7review

Use for changes to REST, GraphQL, RPC, protobuf, OpenAPI, AsyncAPI, webhooks, SDK-facing structs, HTTP status semantics, pagination, idempotency, retry behavior, request/response schemas, and event payloads. This skill detects contract drift, backward-incompatible behavior, unsafe defaults, and missing contract tests.

Use for database migrations, schema changes, data model updates, persistence logic, query behavior, cache invalidation, backfills, retention changes, and durable memory writes. This skill reviews rolling deploy safety, reversibility, locking, data integrity, tenant isolation, migration ordering, and operational recovery.

Use when implementation must be checked against explicit design intent: PRD/SRS, acceptance criteria, architecture contracts, ADRs, component ownership, API/UI/data contracts, invariants, guarantees, prohibitions, and generated project wiki sections. Finds behavior that is locally correct but violates the intended system design.

Use to enforce an engineering method before judging code: problem intent, PRD/product scope, SRS/verifiable requirements, system contract/invariants, responsibility assignment, architecture/modeling, then implementation review. Also enforces the agent review lifecycle when the target system is a review automation service. Prevents shortcut reviews that let code or model output invent missing context.

Use for changes touching goroutines, workers, queues, retries, timeouts, context cancellation, HTTP clients, external APIs, Docker sidecars, streaming, memory stores, file handles, locks, schedulers, idempotency, or observability. This skill finds production failure modes such as leaks, hangs, duplicate work, lost work, retry storms, and silent partial failure.

Use when code changes must be traced to requirements, invariants, architecture decisions, threat controls, API contracts, process gates, or design sources. Enforces links between changed files and identifiers such as FR, NFR, INV, GAR, PRO, LAW, OPC, ADR, CMP, DSO, CTRL, and threat-model controls.

Use for dependency, build, CI, Docker, environment variable, feature flag, permission, runtime config, release packaging, and supply-chain changes. This skill reviews reproducibility, secret safety, least privilege, unsafe scripts, rollout defaults, version pinning, and deployment drift.

Use to enforce repository-specific engineering framework rules, architectural boundaries, coding conventions, language idioms, lifecycle hooks, package ownership, local helpers, deterministic gates, and documented guardrails. This skill resolves local rules from AGENTS.md, CLAUDE.md, rules directories, nearby code patterns, and framework docs without turning style preference into findings.

Review UI changes for accessibility, semantic HTML, keyboard interaction, focus management, responsive layout, design token consistency, form errors, and safe client behavior.

Master GitHub pull request APIs for review enrichment and publishing. Use when the agent needs to normalize GitHub webhook events, fetch PR metadata, commits, changed files, checks, discussions, labels, reviewers, or publish draft/final review comments.

Master GitLab merge request APIs for review enrichment and publishing. Use when the agent needs to normalize GitLab webhook events, fetch MR metadata, commits, diffs, pipelines, discussions, labels, approvals, or publish draft/final merge request notes.

Guide human-in-the-loop review decisions: decide when draft reports can be published, when final reports require approval, and how human edits affect memory.

Use for protected behavior governed by laws, guards, invariants, prohibitions, safety boundaries, authorization constraints, privacy rules, operation contracts, approval gates, destructive actions, publishing, and memory writes. Finds bypasses and alternate paths that violate explicit constraints.

Apply process knowledge such as Definition of Done, delivery rules, release gates, test expectations, operational playbooks, review policy, and team workflow constraints.

Use to discover, classify, select, and cite rich project knowledge for reviews: AGENTS.md, instructions, rules, PRD/SRS, architecture contracts, ADRs, API specs, threat models, design tokens, process docs, and project wiki context packs. Ensures review context is relevant, source-cited, and not invented.

Use when the agent needs to build, refresh, validate, or consume a repository wiki/context pack for better reviews. This skill turns source trees, docs, contracts, architecture notes, APIs, and tests into evidence-based project knowledge with citations, diagrams, ownership maps, and machine-readable context packs. It is for scheduled/manual knowledge building, not every hot review path.

Publish draft and final review reports safely to GitHub or GitLab. Use when the agent needs to format findings, avoid duplicate bot comments, create inline comments, update previous reports, or apply human-in-the-loop approval policy before publishing.

Use for any change touching trust boundaries, authn/authz, secrets, privacy, tenant isolation, parsers, files, network calls, webhooks, crypto, logging, dependency execution, or user-controlled input. This skill produces exploit-oriented security findings with attacker capability, failing guard, affected asset, evidence, false-positive checks, and concrete remediation.

Evaluate whether tests cover changed behavior, edge cases, regressions, external integrations, and deterministic validation paths. Use for all non-trivial code changes and especially bug fixes, validators, parsers, adapters, and workflows.