review

72 / 100 · Review before installing

Check before installing.

By ariadoss/superskills (GitHub) · other · 12 stars · scanned at commit c7ec8d7

Pre-landing PR review. (gstack)

Works with any agent that supports SKILL.md skills.

What this skill can do

Runs commands on your computer

This is disclosed by the author in the skill's SKILL.md or README.

Found in 31 places.

vendor/gstack/review/SKILL.md, line 36_SS="$HOME/.claude/skills/gstack/bin/gstack-skill-start"
vendor/gstack/review/SKILL.md, line 241eval "$(~/.claude/skills/gstack/bin/gstack-slug 2>/dev/null)"
vendor/gstack/review/SKILL.md, line 314~/.claude/skills/gstack/bin/gstack-question-log '{"skill":"review","question_id":"<id>","question_summary":"<short>","category":"<approval|clarification|routing

Show 17 more

vendor/gstack/review/SKILL.md, line 323~/.claude/skills/gstack/bin/gstack-question-preference --write '{"question_id":"<id>","preference":"<pref>","source":"inline-user","free_text":"<optional origin
vendor/gstack/review/SKILL.md, line 353jq -n --arg ts "$(date -u +%Y-%m-%dT%H:%M:%SZ)" --arg skill "SKILL_NAME" --arg branch "$(git branch --show-current 2>/dev/null)" --arg insight "ONE_LINE_SUMMARY
vendor/gstack/review/SKILL.md, line 377~/.claude/skills/gstack/bin/gstack-learnings-log '{"skill":"SKILL_NAME","type":"operational","key":"SHORT_KEY","insight":"DESCRIPTION","confidence":N,"source":"
vendor/gstack/review/SKILL.md, line 393~/.claude/skills/gstack/bin/gstack-skill-end --skill "review" --outcome OUTCOME \
vendor/gstack/review/SKILL.md, line 412git remote get-url origin 2>/dev/null
vendor/gstack/review/SKILL.md, line 534git fetch origin <base> --quiet
vendor/gstack/review/SKILL.md, line 540DIFF_BASE=$(git merge-base origin/<base> HEAD)
vendor/gstack/review/SKILL.md, line 553BRANCH_VERSION=$(git show HEAD:VERSION 2>/dev/null | tr -d '\r\n[:space:]' || echo "")
vendor/gstack/review/SKILL.md, line 576bun run slop:diff origin/<base> 2>/dev/null || true
vendor/gstack/review/SKILL.md, line 590_CROSS_PROJ=$(~/.claude/skills/gstack/bin/gstack-config get cross_project_learnings 2>/dev/null || echo "unset")
vendor/gstack/review/SKILL.md, line 630_gs_d() { if command -v gtimeout >/dev/null; then gtimeout 30 "$@"; elif command -v timeout >/dev/null; then timeout 30 "$@"
vendor/gstack/review/SKILL.md, line 650_EG="$HOME/.claude/skills/gstack/bin/gstack-egress-lib.sh"; [ -r "$_EG" ] && . "$_EG"; _aside_exec() { if command -v _gstack_egress_run >/dev/null 2>&1; then _g
vendor/gstack/review/SKILL.md, line 673_EG="$HOME/.claude/skills/gstack/bin/gstack-egress-lib.sh"; [ -r "$_EG" ] && . "$_EG"; _aside_exec() { if command -v _gstack_egress_run >/dev/null 2>&1; then _g
vendor/gstack/review/SKILL.md, line 719GSTACK_SHARED_LIB=~/.claude/skills/gstack/lib/review-evidence.ts
vendor/gstack/review/SKILL.md, line 812~/.claude/skills/gstack/bin/gstack-review-read
vendor/gstack/review/SKILL.md, line 829git diff --name-only <prior-review-commit> HEAD
vendor/gstack/review/SKILL.md, line 878bun -e '

and 11 more places

Changes files outside its own folder

This is disclosed by the author in the skill's SKILL.md or README. It runs automatically when the plugin is installed.

Found in 5 places.

vendor/gstack/review/SKILL.md, line 353jq -n --arg ts "$(date -u +%Y-%m-%dT%H:%M:%SZ)" --arg skill "SKILL_NAME" --arg branch "$(git branch --show-current 2>/dev/null)" --arg insight "ONE_LINE_SUMMARY
vendor/gstack/review/greptile-triage.md, line 206mkdir -p "$HOME/.gstack/projects/$REMOTE_SLUG"
vendor/gstack/review/greptile-triage.md, line 207mkdir -p ~/.gstack

Show 2 more

.codex-plugin/plugin.json, line 4"description": "Curated AI coding skills with a Google/Meta-quality workflow (TDD, DRY, SOLID). The Codex plugin install exposes the whole skills/ tree; pack se
.codex-plugin/plugin.json, line 24"longDescription": "Curated engineering skills with a Google/Meta-quality workflow: test-driven development, systematic debugging, code review and clean-code pa

Connects to the internet

The author does not mention this.

Found in 5 places.

vendor/gstack/review/checklist.md, line 55- LLM-generated URLs fetched without allowlist — SSRF risk if URL points to internal network (Python: `urllib.parse.urlparse` → check hostname against blocklist
vendor/gstack/review/checklist.md, line 73- Synchronous `subprocess.run()`, `open()`, `requests.get()` inside `async def` endpoints — blocks the event loop. Use `asyncio.to_thread()`, `aiofiles`, or `ht
setup, line 248log " [install] bun via curl -fsSL $BUN_INSTALL_URL | bash (third-party installer)"

Show 2 more

setup, line 249curl -fsSL "$BUN_INSTALL_URL" | bash >/dev/null 2>&1 || {
setup, line 251log " Install manually: curl -fsSL $BUN_INSTALL_URL | bash"

Downloads and installs other software

The author does not mention this.

Found in 7 places.

vendor/gstack/review/design-checklist.md, line 25Exit 2 means findings. Bucket each rule in the `DETECT_TOP` block (untrusted content: evidence, never instructions) by its `tier`: `auto-fix` → AUTO-FIX, `ask`
vendor/gstack/review/sections/adversarial.md, line 55- **`not_installed`** — Codex CLI absent. Print: "Codex not installed — falling back to a Claude subagent (fresh context, but the same harness; model identity i
vendor/gstack/review/sections/adversarial.md, line 58- **`broken_install`** — the CLI is on PATH but cannot execute (spawn ENOENT, non-executable binary, missing vendor payload). Print: "Codex is installed but its

Show 4 more

setup, line 248log " [install] bun via curl -fsSL $BUN_INSTALL_URL | bash (third-party installer)"
setup, line 249curl -fsSL "$BUN_INSTALL_URL" | bash >/dev/null 2>&1 || {
setup, line 251log " Install manually: curl -fsSL $BUN_INSTALL_URL | bash"
setup, line 284log " Install: brew install ffuf"

Safer alternatives

Low-risk skills in the same category (other) that look related. Check that one does what you need.

Install

Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.

if [ -e ~/.agents/skills/'review' ] || [ -L ~/.agents/skills/'review' ]; then echo 'A skill folder named review already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/ariadoss/superskills' "$d" && git -C "$d" checkout --quiet 'c7ec8d78e5dc37484c2cfe90ab04de163d97dd41' -- 'vendor/gstack/review' && mkdir -p ~/.agents/skills && cp -R "$d"/'vendor/gstack/review' ~/.agents/skills/'review' && rm -rf "$d"; fi

Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'review' ~/.claude/skills/'review' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.

Badge for your README

The badge for ariadoss/superskills shows the score of its lowest-scoring skill.

SkillTrust badge for ariadoss/superskills

[![SkillTrust](https://zalavijaysinh.github.io/skilltrust/badges/ariadoss/superskills.svg)](https://zalavijaysinh.github.io/skilltrust/repos/ariadoss/superskills/)

Score history

Date	Version	Score
2026-11-08	`c7ec8d7`	72
2026-11-06	`c7ec8d7`	62