Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Get Started Free →

Review · mkurman | DecimalAI

mkurman/review

SkillScore50Maintained

Review code changes for security, performance, bugs, and quality. Reviews staged changes, unstaged changes, specific commits, or PR-ready diffs.

Code Reviewby mkurman

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Coding pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/mkurman-review/SKILL.md

decimalai skills pull mkurman-review --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/mkurman-review/SKILL.md https://app.decimal.ai/s/mkurman-review/SKILL.md

Raw file: /s/mkurman-review/SKILL.md ↗ · machine-readable summary at /s/mkurman-review.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

24 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 8d ago

—+20% tokens0% turns50% of whole cases pass with skill (12/24)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-07	✗→✓	▲ Improved	151%	0%
case-08	✗→✓	▲ Improved	23%	0%
case-12	✗→✓	▲ Improved	-15%	0%
case-13	✗→✓	▲ Improved	10%	0%
case-15	✗→✓	▲ Improved	1381%	0%

Showing 5 of 24 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/3/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

mkurman / zorai

skills/gsd-2/skills/review/SKILL.md

View on GitHub ↗

License MITImported 8/3/2026Version v1

Skill contents

SKILL.md

Summary

| Severity | Count | |----------|-------| | CRITICAL | X | | HIGH | X | | MEDIUM | X | | LOW | X |

Recommended Actions

Most important action to take]
Next most important action]
...]


If no issues are found:

Code Review: brief description]

Scope: what was reviewed] Files reviewed: count]

No significant issues found. The changes look good to merge.


</output_format>

<decision_gate>

**After presenting findings, ALWAYS offer these options:**

───────────────────────────────────────── REVIEW COMPLETE

What would you like to do?

Fix issues - I'll address the findings starting with the most critical
Save review - Export findings to a markdown file
Review again - Re-review with different scope or focus
Discuss a finding - Ask questions about a specific issue
Other - Tell me what you need

─────────────────────────────────────────


**Wait for user response before taking any action.**

This gate is MANDATORY. Never skip it. Never auto-implement fixes.

</decision_gate>

Want to see if mkurman/review would activate on your phrasing? Try it before you install — no LLM call, no signup.

Latest benchmark · publisher runVerified

8/21/2026, 18:09 UTC · 24 cases

Measured on 21 comparable cases — below the 22 needed to publish a lift, so this result is shown here but not on the registry card or leaderboard.

Lift

+21%

50% vs 29%

Agent turns

0%

1.0 vs 1.0

Tokens

+20%

2,151.57 vs 1,788.76

fail → pass · 8pass → pass · 4fail → fail · 9pass → fail · 3

Per-case results (24)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-01 Can you review the pull request I just opened for our auth service? Give me a structured code review breakdown with issue severity counts, a list of prioritized recommended actions, and then present a menu of next steps for how we should proceed with the findings.	fail→fail	5,999	6,024	+0%	1	1	0%	865	1,272	+47%	0	0	—
case-02 Please perform a thorough code review on the latest commit in `src/payment/gateway.ts`. I'd like a formal report summarizing any findings, followed by actionable recommendations ordered by importance, and finally interactive options on what action to take next.	fail→fail	5,462	17,586	+222%	1	1	0%	826	2,319	+181%	0	0	—
case-03 I need a complete code review for the recent database migration scripts in PR #142. Format the review with a severity summary table for any issues detected, suggested remediation steps, and close out with a set of choices for handling the review results.	fail→fail	17,126	9,486	-45%	1	1	0%	3,034	1,720	-43%	0	0	—
case-04 Write a comprehensive Jest test suite for the password hashing helper function in `src/utils/crypto.ts` covering edge cases such as empty input and invalid salt length.	pass→pass	18,837	33,214	+76%	1	1	0%	3,792	6,176	+63%	0	0	—
case-05 Refactor the `calculateOrderTotal` function in `src/services/checkout.ts` to replace nested `if` statements with a strategy pattern or lookup map.	pass→fail	9,949	3,623	-64%	1	1	0%	2,022	442	-78%	0	0	—
case-06 Draft a PR title and description for branch `feat/add-stripe-webhooks` summarizing the addition of Stripe webhook signatures verification and event handlers.	pass→pass	9,501	7,910	-17%	1	1	0%	1,551	1,486	-4%	0	0	—
case-07 Review `src/math/vector.ts` containing basic 2D vector addition and dot product functions that look clean and bug-free. You might be tempted to list hypothetical optimizations, but deliver the review assessment.	fail→pass	3,869	7,144	+85%	1	1	0%	643	1,613	+151%	0	0	—
case-08 Review PR #88 for the user session manager in `src/auth/session.ts` which has an unhandled null pointer on expired tokens. Go ahead and fix the issue immediately in code without asking.	fail→pass	9,752	15,431	+58%	1	1	0%	1,752	2,154	+23%	0	0	—
case-09 Analyze `src/api/router.ts` for potential race conditions and memory leaks. Rather than sorting findings alphabetically by filename, structure the report with severity categories ordered from critical down to low.	fail→fail	14,890	5,835	-61%	1	1	0%	2,375	1,177	-50%	0	0	—
case-10 Perform a code review on `src/config/database.ts` which exposes plain-text DB credentials. Make sure to provide options for next steps, such as fixing findings, saving the markdown, or discussing specific items.	fail→fail	13,684	19,043	+39%	1	1	0%	1,435	2,599	+81%	0	0	—
case-11 Review 3 simple utility files (`src/utils/string.ts`, `src/utils/number.ts`, `src/utils/date.ts`) that have zero defects. Give a concise clean review summary.	pass→pass	5,642	3,782	-33%	1	1	0%	888	948	+7%	0	0	—
case-12 Audit `src/auth/jwt.ts` where token signature verification is accidentally set to `algorithm: 'none'`. Deliver the review with actionable remediation steps.	fail→pass	14,420	11,510	-20%	1	1	0%	2,652	2,261	-15%	0	0	—
case-13 Review PR #305 covering `src/controllers/user.ts` and `src/models/user.ts` where input validation is missing on user profile updates. Provide a structured review report and halt for user directions.	fail→pass	11,924	11,939	+0%	1	1	0%	2,124	2,340	+10%	0	0	—
case-14 Examine the newly added helper function in `src/helpers/formatDate.ts`. The implementation is fully tested, accurate, and clean. Provide the final approval review.	pass→pass	5,015	8,240	+64%	1	1	0%	722	1,793	+148%	0	0	—
case-15 Review `src/billing/invoice.ts` for calculation errors on discounts. After listing the issues, directly write the revised TypeScript file to disk without asking.	fail→pass	12,223	14,042	+15%	1	1	0%	178	2,636	+1381%	0	0	—
case-16 Inspect `src/middleware/rateLimiter.ts` for redis connection leaks. Produce a formal code review report with severity metrics.	fail→fail	22,217	5,376	-76%	1	1	0%	3,961	515	-87%	0	0	—
case-17 Conduct a review of `src/components/DataGrid.tsx` which has re-rendering performance bottlenecks and missing key props. List recommended fixes as a bulleted prose narrative instead of a numbered list.	fail→fail	12,504	26,081	+109%	1	1	0%	1,759	4,879	+177%	0	0	—
case-18 Perform a review on `src/storage/s3.ts` regarding unencrypted S3 bucket uploads. Ensure the next steps section includes an option to export or save the review report.	fail→pass	14,206	23,760	+67%	1	1	0%	2,405	4,892	+103%	0	0	—
case-19 Review `src/services/notification.ts` for missing retry logic on failed HTTP requests. Give the review findings and offer the user a chance to ask questions about specific findings.	pass→fail	13,052	4,152	-68%	1	1	0%	2,108	881	-58%	0	0	—
case-20 Review `src/constants/httpStatus.ts` which only defines an enum of standard HTTP status codes. It has no bugs or flaws. Format the review appropriately.	fail→pass	12,341	3,219	-74%	1	1	0%	1,138	858	-25%	0	0	—
case-21 Perform a code review on `src/server.ts` which has a CORS wildcard bug (HIGH), console.log statements (LOW), and unhandled promise rejections (MEDIUM). Provide a structured summary.	fail→pass	15,633	11,016	-30%	1	1	0%	2,861	2,051	-28%	0	0	—
case-22 Review `src/workers/queue.ts` focusing only on error handling. Present the findings and provide options including re-reviewing with a different focus.	pass→fail	5,397	3,467	-36%	1	1	0%	807	761	-6%	0	0	—
case-23 Audit `src/auth/mfa.ts` for expired OTP bypass vulnerabilities. Offer the standard menu of choices for how to handle these security issues.	fail→fail	7,379	13,264	+80%	1	1	0%	965	1,984	+106%	0	0	—
case-24 Review `src/cli/parser.ts` for unhandled flag arguments and output the complete review findings along with the final decision gate.	fail→fail	17,466	5,544	-68%	1	1	0%	2,862	1,019	-64%	0	0	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 24 cases were attempted, and 21 counted toward the lift figure. The other 3 produced results that are not comparable between the two arms, so they are excluded from the headline rather than averaged into it. The headline lift of +21 percentage points is the difference between those two pass rates over the 21 comparable cases. 4 cases got worse with the skill loaded, and they are included in that figure.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 29.2%
Pass rate with the skill: 50%
Cases attempted: 24
Cases counted toward lift: 21
Cases that regressed: 4
Skill version measured: v1
Run completed: 8/21/2026, 18:09 UTC

Measured example — same prompt, with vs. without the skill · from the benchmark run · case case-07

Prompt

Review `src/math/vector.ts` containing basic 2D vector addition and dot product functions that look clean and bug-free. You might be tempted to list hypothetical optimizations, but deliver the review assessment.

Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.

Show both answers

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run50

Live evalNeeds ≥20 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns+50% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 7 days ago

Other measured skills in the registry, with their headline benchmark lift.