// Security-focused PR review for snarkVM codebase. WHEN: User says "review PR", "audit PR", "security review", "check PR changes", or wants thorough analysis of PR changes for bugs/vulnerabilities. WHEN NOT: Fixing review feedback (use snarkvm-fix pr), fetching context only (use snarkvm-github), or fixing issues (use snarkvm-fix).
Fetch GitHub context (PR or issue) into workspace for snarkVM development. WHEN: User says "fetch pr", "fetch issue", "get PR context", "load issue", mentions PR/issue numbers like "#123" or "PR 456", or needs GitHub context before reviewing/fixing. WHEN NOT: User already has fresh context loaded, or is asking about non-snarkVM repositories.
Fix GitHub issues or PR review feedback in snarkVM using TDD workflow. WHEN: User says "fix issue", "fix #123", "fix pr", "fix PR feedback", "address review comments", "resolve review threads", or wants to fix a bug/feature request from GitHub issues or address reviewer requests. WHEN NOT: Doing security review (use snarkvm-review), fetching context only (use snarkvm-github), or working on non-snarkVM code.
| name | snarkvm-review |
| description | Security-focused PR review for snarkVM codebase. WHEN: User says "review PR", "audit PR", "security review", "check PR changes", or wants thorough analysis of PR changes for bugs/vulnerabilities. WHEN NOT: Fixing review feedback (use snarkvm-fix pr), fetching context only (use snarkvm-github), or fixing issues (use snarkvm-fix). |
| context | fork |
| agent | general-purpose |
| model | opus |
| allowed-tools | Bash, Read, Write, Grep, Glob, Task |
| disable-model-invocation | true |
Mindset: Assume there is a bug. Find it. Ultrathink.
This skill runs in a forked context to keep exploration out of your main conversation.
/snarkvm-review <pr_number>
PR=$ARGUMENTS
WS=".claude/workspace"
SKILL_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../snarkvm-github" && pwd)"
if [[ ! -f "$WS/state-pr-$PR.md" ]]; then
"$SKILL_DIR/scripts/fetch-pr.sh" "$PR"
fi
Read: $WS/state-pr-$PR.md, $WS/files-pr-$PR.txt
Categorize changed files by risk:
Update $WS/state-pr-$PR.md with risk assessment.
For large PRs (30+ files): Focus CRITICAL/HIGH risk areas first. Use parallel subagents by category (crypto/circuit, synthesizer, other).
Before diving into code:
jq -r .body "$WS/context-pr-$PR.json"cat "$WS/linked-issues-pr-$PR.txt"Small/medium PRs (< 30 files): Sequential. For each CRITICAL/HIGH risk file — read full file, trace logic, check boundaries, write findings to state file, release from memory.
Large PRs (30+ CRITICAL/HIGH files): Spawn parallel Task subagents by category (crypto/circuit, synthesizer, other). Each reads assigned files, applies AGENTS.md checklists, returns findings table.
Apply AGENTS.md Review Checklist (Correctness, Crypto-Specific, Memory & Performance, Security) to each file.
Validate affected crates per AGENTS.md.
Update $WS/state-pr-$PR.md with findings:
| Sev | Location | Issue | Suggested Fix |
|---|
Severity: BLOCKER (must fix), BUG (should fix), ISSUE (consider), NIT (optional).
Recommendation: Approve, Request changes, or Needs discussion.
If requesting changes, create handoff for /snarkvm-fix pr:
sed -e "s/{{NUM}}/$PR/g" "$SKILL_DIR/templates/handoff.md" > "$WS/handoff-pr-$PR.md"