# code-review-testing Adopt this skill: https://proskills.md/skills/engineering/honorx12-vibeguard-skills-engineering-code-review-testing Page: https://proskills.md/skills/engineering/honorx12-vibeguard-skills-engineering-code-review-testing This document is the public skill bundle for that page. It contains SKILL.md and every helper file the catalog carries. No login is required. ## File: skills/engineering/code-review-testing/SKILL.md size: 3774 sha: 6a456f7c5990a32ab8c3afe4f87dd83686bd514d upstream: https://github.com/honorx12/vibeguard/blob/main/skills/engineering/code-review-testing/SKILL.md ````text --- name: code-review-testing description: 'Review code changes and test them: correctness, security-sensitive paths, AI-generated code scrutiny, regression tests and verification discipline. Use when reviewing a diff or PR or when remediation needs tests.' license: MIT metadata: category: engineering version: 0.1.0 --- # Code Review Testing ## Objective Ensure changes are understood, reviewed, tested and honestly reported. ## When to Use Use when: reviewing a diff or PR or when remediation needs tests. Do not use for: Whole-repo security audit (security-audit). ## Scope Diffs, tests, linters, type checkers and CI results. ## Workflow 1. Inspect the project (language, framework, dependencies, data stores, auth model, deployment target, test commands) before changing anything. 2. Select only the checks below that apply to the actual stack; record those skipped and why. 3. Identify intent, then risk areas (auth, input, money, data). 4. Run commands and record exact results. 5. Report failed or unavailable checks explicitly. 6. Classify each result as **confirmed** (reproduced or directly evidenced by file and line, command output, or request/response) or **suspected** (pattern match or inference). Never present a suspicion as a confirmed finding. 7. Rank by severity, exploitability, exposure, confidence and business impact. 8. Explain the planned change, its effect, tests and possible breaking behaviour before any risky operation. 9. Make focused changes that preserve existing behaviour; avoid unrelated rewrites. 10. Verify using the commands under Verification and record exact outcomes. ## Detection Methods - Read the diff and connected code. - Run the project's test, lint and type commands. - Add targeted regression tests. ## Coverage Items this skill owns. Each is individually traceable in `registry/coverage.json`. This skill owns no individual items; it coordinates the specialist skills. ### Supporting Role Items owned elsewhere where this skill contributes: - `SEC-50` Unreviewed code (owner: `security-audit`) ## Remediation - Apply the smallest change that removes the confirmed problem; keep public behaviour stable. - Prefer maintained libraries and platform features over custom implementations. - Require human approval before: destructive changes, credential rotation, production deployment, external side effects, or material cloud permission changes. - Add or update an automated regression test for each fix where practical. ## Verification - Run the **Verify** step for every item touched; record the exact command and observed result. - Run the project's existing tests, linter, type checker and build. - Re-run the relevant scanner or check after the fix and compare with the baseline. - Report any check that could not run as **unverified**, with the reason. Never report a pass for a check that did not execute. - A passing checklist does not show the system is secure; state residual risk. ## Limitations - Cannot replace human review for high-impact changes. - Passing tests only show tested behaviour. - Findings that depend on business intent, legal interpretation or production state need human review. ## Output Format Report each finding as: ```text ID: Severity: Confidence: Location: Evidence: Impact: Fix: Verification: ``` End with: commands executed, checks skipped or unavailable, residual risks, and items needing human decision. ## Related Skills - `security-audit` - `skill-supply-chain-review` ```` ## File: README.md upstream: https://github.com/honorx12/vibeguard/blob/main/README.md ````text # VibeGuard **Security, quality and launch-readiness skills for AI coding agents.** [![License: MIT](https://img.shields.io/github/license/honorx12/VibeGuard)](LICENSE) [![Stars](https://img.shields.io/github/stars/honorx12/VibeGuard?style=flat)](https://github.com/honorx12/VibeGuard/stargazers) 24 skills (`SKILL.md` files) that guide Claude Code, Cursor, Codex, Copilot, Gemini CLI and Windsurf to find, fix and *verify* problems in AI-generated and vibe-coded web apps: secrets, auth, injection, SSRF, payments, performance, SEO, accessibility and more. **Quick start** ```bash git clone https://github.com/honorx12/VibeGuard.git # copy only the skill folders you need into your agent's skills folder # Claude Code (project): .claude/skills// (verify path, see agents/README.md) ``` Then ask your agent: *"Use security-audit on this project."* --- > **Honest scope.** These skills guide an agent's workflow. They do not make a system secure, compliant or accessible. A passing checklist is not proof. Findings must be backed by evidence and verification, and some decisions need a human. ## What is inside | Area | Skills | | --- | --- | | Security (15) | `security-audit` (orchestrator), `secrets-detection`, `authentication-authorization`, `api-access-control`, `injection-prevention`, `web-input-security`, `ssrf-cors-webhooks`, `session-jwt-oauth`, `rate-limits-abuse`, `cloud-config`, `logging-monitoring-backups`, `ai-agent-security`, `dependency-supply-chain`, `crypto-data-protection`, `payment-business-logic` | | Frontend (4) | `accessibility-responsive`, `website-interactions`, `forms-validation`, `consent-and-privacy-ui` | | Production (3) | `production-readiness`, `performance`, `seo-metadata` | | Engineering (2) | `code-review-testing`, `skill-supply-chain-review` | Coverage: **70 security issues**, **20 UX enhancements**, **20 production-checklist items plus 7 extensions**. Every item has a stable ID (`SEC-01`…, `UX-01`…, `PROD-01`…), a primary skill, and detect / fix / verify guidance. See [`docs/COVERAGE_MAP.md`](docs/COVERAGE_MAP.md) (generated) and `registry/coverage.json`. ## Install and use ```bash python -m venv .venv && . .venv/bin/activate # Windows: .venv\Scripts\activate pip install -r requirements-dev.txt # exact tested versions: requirements-lock.txt python scripts/validate_skills.py # validate skills, coverage, registry python -m pytest # run tests python scripts/build_registry.py --check # confirm generated files are current python scripts/scan_project.py path/to/project # candidate-only local scan (read-only, offline) ``` To use skills with an agent, copy only the skill folders you need into that agent's skills location. See [`agents/README.md`](agents/README.md): it separates what is confirmed from what must be checked against vendor documentation. Start with `security-audit`, which routes to specialist skills based on your actual stack and defines the audit workflow (understand, select, audit, prioritise, plan, remediate, verify, report) and the approval gates for destructive, production, credential and permission changes. ## Tools | Script | Purpose | Network | | --- | --- | --- | | `scripts/validate_skills.py` | Frontmatter (spec rules), required sections, duplicate names, local references, related skills, coverage and registry validation. Nonzero exit on failure. | none | | `scripts/scan_project.py` | Inventory plus regex *candidates*. Never prints secret values, never modifies the target, skips dependency/build dirs. | none | | `scripts/build_registry.py` | Builds `registry/skills-index.json` and `docs/COVERAGE_MAP.md`; `--check` detects stale output. | none | | `scripts/discover_skills.py` | Catalogues public skills through the GitHub REST API (metadata only; optional heuristic inspection). Nothing is installed or executed. | GitHub API (optional `GITHUB_TOKEN`) | ## Third-party content and licensing This repository is MIT licensed (see `LICENSE`). It contains **no copied third-party skills**. External skills are only catalogued (`registry/external-candidates.json`) with source URL, licence, revision and retrieval date; entries with unclear or restrictive licences are marked `link-only`. Every external entry requires human review before any adoption. See [`docs/DISCOVERY_PIPELINE.md`](docs/DISCOVERY_PIPELINE.md). ## Known limitations - The local scanner is a small regex tool with false positives and false negatives (see `examples/example-audit-report.md` for a real miss). - Per-agent install paths were gathered from third-party sources, not vendor docs, in this release; see `agents/README.md`. - The first discovery run hit the unauthenticated GitHub rate limit; most candidates have unresolved revisions and no heuristic inspection (details in `docs/DISCOVERY_REPORT.md`). - No CI workflow is shipped yet (see roadmap). - Skills have not been evaluated empirically against agent behaviour. Only structure and traceability are tested. ## Roadmap CI workflow with SHA-pinned actions; per-skill `references/` for long topics; agent behaviour evals; vendor-doc verification of integration paths; richer scanner rules with an allowlist file. ## Docs [Architecture](docs/ARCHITECTURE.md) · [Operating model](docs/OPERATING_MODEL.md) · [Security model](docs/SECURITY_MODEL.md) · [Authoring guide](docs/SKILL_AUTHORING_GUIDE.md) · [Discovery pipeline](docs/DISCOVERY_PIPELINE.md) · [Contributing](CONTRIBUTING.md) ````