メニュー
Code review conventions for all projects. Covers mandatory review requirements, review scope, PR sizing, reviewer and author responsibilities, and automated review integration. Applied when creating or reviewing pull requests.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
Scan a project for missing best-practice areas and implement the top recommendation for each gap (linting, unit testing) — installs tools, writes configs, verifies, and commits. Pass 'recommend' to stop after writing recommendations without implementing (replaces the old do-recommend skill).
Implement a focused code change. Use this skill as the wrapper for any implementation work so the Maverick workflow report captures what was done and so the agent applies the project's coding standards before editing. Intended to be invoked once per task from inside a do-issue-* or do-epic phase, not standalone.
Audit a codebase for security risks in one of two modes. In full-audit mode it scans the entire codebase and writes a findings report to docs/security-audit.md (run as part of do-init or on demand). In update mode it reviews only a diff plus the code it could impact, returning a structured findings list as a pre-push gate for do-issue-solo and do-issue-guided. Covers secrets exposure, dependency vulnerabilities, authentication and authorisation patterns, input validation, transport security, and common OWASP risks.
Create, restructure, or update technical documentation. Handles greenfield projects, refactoring non-compliant docs, and incremental updates after code changes.
Work on a multi-story GitHub epic end-to-end. Builds a DAG from the child stories, groups them into waves, runs waves in parallel via per-story worktrees, ejects PRs that fail agent-code-review for human handling, and propagates blocks to downstream stories. Requires git worktrees.
Initialise a project for use with Maverick — verifies the GitHub App, installs the CLI if needed, writes the project config with integration tracking, scaffolds docs, generates project skills, runs an initial cybersecurity audit, then commits the changes and opens a PR.
| name | mav-bp-code-review |
| description | Code review conventions for all projects. Covers mandatory review requirements, review scope, PR sizing, reviewer and author responsibilities, and automated review integration. Applied when creating or reviewing pull requests. |
| user-invocable | false |
| disable-model-invocation | true |
Ensure all code changes are reviewed before merging; in Maverick the reviewer is agent-code-reviewer running in-session, backed by branch-protection gates.
do-cybersecurity-review (update mode against the diff and impact set) before the PR is opened. By review time, security findings are already surfaced and folded into the PR body.| Size | Lines changed | Review quality | Recommendation |
|---|---|---|---|
| Small | < 100 | Excellent | Ideal. Aim for this size. |
| Medium | 100 - 400 | Good | Acceptable for most feature work. |
| Large | 400 - 800 | Declining | Split if possible. Flag to reviewers. |
| Too large | > 800 | Poor | Must split. Reviewers cannot effectively review this. |
Split strategies: by layer (backend vs frontend), by feature slice (one endpoint/component per PR), by phase (refactor PR before feature PR), or by dependency (extract shared utilities/models into a preparatory PR).
| Pattern | Issue | Fix |
|---|---|---|
| PR merged without any review | No review gate | Enable branch protection requiring approvals |
| PR with 1000+ lines changed | Too large to review effectively | Split into smaller, focused PRs |
| All review comments are style nits | Wasted review effort | Configure linters to catch style; focus on logic |
| Reviewer approves without comments on large PR | Rubber-stamp review | Reviewers must demonstrate understanding of the change |
| Author pushes "fix review" commits without context | Lost review trail | Explain what was changed in response to which comment |
| Self-approval on protected branch | Missing review gate | Configure branch protection to disallow self-approval |
| Skipping CI to merge faster | Bypassing quality gates | CI must pass; fix failures, do not skip them |