Code Review

What the source does

• FilesystemNone observedNo reads or writes in the source
• NetworkNone observedNo outbound calls in the source
• ShellNone observedNo commands run in the source
• DependenciesPinnedNothing floats
• SecretsNone foundNo keys in source

Five audit layers

Gates applied: no behavioural pass, no license.

Audit 0.4.1 · source sha dd4da722e22a · 18 Oct 2026Report an issue or request a re-scan

• Publisheragulli GitHub userOwner of the repository this skill is read from
• Source folderagulli/atlas-agents/ch09_agent_skills/skills/code-reviewThe exact folder we audited
• LicenceNot declaredAs the repository states it
• Commit pinned for this verdictdd4da722e22aA new audit runs when the source changes
• Repository statusNot archivedLast push 93 days ago
• Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

Its description: Perform a structured security and quality audit on source code. Use when asked to review code, audit a pull request, check for vulnerabilities, or assess code quality.

---
name: code-review
description: Perform a structured security and quality audit on source code. Use when asked to review code, audit a pull request, check for vulnerabilities, or assess code quality.
license: MIT
compatibility: Requires python 3.10+
allowed-tools: Bash(grep:*) Bash(rg:*) Read
---

## Overview

You are conducting a code review as a principal engineer with security expertise. This is not a courtesy scan — you are the last gate before production.

## Process

1. **Read the target files.** Use `file_read` or equivalent to load every file under review. Do not review from memory or summaries.
2. **Security pass.** Check for OWASP Top 10 vulnerabilities in this order:
   - SQL injection (string concatenation in queries)
   - Path traversal (`../` in file operations without validation)
   - Command injection (`os.system`, `subprocess` with `shell=True`)
   - Hardcoded secrets (API keys, passwords, tokens in source)
   - Insecure deserialization (`pickle.loads`, `yaml.load` without SafeLoader)
3. **Logic pass.** Check for:
   - Unhandled exceptions that silently swallow errors
   - Race conditions in concurrent code
   - Off-by-one errors in loops and slicing
   - Mutable default arguments in function signatures
4. **Style pass.** Flag only violations that affect readability or correctness:
   - Functions longer than 50 lines
   - Deeply nested conditionals (>3 levels)
   - Unused imports or variables
5. **Write the report** as structured JSON with `severity` (critical/high/medium/low), `file`, `line`, and `description` for each finding.

## Rationalizations

| Excuse | Rebuttal |
|--------|----------|
| "The code looks fine at a glance" | You must read every line. Glancing is not reviewing. |
| "This is just a small change" | Small changes cause production outages. Review the diff AND the surrounding context. |
| "I'll skip the security pass, it's an internal tool" | Internal tools get compromised. The security pass is mandatory. |
| "There are too many files to review" | Review them all. If there are more than 20 files, summarize findings per-directory. |

## Verification

Do not mark this review as complete until you have:
- [ ] Read every file under review (not summarized, not skimmed)
- [ ] Produced a JSON report with at least one finding (even if it's "no issues found")
- [ ] Categorized every finding by severity

Excerpt, first 2,371 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

git clone https://github.com/agulli/atlas-agents
git -C atlas-agents checkout dd4da722e22a

Works in

1. 2026-10-18
   ✓SAFE B 89 / 100

   first audit · source dd4da722e22a

Questions about Code Review

• github.com/agulli/atlas-agents/tree/main/ch09_agent_skills/skill — the audited source at commit dd4da722e22a and every finding aboveObserved · 18 Oct 2026

Spotted something wrong? Report a correction · Methodology