basic-review

65 / 100 · Review before installing

Check before installing. Some of what it can do is expected: a coding skill usually runs build and test commands.

By ariadoss/superskills (GitHub) · coding · 12 stars · scanned at commit c7ec8d7

Read-only correctness review of pending changes, needing no external install: correctness, security, reliability/performance and contract risk, each finding cited as file:line with why it is wrong and a fix. The fallback when gstack's /review is unavailable (not installed, or its install is broken); /qa-full and /daily-qa call it automatically then. Applies a vendored copy of gstack's pre-landing checklist. Use when asked for a "basic review", a "quick review without gstack", or a review in a t…

Works with any agent that supports SKILL.md skills.

What this skill can do

Connects to the internet

The author does not mention this.

Found in 5 places.

skills/basic-review/checklist.md, line 59- LLM-generated URLs fetched without allowlist — SSRF risk if URL points to internal network (Python: `urllib.parse.urlparse` → check hostname against blocklist
skills/basic-review/checklist.md, line 77- Synchronous `subprocess.run()`, `open()`, `requests.get()` inside `async def` endpoints — blocks the event loop. Use `asyncio.to_thread()`, `aiofiles`, or `ht
setup, line 248log " [install] bun via curl -fsSL $BUN_INSTALL_URL | bash (third-party installer)"

Show 2 more

setup, line 249curl -fsSL "$BUN_INSTALL_URL" | bash >/dev/null 2>&1 || {
setup, line 251log " Install manually: curl -fsSL $BUN_INSTALL_URL | bash"

Runs commands on your computer

The author does not mention this. It runs automatically when the plugin is installed. Expected for a coding skill.

Found in 7 places.

skills/basic-review/checklist.md, line 63- `subprocess.run()` / `subprocess.call()` / `subprocess.Popen()` with `shell=True` AND f-string/`.format()` interpolation in the command string — use argument
skills/basic-review/checklist.md, line 64- `os.system()` with variable interpolation — replace with `subprocess.run()` using argument arrays
skills/basic-review/checklist.md, line 77- Synchronous `subprocess.run()`, `open()`, `requests.get()` inside `async def` endpoints — blocks the event loop. Use `asyncio.to_thread()`, `aiofiles`, or `ht

Show 4 more

hooks/hooks.json, line 8"command": "\"${CLAUDE_PLUGIN_ROOT}/scripts/qa-full-ledger-hook.sh\""
hooks/hooks.json, line 18"command": "\"${CLAUDE_PLUGIN_ROOT}/scripts/qa-full-ledger-hook.sh\""
hooks/hooks.json, line 28"command": "\"${CLAUDE_PLUGIN_ROOT}/scripts/handoff-trigger-hook.sh\""
hooks/hooks.json, line 38"command": "\"${CLAUDE_PLUGIN_ROOT}/scripts/humanize-prepush-hook.sh\""

Downloads and installs other software

The author does not mention this.

Found in 4 places.

setup, line 248log " [install] bun via curl -fsSL $BUN_INSTALL_URL | bash (third-party installer)"
setup, line 249curl -fsSL "$BUN_INSTALL_URL" | bash >/dev/null 2>&1 || {
setup, line 251log " Install manually: curl -fsSL $BUN_INSTALL_URL | bash"

Show 1 more

setup, line 284log " Install: brew install ffuf"

Changes files outside its own folder

The author does not mention this. It runs automatically when the plugin is installed.

Found in 2 places.

.codex-plugin/plugin.json, line 4"description": "Curated AI coding skills with a Google/Meta-quality workflow (TDD, DRY, SOLID). The Codex plugin install exposes the whole skills/ tree; pack se
.codex-plugin/plugin.json, line 24"longDescription": "Curated engineering skills with a Google/Meta-quality workflow: test-driven development, systematic debugging, code review and clean-code pa

Safer alternatives

Low-risk skills in the same category (coding) that look related. Check that one does what you need.

Install

Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.

if [ -e ~/.agents/skills/'basic-review' ] || [ -L ~/.agents/skills/'basic-review' ]; then echo 'A skill folder named basic-review already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/ariadoss/superskills' "$d" && git -C "$d" checkout --quiet 'c7ec8d78e5dc37484c2cfe90ab04de163d97dd41' -- 'skills/basic-review' && mkdir -p ~/.agents/skills && cp -R "$d"/'skills/basic-review' ~/.agents/skills/'basic-review' && rm -rf "$d"; fi

Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'basic-review' ~/.claude/skills/'basic-review' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.

Badge for your README

The badge for ariadoss/superskills shows the score of its lowest-scoring skill.

SkillTrust badge for ariadoss/superskills

[![SkillTrust](https://zalavijaysinh.github.io/skilltrust/badges/ariadoss/superskills.svg)](https://zalavijaysinh.github.io/skilltrust/repos/ariadoss/superskills/)

Score history

Date	Version	Score
2026-11-08	`c7ec8d7`	65
2026-11-06	`c7ec8d7`	45