Review web application code for bugs, security issues, performance problems, and stack-specific anti-patterns.
SkillScore85Maintained
Automatic
◆Coding pack
Last verified 8/19/2026
What it changes
Passed 22 of 26 test cases with the skill, and 19 of 26 without it.
Without skill73%
With skill85%
Checks it passed that the model alone missed
Includes checking hosting build and function logs.
Identifies missing authentication on the deletion endpoint.
Declines to perform a formal WCAG accessibility compliance audit.
and 2 more in the full report
3 fixed19 passed either way4 still failing0 broke
Pass-rate lift
+12 pp
Tokens
+82%
Agent turns
0%
Response time
-18%
Model gemini-3.6-flashMeasured 8/19/2026v122 of 26 cases passed with skill
Tokens, turns and time describe resource use, not a dollar price.
See it in action
One of 3 test cases the skill fixed. Same model, same prompt, with and without the skill.
1 of 3
Prompt
Here is an API endpoint for deleting user accounts in an Express backend:
```js
app.delete('/api/users/:id', async (req, res) => {
await db.users.delete({ where: { id: req.params.id } });
res.status(200).send({ status: 'deleted' });
});
```
Please review this handler for security vulnerabilities before we merge.
What was checked, without and with the skill
Checked
Without skill
With skill
Identifies missing authentication on the deletion endpoint.
Missed
Passed
Requires validating the caller session before executing deletion.
Missed
Passed
case-09 · gemini-3.6-flash · 8/19/2026 · answers are capped and redacted
What's inside
The instructions your model reads when the skill loads.
SKILL.md205 lines4 files
Code Review for Web
Review and debug web application code with a focus on the patterns that actually break production. Stack-agnostic principles in SKILL.md. Stack-specific patterns in references.
When to use
Reviewing a pull request before merging
Debugging a production issue
Investigating a build failure
Auditing security or performance of existing code
Investigating environment variable or configuration issues
Triaging a "the site is broken" report
When NOT to use
Writing a new feature spec (use pm-spec-writing)
Pre-launch QA against the running site (use qa-testing)
Performance deep-dive on Core Web Vitals (use performance-optimization)
Deep accessibility compliance review (use accessibility-audit)
Required inputs
The code, PR, error message, or symptom under review
Access to logs (build logs, function logs, server logs) if debugging
The stack (framework, hosting, database) - even at high level
If just a symptom is provided ("the site is broken"), the workflow's first step is gathering enough context to investigate.
The framework: 5 review dimensions
Every code review covers five dimensions. Pick the depth based on the situation.
Write or edit website copy, blog content, and editorial pieces with attention to voice, structure, and goal. Use this skill whenever the user wants to write an article, draft website copy, edit existing content for clarity or voice, write a blog post, or produce general editorial content. Triggers on write a blog post, draft an article, write copy for, edit this, rewrite this, write content, write a guide, draft a how-to, write web copy. Also triggers when content has been outlined and now needs