| name | ai-code-risk-review |
| description | Review AI-generated code for hallucinations, runtime risk, trust boundaries, and missing verification across React, TypeScript, FastAPI, and Node.js. |
AI Code Risk Review
Use this skill to decide where AI-generated code can be trusted, where it must be verified, and where the user must review before proceeding.
Procedure
- Identify the changed behavior and affected stack.
- Inspect the changed files and nearby call sites.
- Apply the relevant stack checklist:
- React/JS/TS UI: hooks, async UI state, SSR/hydration, forms, accessibility.
- TypeScript: casts,
any, suppressions, runtime validation, exhaustive unions.
- Python/FastAPI: async blocking, Pydantic/FastAPI version assumptions, auth dependencies, DB lifecycle.
- Node.js: unhandled promises, event loop blocking, env validation, injection/path/SSRF risks, worker idempotency.
- Run or recommend the smallest useful verification command.
- Classify the trust level and state what remains unverified.
Trust Levels
Static verification enough: simple pure code, formatting, small refactors, isolated tests.Runtime verification required: UI behavior, async flows, API behavior, validation, framework integration.Human review required: auth, authorization, payments, migrations, destructive data changes, secrets, deployment config.Do not trust yet: invented APIs, missing dependencies, broad rewrites, unexplained casts, tests not run, or no local way to verify.
Output Format
Risk: Low | Medium | High | Critical
Trust Level: Static verification enough | Runtime verification required | Human review required | Do not trust yet
Evidence:
- Files inspected:
- Commands run:
- Runtime checks:
Findings:
- ...
Unverified Assumptions:
- ...
Required Next Step:
- ...
Refusal To Overclaim
If verification was not run, say so. If code depends on external services, package versions, environment variables, or production data that were not available, downgrade confidence and list the missing evidence.
