⏳ This skill is pending AI review.

Scores will appear once the review pipeline completes.

v0.1.0

code-review-testing

@honorx12⭐ 0 stars

Review code changes and test them: correctness, security-sensitive paths, AI-generated code scrutiny, regression tests and verification discipline. Use when reviewing a diff or PR or when remediation needs tests.

Choose how to use this skill

You do not need every option. Choose the path your AI client supports. The stable page stays the same; versioned files are immutable.

1. Native installer

This listing has no registered native installer command. Use the complete package or source fallback below, depending on what your client supports.

Do not guess an installer command or replace an existing version without reviewing the diff.

2. Complete package recommended

Download the ZIP when available. It includes SKILL.md plus the references, security notes and version metadata.

No complete ProSkills package is published for this listing yet.

3. Prompt-only

Copy the prompt above when the agent can read the stable page or when you want to adopt the workflow without installing a skill.

Need only the instruction file?

Download SKILL.md only if your client requires a single file. The complete ZIP is safer for a full installation because it preserves the references and release context.

No path installs or executes anything by itself. Your agent still needs access to the project files. Before updating, compare the installed version and review the diff.

—/10

// RATINGS

⭐GitHub Stars
⭐ 0 on GitHubGitHub ↗

New / niche

🟢ProSkills Score
—
📍

Not yet listed on ClawHub or SkillsMP

// README

VibeGuard

Security, quality and launch-readiness skills for AI coding agents.

License: MIT Stars

24 skills (SKILL.md files) that guide Claude Code, Cursor, Codex, Copilot, Gemini CLI and Windsurf to find, fix and verify problems in AI-generated and vibe-coded web apps: secrets, auth, injection, SSRF, payments, performance, SEO, accessibility and more.

Quick start

git clone https://github.com/honorx12/VibeGuard.git
# copy only the skill folders you need into your agent's skills folder
# Claude Code (project): .claude/skills/<name>/   (verify path, see agents/README.md)

Then ask your agent: "Use security-audit on this project."

Honest scope. These skills guide an agent's workflow. They do not make a system secure, compliant or accessible. A passing checklist is not proof. Findings must be backed by evidence and verification, and some decisions need a human.

What is inside

AreaSkills
Security (15)security-audit (orchestrator), secrets-detection, authentication-authorization, api-access-control, injection-prevention, web-input-security, ssrf-cors-webhooks, session-jwt-oauth, rate-limits-abuse, cloud-config, logging-monitoring-backups, ai-agent-security, dependency-supply-chain, crypto-data-protection, payment-business-logic
Frontend (4)accessibility-responsive, website-interactions, forms-validation, consent-and-privacy-ui
Production (3)production-readiness, performance, seo-metadata
Engineering (2)code-review-testing, skill-supply-chain-review

Coverage: 70 security issues, 20 UX enhancements, 20 production-checklist items plus 7 extensions. Every item has a stable ID (SEC-01…, UX-01…, PROD-01…), a primary skill, and detect / fix / verify guidance. See docs/COVERAGE_MAP.md (generated) and registry/coverage.json.

Install and use

python -m venv .venv && . .venv/bin/activate        # Windows: .venv\Scripts\activate
pip install -r requirements-dev.txt                  # exact tested versions: requirements-lock.txt
python scripts/validate_skills.py                    # validate skills, coverage, registry
python -m pytest                                     # run tests
python scripts/build_registry.py --check             # confirm generated files are current
python scripts/scan_project.py path/to/project       # candidate-only local scan (read-only, offline)

To use skills with an agent, copy only the skill folders you need into that agent's skills location. See agents/README.md: it separates what is confirmed from what must be checked against vendor documentation.

Start with security-audit, which routes to specialist skills based on your actual stack and defines the audit workflow (understand, select, audit, prioritise, plan, remediate, verify, report) and the approval gates for destructive, production, credential and permission changes.

Tools

ScriptPurposeNetwork
scripts/validate_skills.pyFrontmatter (spec rules), required sections, duplicate names, local references, related skills, coverage and registry validation. Nonzero exit on failure.none
scripts/scan_project.pyInventory plus regex candidates. Never prints secret values, never modifies the target, skips dependency/build dirs.none
scripts/build_registry.pyBuilds registry/skills-index.json and docs/COVERAGE_MAP.md; --check detects stale output.none
scripts/discover_skills.pyCatalogues public skills through the GitHub REST API (metadata only; optional heuristic inspection). Nothing is installed or executed.GitHub API (optional GITHUB_TOKEN)

Third-party content and licensing

This repository is MIT licensed (see LICENSE). It contains no copied third-party skills. External skills are only catalogued (registry/external-candidates.json) with source URL, licence, revision and retrieval date; entries with unclear or restrictive licences are marked link-only. Every external entry requires human review before any adoption. See docs/DISCOVERY_PIPELINE.md.

Known limitations

  • The local scanner is a small regex tool with false positives and false negatives (see examples/example-audit-report.md for a real miss).
  • Per-agent install paths were gathered from third-party sources, not vendor docs, in this release; see agents/README.md.
  • The first discovery run hit the unauthenticated GitHub rate limit; most candidates have unresolved revisions and no heuristic inspection (details in docs/DISCOVERY_REPORT.md).
  • No CI workflow is shipped yet (see roadmap).
  • Skills have not been evaluated empirically against agent behaviour. Only structure and traceability are tested.

Roadmap

CI workflow with SHA-pinned actions; per-skill references/ for long topics; agent behaviour evals; vendor-doc verification of integration paths; richer scanner rules with an allowlist file.

Docs

Architecture · Operating model · Security model · Authoring guide · Discovery pipeline · Contributing

// HOW IT'S BUILT

// FILES

2 files shipped with this skill. Inline text is the catalog copy. The upstream link is the source repository.

  • skills/engineering/code-review-testing/SKILL.md3.7 KB6a456f7c5990upstream ↗
    ---
name: code-review-testing
description: 'Review code changes and test them: correctness, security-sensitive paths, AI-generated code scrutiny, regression tests and verification discipline. Use when reviewing a diff or PR or when remediation needs tests.'
license: MIT
metadata:
  category: engineering
  version: 0.1.0
---

# Code Review Testing

## Objective

Ensure changes are understood, reviewed, tested and honestly reported.

## When to Use

Use when: reviewing a diff or PR or when remediation needs tests.

Do not use for: Whole-repo security audit (security-audit).

## Scope

Diffs, tests, linters, type checkers and CI results.

## Workflow

1. Inspect the project (language, framework, dependencies, data stores, auth model, deployment target, test commands) before changing anything.
2. Select only the checks below that apply to the actual stack; record those skipped and why.
3. Identify intent, then risk areas (auth, input, money, data).
4. Run commands and record exact results.
5. Report failed or unavailable checks explicitly.
6. Classify each result as **confirmed** (reproduced or directly evidenced by file and line, command output, or request/response) or **suspected** (pattern match or inference). Never present a suspicion as a confirmed finding.
7. Rank by severity, exploitability, exposure, confidence and business impact.
8. Explain the planned change, its effect, tests and possible breaking behaviour before any risky operation.
9. Make focused changes that preserve existing behaviour; avoid unrelated rewrites.
10. Verify using the commands under Verification and record exact outcomes.

## Detection Methods

- Read the diff and connected code.
- Run the project's test, lint and type commands.
- Add targeted regression tests.

## Coverage

Items this skill owns. Each is individually traceable in `registry/coverage.json`.

This skill owns no individual items; it coordinates the specialist skills.

### Supporting Role

Items owned elsewhere where this skill contributes:

- `SEC-50` Unreviewed code (owner: `security-audit`)

## Remediation

- Apply the smallest change that removes the confirmed problem; keep public behaviour stable.
- Prefer maintained libraries and platform features over custom implementations.
- Require human approval before: destructive changes, credential rotation, production deployment, external side effects, or material cloud permission changes.
- Add or update an automated regression test for each fix where practical.

## Verification

- Run the **Verify** step for every item touched; record the exact command and observed result.
- Run the project's existing tests, linter, type checker and build.
- Re-run the relevant scanner or check after the fix and compare with the baseline.
- Report any check that could not run as **unverified**, with the reason. Never report a pass for a check that did not execute.
- A passing checklist does not show the system is secure; state residual risk.

## Limitations

- Cannot replace human review for high-impact changes.
- Passing tests only show tested behaviour.
- Findings that depend on business intent, legal interpretation or production state need human review.

## Output Format

Report each finding as:

```text
ID: <coverage ID>   Severity: <Critical|High|Medium|Low|Info>   Confidence: <confirmed|likely|possible>
Location: <file:line or URL path>
Evidence: <command output or request/response excerpt; secrets redacted>
Impact: <what an attacker or user could do>
Fix: <change made or proposed>
Verification: <command run and result, or 'unverified: reason'>
```

End with: commands executed, checks skipped or unavailable, residual risks, and items needing human decision.

## Related Skills

- `security-audit`
- `skill-supply-chain-review`
  • README.mdupstream ↗

    Contents are not inlined in the catalog. Open the upstream file.

Plain-text copy, no login: /skill-bundles/honorx12-vibeguard-skills-engineering-code-review-testing.md

// REPO STATS

0 stars

// SHARE

Share on XShare on LinkedIn