plan/scope it claims to satisfy.
2. Every finding needs a concrete scenario behind it — a failure (wrong output, crash, data corruption) or an exploit (who gets in, what they reach) — never a style preference.
3. Tie each finding to specific files/lines, tagged must-fix or worth-noting; an explicit no-findings record is a valid, complete output.
4. Scope creep found in the diff is escalated as a planning matter, never resolved inline.

## Action-specific rules

- `diff_review` — `db-administrator` is the supporting lens when the diff contains schema, migration, or query changes. Security-sensitive patterns are flagged for the security pass, never adjudicated here.
- `security_pattern_review` — adjudicate what `diff_review` flagged plus your own scan of the diff; every finding carries a concrete exploit scenario; a missing authorization check on a sensitive route is a stop-condition finding, never a note.

## Result

Report each required output produced (with its location), the result (pass / pass_with_risks / blocked / failure), and blocking questions as an explicit list (empty list stated explicitly).