human-review

47 / 100 · High risk

Only if you trust the author. Some of what it can do is expected: a coding skill usually runs build and test commands.

By victorrentea/human-review (GitHub) · coding · 46 stars · scanned at commit 9868964

Assemble .human-review/review.html — a tabbed reviewer's guide for a change set — from the review-points.md the coding agent committed with its fixes (what it fixed, declined and assumed), plus diagram deltas, a Code City shot, a feature video, the endpoint-complexity increment, the REST contract diff and deep-linked snippets. Explicit invocation only — user types /human-review.

Works with any agent that supports SKILL.md skills.

What this skill can do

Runs commands on your computer

This is disclosed by the author in the skill's SKILL.md or README. Expected for a coding skill.

Found in 562 places.

skills/human-review/SKILL.md, line 35for candidate in "${CLAUDE_PLUGIN_ROOT:-/nonexistent}/skills/human-review" \
skills/human-review/SKILL.md, line 50${SKILL}/scripts/run-review.py --base "$BASE" # Steps 1–5, end to end; prints the URL last
skills/human-review/SKILL.md, line 72${SKILL}/scripts/review-points.py --check

Show 17 more

skills/human-review/SKILL.md, line 113${SKILL}/scripts/preflight.py --base "$BASE"
skills/human-review/SKILL.md, line 148${SKILL}/scripts/run-steps.py --base "$BASE"
skills/human-review/SKILL.md, line 235${SKILL}/scripts/steps-ledger.py start guide --label "assemble content.json and build the page" \
skills/human-review/SKILL.md, line 258${SKILL}/scripts/rerun-model.py # Sonnet by default, one call for the whole ticket
skills/human-review/SKILL.md, line 368${SKILL}/scripts/steps-ledger.py end "$(cat .human-review/.step-guide)"
skills/human-review/SKILL.md, line 424${SKILL}/scripts/refresh-report.py # the page changed: rebuild, re-serve
skills/human-review/puml-diff/test_puml_diff.py, line 1056got = subprocess.run(["plantuml", "-tsvg", *(str(tmp_path / f"{n}.puml") for n in files)],
skills/human-review/scripts/annotate-feature-video.py, line 233out = subprocess.run(cmd, check=True, capture_output=True, text=True).stdout
skills/human-review/scripts/annotate-feature-video.py, line 334subprocess.run(["ffmpeg", "-v", "error", "-y", "-f", "concat", "-safe", "0",
skills/human-review/scripts/annotate-feature-video.py, line 405subprocess.run(cmd + [str(out)], check=True)
skills/human-review/scripts/authoring-sessions.py, line 115proc = subprocess.run(["git", *args], capture_output=True, text=True)
skills/human-review/scripts/authoring-sessions.py, line 295cache[name] = bool(tip) and subprocess.run(
skills/human-review/scripts/build-review-html.py, line 913extra_css += subprocess.run(
skills/human-review/scripts/build-review-html.py, line 924extra_css += subprocess.run(
skills/human-review/scripts/c2-from-sequence.py, line 859subprocess.run(["plantuml", "-tsvg", str(puml)],
skills/human-review/scripts/c2-from-sequence.py, line 861except (FileNotFoundError, subprocess.TimeoutExpired):
skills/human-review/scripts/c2-from-sequence.py, line 889def sh(args: list[str], root: Path) -> subprocess.CompletedProcess:

and 542 more places

Downloads and installs other software

The author does not mention this.

Found in 26 places.

skills/human-review/human-review.example.json, line 244"command": "npx ng test --watch=false --code-coverage --browsers=ChromeHeadless {karma}"}
skills/human-review/reference/content-schema.md, line 407`npx playwright show-trace …`, which opens the same recording natively. Serve the page
skills/human-review/reference/content-schema.md, line 586"missing": "run scripts/openapi-visual-diff.py (needs `brew install oasdiff`)"}}

Show 17 more

skills/human-review/scripts/ds-audit.py, line 34Requires: playwright (`pip install playwright && playwright install chromium`),
skills/human-review/scripts/extract-snippet.py, line 35raise SystemExit("[extract-snippet] needs Pygments: python3 -m pip install pygments")
skills/human-review/scripts/hrbuild/shared/layout.py, line 46"missing": "run scripts/openapi-visual-diff.py (needs `brew install oasdiff`)"},
skills/human-review/scripts/hrbuild/tabs/tests.py, line 355"cmd": f"cd {home} && npx playwright show-trace {zip_path}"})
skills/human-review/scripts/logextract.py, line 578"ast-grep not found on PATH — install it (`brew install ast-grep`, or "
skills/human-review/scripts/logextract.py, line 579"`pip install ast-grep-cli`) or point $AST_GREP_BIN at it. This scan is structural "
skills/human-review/scripts/openapi-compat.py, line 30`go install` binary, so it is treated as **optional**: when it is missing the
skills/human-review/scripts/openapi-compat.py, line 75raise SystemExit("[openapi-compat] needs PyYAML: python3 -m pip install pyyaml")
skills/human-review/scripts/openapi-compat.py, line 440"(<code>brew install oasdiff</code>, or <code>go install "
skills/human-review/scripts/openapi-visual-diff.py, line 11Requires: oasdiff on PATH (brew install oasdiff), PyYAML.
skills/human-review/scripts/playwright-python.sh, line 18"$VENV/bin/python" -m pip install --quiet --upgrade pip >&2
skills/human-review/scripts/playwright-python.sh, line 19"$VENV/bin/python" -m pip install --quiet playwright numpy pillow pygments >&2
skills/human-review/scripts/playwright-python.sh, line 25"$VENV/bin/python" -m pip install --quiet playwright numpy pillow pygments >&2
skills/human-review/scripts/playwright-traces.py, line 358"`npx playwright show-trace` command"),
skills/human-review/scripts/readme-tour.py, line 343" publish-demo.sh provisions it; or: pip install playwright && "
skills/human-review/scripts/shoot-review.py, line 480" pip install playwright && playwright install chromium"
skills/human-review/scripts/structurizr-views.py, line 577"(pip install playwright && playwright install chromium)")

and 6 more places

Connects to the internet

The author does not mention this.

Found in 117 places.

skills/human-review/scripts/drive-to-cue.js, line 67const res = await fetch(url);
skills/human-review/scripts/drive-to-cue.js, line 76const r = await fetch(APP + RESET, {method: "POST"}).catch(() => null);
skills/human-review/scripts/ds-audit.py, line 52import urllib.request

Show 17 more

skills/human-review/scripts/ds-audit.py, line 2960urllib.request.urlopen(url, timeout=timeout).close()
skills/human-review/scripts/endpoint-complexity.py, line 63import urllib.request
skills/human-review/scripts/endpoint-complexity.py, line 599with urllib.request.urlopen(url, timeout=60) as r, open(part, "wb") as f:
skills/human-review/scripts/hrbuild/assets/app-env.js, line 123return fetch('/__compose__?run=' + encodeURIComponent(id), {cache: 'no-store'})
skills/human-review/scripts/hrbuild/assets/app-env.js, line 334fetch('/__open_db__', {
skills/human-review/scripts/hrbuild/assets/app-env.js, line 375fetch(b + '/healthz', {cache: 'no-store'}).then(function (r) {
skills/human-review/scripts/hrbuild/assets/app-env.js, line 439fetch(b + bar.dataset.reset, {cache: 'no-store'}).then(function (r) {
skills/human-review/scripts/hrbuild/assets/app-env.js, line 639return fetch('/__run_status__', {cache: 'no-store'}).then(function (r) {
skills/human-review/scripts/hrbuild/assets/app-env.js, line 732fetch(b + bar.dataset.reset + (name ? '/' + encodeURIComponent(name) : ''),
skills/human-review/scripts/hrbuild/assets/editor.js, line 495fetch(LAUNCHER + '/serve', {
skills/human-review/scripts/hrbuild/assets/editor.js, line 708fetch('/__open_diff__?path=' + encodeURIComponent(dpath) + '&base=' + encodeURIComponent(base)
skills/human-review/scripts/hrbuild/assets/editor.js, line 740fetch('/__open__?path=' + encodeURIComponent(ref2.path) + '&line=' + ref2.line
skills/human-review/scripts/hrbuild/assets/editor.js, line 786fetch('/__open_pr__', {method: 'POST', cache: 'no-store',
skills/human-review/scripts/hrbuild/assets/editor.js, line 805fetch('/__editor_open__', {method: 'POST', cache: 'no-store',
skills/human-review/scripts/hrbuild/assets/editor.js, line 871return fetch('/__editor__?' + commitQuery() + ideQuery(), {cache: 'no-store'})
skills/human-review/scripts/hrbuild/assets/editor.js, line 891var opened = fetch('/__editor_open__', {
skills/human-review/scripts/hrbuild/assets/editor.js, line 981fetch('/__reveal__', {

and 97 more places

Reads your saved credentials, such as SSH keys or .env files

The author does not mention this.

Found in 3 places.

skills/human-review/scripts/hrbuild/shared/actions.py, line 79env = dict(os.environ)
skills/human-review/scripts/hrbuild/tabs/cost.py, line 47env = dict(os.environ)
skills/human-review/scripts/refresh-report.py, line 421env = dict(os.environ)

Changes files outside its own folder

The author does not mention this.

Found in 6 places.

skills/human-review/scripts/test_city_step.py, line 143(bin_dir / "node").write_text("#!/usr/bin/env bash\necho '3 changed'\n")
skills/human-review/scripts/test_preflight_gate.py, line 88git.write_text('#!/bin/sh\nif [ "$1" = push ]; then exit 0; fi\nexec /usr/bin/git "$@"\n')
skills/human-review/scripts/test_preflight_gate.py, line 153gh.write_text("#!/usr/bin/env python3\nimport sys\n"

Show 3 more

skills/human-review/scripts/test_preflight_gate.py, line 160git.write_text('#!/bin/sh\nif [ "$1" = push ]; then exit 0; fi\nexec /usr/bin/git "$@"\n')
skills/human-review/scripts/test_semcov.py, line 1176exe.write_text("#!/usr/bin/env python3\nimport json, sys\n"
README.md, line 1015ln -s ~/workspace/human-review/skills/human-review \

Safer alternatives

Low-risk skills in the same category (coding) that look related. Check that one does what you need.

Install

Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.

if [ -e ~/.agents/skills/'human-review' ] || [ -L ~/.agents/skills/'human-review' ]; then echo 'A skill folder named human-review already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/victorrentea/human-review' "$d" && git -C "$d" checkout --quiet '986896402235473e699bbb59a449285cbefa73a6' -- 'skills/human-review' && mkdir -p ~/.agents/skills && cp -R "$d"/'skills/human-review' ~/.agents/skills/'human-review' && rm -rf "$d"; fi

Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'human-review' ~/.claude/skills/'human-review' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.

Badge for your README

The badge for victorrentea/human-review shows the score of its lowest-scoring skill.

SkillTrust badge for victorrentea/human-review

[![SkillTrust](https://zalavijaysinh.github.io/skilltrust/badges/victorrentea/human-review.svg)](https://zalavijaysinh.github.io/skilltrust/repos/victorrentea/human-review/)

Score history

Date	Version	Score
2026-11-14	`9868964`	47
2026-11-10	`7292ad0`	47
2026-11-07	`3bc8648`	77