---
name: svgreg/sg-code-review
source: https://app.decimal.ai/s/svgreg-sg-code-review@1/SKILL.md
source_sha256: 5b0fa78dc4e3
---

# Cold code review of one area

Goal: review one slice of the codebase with fresh eyes across three lenses — **correctness**,
**security**, **performance/efficiency** — and land the fixes that fit in a single focused PR.

## Guardrails

All `sg-maintain` global guardrails apply. If a fix is risky, large, or changes behavior in a way
that needs a decision, **don't force it into this cycle** — file it to `docs/planned-rules.md` or a
GitHub issue and move on. Small, correct, reviewable increments only.

## 1. Pick the area (rotate)

Load state from `.claude/maintenance/state.json` → `review_area_cursor`. Rotate through the packages:

```
0 pkg/skill    1 pkg/rules    2 pkg/scan     3 pkg/policy
4 pkg/attest   5 pkg/verify   6 pkg/report   7 cmd/skill-guard
```

Advance to the next area each cycle. A caller may name a specific path instead.

## 2. Review across three lenses

Read the area's code closely. Then bring in the repo's own reviewers where they help:

- **Correctness** — run `/code-review` on the working diff or reason directly about the target
  files: edge cases, error handling, the line-offset invariant (`f.StartLine += t.lineOffset` in
  `pkg/scan`), exit-code contract (`exitErr{code,msg}` in `cmd/skill-guard/main.go`), dedup/verdict
  math, RE2 assumptions.
- **Security** — run `/security-review`. This project parses untrusted bundles: check for ReDoS-y
  patterns, unbounded reads, path traversal in the file walk, panics on malformed input, and the
  invariant that **nothing in a scanned bundle is ever executed**.
- **Performance/efficiency** — repeated compilation, quadratic scans over large bundles, needless
  allocations in the per-line hot path, redundant file reads.

Collect concrete findings with `file:line` references and a failure scenario for each.

## 3. Fix what fits

Pick the findings that are clearly correct and self-contained. Apply the fixes. Add or extend a
test that fails before and passes after — especially for correctness/security fixes. Prefer the
smallest change that fixes the root cause; match surrounding style.

Defer the rest: append larger items to `docs/planned-rules.md` (or open a GitHub issue labeled
`maintenance` + the appropriate lens) so nothing is lost.

## 4. Verify

- `gofmt -l .` empty · `go vet ./...` · `go test ./...` green.
- Exit-code smoke: `scan testdata/malicious`→1, `scan testdata/benign`→0.
- Dogfood any skill you touched: `go run ./cmd/skill-guard scan .claude/skills/<name>`.
- If you changed a rule pack, regenerate evaluation and cross-check (see `sg-rule-polish` §6).

## 5. Open the PR

```sh
git checkout main && git pull --ff-only && git checkout -b review/<area>-<slug>
git add -A
git commit -m "<fix|perf|refactor>(<area>): <what was wrong and the fix>"
git push -u origin HEAD
gh pr create --label automated --label code-review \
  --title "<fix|perf>(<area>): <short>" \
  --body "Automated code-review cycle over <area>. Findings + fixes with regression tests. Deferred items filed to backlog/issues.$( [ -n \"$ISSUE\" ] && echo \" Closes #$ISSUE.\" ) Bot-generated; needs review."
```

If the fix resolves an open issue, add `Closes #<n>` to the body so it auto-closes on merge.

Update `state.json` → advance `review_area_cursor` (wrap mod 8). Report the PR link and list any
deferred findings.