# Local Review

> Perform local code reviews on workspace changes without posting to GitHub. Use for requests like /review, review this diff, audit staged changes, or check branch changes. Produces findings-first reports with severity, file line references, risks, and test gaps.

- Skill: `davisbuilds/local-review` (Agent Skill, multi-file: 5 files)
- Install (CLI): `npx skillmds@latest add davisbuilds/local-review`
- Raw SKILL.md: https://api.skillmd.com/api/skills/davisbuilds/local-review/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: davisbuilds (https://skillmd.com/u/davisbuilds)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/davisbuilds/local-review

---


# local-review

## Overview

Run a disciplined local code review on git changes with no GitHub side effects. Use this skill when the user wants a `/review`-style assessment of local diffs.

## Scope

- In scope: local diff review (`working`, `staged`, or `branch` compare), risk analysis, and action-focused findings.
- Out of scope: posting PR reviews to GitHub. Use the `gh` CLI or the harness's own PR-review command.

## Workflow

1. Select review target.
- Working tree changes: `--mode working` (default)
- Staged changes only: `--mode staged`
- Branch changes against a base: `--mode branch --base <ref> [--head <ref>]`
- Deep review: add `--deep` to raise the default diff budget from 4000 to 8000
  lines, or pass `--max-diff-lines <n>` explicitly.

2. Collect deterministic context. Resolve `scripts/collect_review_context.sh`
relative to this skill directory, not the repository being reviewed. Do not look
for the script in the target repo unless that repo deliberately vendors a copy.

```bash
bash <local-review-skill-dir>/scripts/collect_review_context.sh --mode working
```

or

```bash
bash <local-review-skill-dir>/scripts/collect_review_context.sh --mode staged
```

or

```bash
bash <local-review-skill-dir>/scripts/collect_review_context.sh --mode branch --base origin/main
```

If branch mode cannot resolve the default `origin/main` but local `main` exists,
the helper falls back to `main` and prints a base note in the review target.

3. Analyze for:
- correctness and regressions
- security and data integrity
- performance and scalability
- maintainability and readability
- API or contract compatibility
- test coverage gaps

4. Produce response in the exact output contract below.

## Output Contract

Always present sections in this order:

1. Findings
- Findings must come first.
- Order by severity: `CRITICAL`, `HIGH`, `MEDIUM`, `LOW`.
- Include file and line when available.
- Use this structure for each finding:
  - `Severity: <level>`
  - `Location: <path:line>`
  - `Issue: <concise problem statement>`
  - `Risk: <why this matters>`
  - `Recommended fix: <specific fix>`
  - `Tests: <missing or required tests>`

2. Open Questions / Assumptions
- List unknowns that affect confidence.

3. Change Summary
- Keep short. This is secondary to findings.

4. Residual Risks / Testing Gaps
- Explicitly call out what was not verified.

If there are no meaningful findings, state that explicitly and still include residual risks and test gaps.

## Review Depth

- Quick review: small changes and low-risk files.
- Deep review: large diff, sensitive areas (auth, migrations, payments, infra), or user request.
- Trigger deep review automatically when diff is very large (for example, over 20 files or over 500 changed lines). If the context says the diff was truncated, rerun with `--deep` or a higher `--max-diff-lines`, then read high-risk touched files directly as needed.

## Commands

```bash
# Default: review working tree changes
bash <local-review-skill-dir>/scripts/collect_review_context.sh

# Review only staged changes
bash <local-review-skill-dir>/scripts/collect_review_context.sh --mode staged

# Review branch changes vs base
bash <local-review-skill-dir>/scripts/collect_review_context.sh --mode branch --base origin/main

# Deep review with a larger default diff budget
bash <local-review-skill-dir>/scripts/collect_review_context.sh --mode branch --base origin/main --deep
```

## Command Wrapper

If the harness supports command files, use `commands/review.md` as the canonical `/review` wrapper for this skill.

## Boundaries

- Do not post reviews to GitHub or call the GitHub API
- Do not modify source code; this skill is read-only analysis
- Do not review files outside the git diff scope

## Verification

- All findings reference specific files and line numbers from the diff
- Severity ratings are justified by stated risk
- Residual risks section is present even when no findings exist

## Notes

- Prefer precise, evidence-backed findings over broad advice.
- Do not make GitHub review API calls in this skill.

## Sibling skills

One of three review skills (diff / PR / multi-agent).

- `verify-before-complete` — orthogonal gate. Run before claiming a diff is "done"; this skill produces the findings, that one enforces the completion claim.
- `error-handling-review` — deliberately-invoked specialist lens for silent failures, swallowed errors, and unjustified fallbacks. Reach for it when this general pass flags error handling worth a deeper look.
- `type-design-review` — deliberately-invoked specialist lens rating a new or changed type's invariants and encapsulation. Reach for it when this pass surfaces a new type worth assessing.