---
name: tetherto/review
source: https://app.decimal.ai/s/tetherto-review@1/SKILL.md
source_sha256: 7d04c2f1bd88
---

# Code Review

Run a comprehensive code review using 4 specialized review agents: security, correctness, performance, and consistency.

## Usage

```
/review              # review current branch changes vs main
/review #1561        # review a PR by number
/review branch-name  # review a specific branch vs main
/review --only security,correctness  # run only specific reviewers
```

## Arguments

- No argument: review current branch changes against `main`
- `#<number>` or `<number>`: review a GitHub PR
- `<branch-name>`: review a specific branch against `main`
- `--only <list>`: comma-separated list of reviewers to run (security, correctness, performance, consistency). Default: all 4.

## Workflow

### Step 1: Determine review target

Parse `$ARGUMENTS` to determine the review target:

- If argument starts with `#` or is a number → PR review mode
- If argument is a branch name → branch review mode
- If no argument → current branch review mode

Extract `--only` flag if present to filter which reviewers to launch.

### Step 2: Get the diff

**PR review mode:**
```bash
gh pr diff <number> --repo tetherto/qvac
gh pr view <number> --repo tetherto/qvac --json title,body,commits
```

**Branch review mode:**
```bash
git diff main...<branch>
git log main..<branch> --oneline
```

**Current branch mode:**
```bash
git diff main...HEAD
git log main..HEAD --oneline
```

If the diff is empty, report "No changes to review" and stop.

### Step 3: Launch specialized reviewers in parallel

Launch the selected review agents **in parallel** as sub-agents.

For each agent, set:
- `subagent_type` to the reviewer name
- `model: "sonnet"` to keep review costs down (Claude Code only — Cursor CLI inherits the parent model)
- `readonly: true` (reviewers report only — they must not modify files)
- `prompt` with enough context for the sub-agent to work independently (see template below)

**Agents to launch** (all 4 unless `--only` filters):

1. **security-reviewer** — injection, auth bypass, credential exposure, OWASP patterns
2. **correctness-reviewer** — logic bugs, edge cases, race conditions, test coverage
3. **performance-reviewer** — allocations, blocking calls, memory leaks, N+1
4. **consistency-reviewer** — cross-addon pattern enforcement, architecture alignment

**Prompt template** — adapt `[target]`, `[diff-command]`, and `[domain]` for each reviewer:

```
Review the code changes on [target] in repo tetherto/qvac.
To get the diff, run: [diff-command]
Focus only on [domain] issues.
Report each finding with: severity, file path and line, description, impact, and fix recommendation.
If no issues found, report: "No [domain] issues identified."
Do NOT fix code — report findings only.
```

Where `[diff-command]` is:
- PR mode: `gh pr diff <number> --repo tetherto/qvac`
- Branch mode: `git diff main...<branch>`
- Current branch mode: `git diff main...HEAD`

### Step 4: Check for forbidden files

While reviewers run, do a quick check:
- `.npmrc`, `.env`, or credential files must NOT be in the diff
- If found, warn immediately

### Step 5: Collect and present results

Collect results from all reviewers and present a unified report:

```
## Code Review: [target]

### Security
[findings or "No issues"]

### Correctness
[findings or "No issues"]

### Performance
[findings or "No issues"]

### Consistency
[findings or "No issues"]

### Summary
- Total findings: X (Y critical, Z warnings)
- Recommendation: [ready to merge / needs fixes / needs discussion]
```

### Step 6: Offer to fix

After presenting the report, ask the user:

```
Found X issues. Want me to fix the actionable ones? (y/n)
```

If the user says yes:
1. Fix each actionable issue directly
2. Commit each fix: `fix: [description]`
3. Re-run build/tests to verify
4. Report what was fixed

Do NOT fix:
- Performance suggestions requiring architectural changes
- Consistency deviations that may be intentional
- Anything marked as "needs discussion"

## Notes

- All 4 reviewers run in parallel via sub-agents for speed
- On Claude Code, set `model: "sonnet"` on each Agent tool call to keep costs down
- On Cursor CLI, reviewers inherit the parent model (no model override available)
- The skill itself coordinates and synthesizes — it does not duplicate reviewer work
- Does NOT push to remote — the user handles that