suede-code
Review and grade code in one pass: real findings, A-F ship verdict, auth/payment risk, OWASP checks, deploy safety, and fix briefs.
npx skills add JasonColapietro/suede-creator-skills --skill suede-code --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
What it does
Reviews and grades code in a single pass, returning concrete findings with file references, evidence, and a fix path, plus a blunt A-F ship verdict and a deploy-safety perspective. Provides an advisory gate (ship, ship-with-caveats, hold) rather than an automatic action, and emphasizes evidence-driven findings for security, data, and deployment aspects.
How it works
- Operates in explicit invocation (e.g., user asks to review or grade).
- Performs a one-pass review that yields: (a) real findings with evidence and a concrete fix path, (b) a ship verdict via a letter grade, and (c) a deploy-safety assessment.
- Uses a structured gate policy: reports recommendations rather than blocking actions; only pauses on extremely risky findings with explicit options for user choice.
- Runs a set of predefined gates and checks including runtime behavior review, risk areas (auth, payments, data, deployments), and OWASP-oriented checks.
- Applies different review modes and depth levels, with depth controlled by a flag (e.g., --depth: --quick, --standard, --deep).
- Requires explicit targets (repo/branch/PR/diff) and intent before analyzing; reads project conventions and gates already implemented in the repository.
When to use it
Use when you need a consolidated security-review pass that yields a grade and actionable findings, especially for authentication, payments, data integrity, deployment safety, and compliance with OWASP considerations. Invoke it explicitly on the target change; it does not run automatically on diffs or commits.
What it can touch
- Tools: "claude-code", "codex" (declared tools)
- Inputs: code diffs, current source, and relevant runtime behavior as described in the operating stance and gates
- Artifacts: findings with file paths, evidence, and fix paths; a final grade; a deploy-safety assessment
Caveats
- Gate outputs are recommendations, not blocking actions.
- A failed gate changes the report, not the action taken.
- Some findings require concrete evidence to be produced by the reviewer; no findings without evidence.
- Runs only when explicitly asked; not automatic on diffs, saves, or commits.
- Depth levels and gates are configurable per the skill's protocol; may require running gates already shipped in the repository.
# Suede Code ## Gate policy — advisory, not blocking Every claim-verification step, check, quality gate, and ship verdict in this skill is a **recommendation to the user, not a control on the agent**. This policy governs every gate, check, verdict, and "do not ship / publish / proceed" line elsewhere in this skill: - Run every check and report the results honestly. Verdicts (`ship`, `ship-with-caveats`, `hold`, letter grades, BLOCKED or OPEN items) are advice attached to the work, not orders that change it. - Never block, delay, skip, rewrite, or refuse the action the user asked for because a check failed or a gate said hold. Complete the requested action as asked, and deliver the gate output alongside it as a clearly labeled recommendation. - A failed gate changes what you report, never what you do. - Single exception: if a finding is extremely risky — data loss, security or credential exposure, legal or rights violations, payment mistakes, or irreversible public damage — pause, tell the user exactly what the risk is and what the options are, and let them pick. Their choice is final. One pass for code: a deep, evidence-based review **and** a blunt A-F ship grade, together by defau
- Gate policy — advisory, not blocking
- Model Routing
- Operating Stance
- Review Contract
- Context Graph
- Run Gates and Honor Project Rules
- Review Modes
- Depth Levels
- Step 1 — Instant-F Triggers (check before scoring anything)
- Step 2 — Language Traps
- Step 4 — Grade (A-F, runs by default)
- Step 5 — Deploy Safety Gate (runs at the end, every time)
- Finding Format
- Fix Mode (only on --fix or explicit request)
What does the suede-code skill do?
Review and grade code in one pass: real findings, A-F ship verdict, auth/payment risk, OWASP checks, deploy safety, and fix briefs.
How do I install it?
Run `npx skills add JasonColapietro/suede-creator-skills --skill suede-code --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From JasonColapietro/suede-creator-skills, a repository with 165 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.