Break the self-review monoculture
When an agent reviews code it just wrote, it shares the author's assumptions and blind spots. This produces "Looks good to me" on code a fresh reviewer would flag immediately. Three hostile personas; each must find at least one issue.
The three personas
Saboteur — wants to break this in production. Asks: what input crashes this? What race condition emerges under load? What happens when a dependency is down? What deploy order causes data corruption?
New Hire — joined last week. Asks: what does this variable name actually mean? Why was this chosen over the obvious alternative? Where does this function get called? Could I maintain this at 2 AM?
Security Auditor — OWASP Top 10 + supply chain. Asks: where is user input validated? Where could injection occur? What happens if this secret leaks? Are dependencies pinned and scanned?
Severity classification
| Level |
Meaning |
Action |
| BLOCK |
Production break, data loss, security vulnerability |
Must fix before merge |
| CONCERN |
Quality, maintainability, or performance issue |
Should fix before merge |
| NOTE |
Suggestion, style, minor smell |
Optional; document if skipping |
Severity promotion: a finding caught by 2+ personas is promoted one level (CONCERN → BLOCK; NOTE → CONCERN). Cross-persona findings reveal a systemic blind spot.
Steps
- Read the diff.
git diff against the merge target. If the diff is large, read the most critical files first: auth, payments, data mutations, API boundaries.
- Adopt the Saboteur. Look for: unhandled error paths, race conditions, wrong assumptions about input range, missing retries, state corruption, resource leaks. The Saboteur must find at least one finding.
- Adopt the New Hire. Look for: unclear names, missing context, surprising behaviour, missing tests, no docstring on a complex function, a choice that needs explanation. The New Hire must find at least one finding.
- Adopt the Security Auditor. Look for: unvalidated input, SQL/command injection, hardcoded secrets, insecure defaults, over-permissive access, dependency risks. The Auditor must find at least one finding.
- Deduplicate and promote. Merge findings; promote cross-persona findings one severity level.
- Emit the verdict. BLOCK (any BLOCK finding) / CONCERNS (CONCERN only) / CLEAN (notes only). Include the evidence: file, line, description, and suggested fix for every BLOCK/CONCERN.
Output format
## Adversarial Review — <scope>
### Saboteur
- [BLOCK] `src/auth.ts:42` — JWT verified without checking `exp` claim; expired tokens accepted.
### New Hire
- [CONCERN] `processPayment()` — 120 lines; no inline doc; unclear why retry limit is 3. Extract and document.
### Security Auditor
- [BLOCK] `src/auth.ts:42` — (shared with Saboteur — promoted from CONCERN)
- [CONCERN] `package.json` — `axios@0.27.2` has known SSRF CVE (CVE-2023-45857); upgrade to 1.6+.
### Verdict: BLOCK
Fix `src/auth.ts:42` before merge.
Review checklist
- Every persona has at least one finding — no persona is allowed a clean pass.
- Every BLOCK includes a suggested fix — not just a description of the problem.
- Cross-persona findings promoted — check for overlap before finalising severity.
- Verdict matches the highest severity — BLOCK if any BLOCK; CONCERNS if any CONCERN.
Rules
- No "looks good" without running all three personas.
- BLOCK findings must be fixed before merge — the reviewer must re-check after the fix.
- Security Auditor always checks dependencies for known CVEs, not just the diff.
1---2name: adversarial-reviewer3description: Use when you want a genuinely critical review of recent changes — before merging a PR, after a sprint, or when you suspect the review is being too agreeable. Forces perspective shifts through three hostile reviewer personas that catch blind spots the author's mental model shares with the reviewer. Triggers on "adversarial review", "break my code", "what could go wrong", "devil's advocate review", or "pre-merge review".4---56# Break the self-review monoculture78When an agent reviews code it just wrote, it shares the author's assumptions and blind spots. This produces "Looks good to me" on code a fresh reviewer would flag immediately. Three hostile personas; each must find at least one issue.910## The three personas1112**Saboteur** — wants to break this in production. Asks: what input crashes this? What race condition emerges under load? What happens when a dependency is down? What deploy order causes data corruption?1314**New Hire** — joined last week. Asks: what does this variable name actually mean? Why was this chosen over the obvious alternative? Where does this function get called? Could I maintain this at 2 AM?1516**Security Auditor** — OWASP Top 10 + supply chain. Asks: where is user input validated? Where could injection occur? What happens if this secret leaks? Are dependencies pinned and scanned?1718## Severity classification1920| Level | Meaning | Action |21|-------|---------|--------|22| **BLOCK** | Production break, data loss, security vulnerability | Must fix before merge |23| **CONCERN** | Quality, maintainability, or performance issue | Should fix before merge |24| **NOTE** | Suggestion, style, minor smell | Optional; document if skipping |2526**Severity promotion:** a finding caught by 2+ personas is promoted one level (CONCERN → BLOCK; NOTE → CONCERN). Cross-persona findings reveal a systemic blind spot.2728## Steps29301. **Read the diff.** `git diff` against the merge target. If the diff is large, read the most critical files first: auth, payments, data mutations, API boundaries.312. **Adopt the Saboteur.** Look for: unhandled error paths, race conditions, wrong assumptions about input range, missing retries, state corruption, resource leaks. The Saboteur must find at least one finding.323. **Adopt the New Hire.** Look for: unclear names, missing context, surprising behaviour, missing tests, no docstring on a complex function, a choice that needs explanation. The New Hire must find at least one finding.334. **Adopt the Security Auditor.** Look for: unvalidated input, SQL/command injection, hardcoded secrets, insecure defaults, over-permissive access, dependency risks. The Auditor must find at least one finding.345. **Deduplicate and promote.** Merge findings; promote cross-persona findings one severity level.356. **Emit the verdict.** BLOCK (any BLOCK finding) / CONCERNS (CONCERN only) / CLEAN (notes only). Include the evidence: file, line, description, and suggested fix for every BLOCK/CONCERN.3637## Output format3839```40## Adversarial Review — <scope>4142### Saboteur43- [BLOCK] `src/auth.ts:42` — JWT verified without checking `exp` claim; expired tokens accepted.4445### New Hire46- [CONCERN] `processPayment()` — 120 lines; no inline doc; unclear why retry limit is 3. Extract and document.4748### Security Auditor49- [BLOCK] `src/auth.ts:42` — (shared with Saboteur — promoted from CONCERN)50- [CONCERN] `package.json` — `axios@0.27.2` has known SSRF CVE (CVE-2023-45857); upgrade to 1.6+.5152### Verdict: BLOCK53Fix `src/auth.ts:42` before merge.54```5556## Review checklist5758- **Every persona has at least one finding** — no persona is allowed a clean pass.59- **Every BLOCK includes a suggested fix** — not just a description of the problem.60- **Cross-persona findings promoted** — check for overlap before finalising severity.61- **Verdict matches the highest severity** — BLOCK if any BLOCK; CONCERNS if any CONCERN.6263## Rules6465- No "looks good" without running all three personas.66- BLOCK findings must be fixed before merge — the reviewer must re-check after the fix.67- Security Auditor always checks dependencies for known CVEs, not just the diff.
tmj-90