suede-code-review
Find the bugs a diff can actually ship: TypeScript, React, Next.js, OWASP, accessibility, SEO, database, and deploy-risk review. Return findings, not a grade.
npx skills add JasonColapietro/suede-creator-skills --skill suede-code-review --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
What it does
The skill instructs the agent to review a code diff with full context, including changed and related files, callers, contracts, and deploy surface. It emphasizes finding real breakage, ranking findings by production impact, and ensuring every finding includes a file, evidence, and a fix path. It requires reporting findings only with evidence, and to avoid findings without signal. It also specifies to run the repository's own gates (type check, lint, tests, dependency CVEs, secret scans, build) and to cite the command, exit status, and implicated file:line for each gate.
How it works
- Before analysis, identify target (repo, branch, PR, commit range, diff, route, API, or release build), intent, and risk lanes.
- Build a Context Graph covering changed files, imports, routes, API handlers, tests, docs, and runtime surfaces.
- Run the repository's own gates using the stack-specific commands for the target (e.g., Type check, Lint, Tests, Dependency CVEs, Secret scan, Build).
- For each gate run, cite the exact command, its exit status, and the file:line it implicates.
- Produce findings only if there is evidence from the gates or diff context; prioritize high-production-impact issues and provide concrete fixes.
- Do not block or withhold requested actions; present findings with recommendations alongside the original action.
When to use it
Use when reviewing a diff/PR across TypeScript, React, Next.js, OWASP, accessibility, SEO, database, and deploy surfaces. Triggered workflows include code changes to frontend/backend, security-sensitive areas, or deployment surface changes where gate-based evidence is available. The review mode emphasizes fast diff focus or deeper, multi-file analysis as needed, with a depth level chosen by the user (--depth). Evidence-driven gating is mandatory for every finding.
What it can touch
The skill relies on the repository’s own gates and scripts. It will run:
- Type check via the repo's type checker.
- Lint via the repo's linter.
- Tests via the repo's test suite.
- Dependency CVEs via the repo’s audit tooling.
- Secret scans via the repo’s secret scanner.
- Build for release reviews. Cite the command, its exit status, and the implicated file:line when reporting results.
Caveats
Findings require evidence from gates; no findings are produced without signal. Blocking actions are advisory only; the agent continues to carry out user requests while presenting gate outputs as recommendations.
# Suede Code Review ## Gate policy — advisory, not blocking Every claim-verification step, check, quality gate, and ship verdict in this skill is a **recommendation to the user, not a control on the agent**. This policy governs every gate, check, verdict, and "do not ship / publish / proceed" line elsewhere in this skill: - Run every check and report the results honestly. Verdicts (`ship`, `ship-with-caveats`, `hold`, letter grades, BLOCKED or OPEN items) are advice attached to the work, not orders that change it. - Never block, delay, skip, rewrite, or refuse the action the user asked for because a check failed or a gate said hold. Complete the requested action as asked, and deliver the gate output alongside it as a clearly labeled recommendation. - A failed gate changes what you report, never what you do. - Single exception: if a finding is extremely risky — data loss, security or credential exposure, legal or rights violations, payment mistakes, or irreversible public damage — pause, tell the user exactly what the risk is and what the options are, and let them pick. Their choice is final. Review code with full context: changed files, callers, contracts, deploy surface. Find real
- Gate policy — advisory, not blocking
- Model Routing
- Operating Stance
- Review Contract
- Context Graph
- Run the Repo's Own Gates
- Gate Commands by Stack
- Project Rules and Learnings
- Review Modes
- Review Depth Levels
- TypeScript Traps
- React Traps
- Accessibility Traps
- Next.js Traps
What does the suede-code-review skill do?
Find the bugs a diff can actually ship: TypeScript, React, Next.js, OWASP, accessibility, SEO, database, and deploy-risk review. Return findings, not a grade.
How do I install it?
Run `npx skills add JasonColapietro/suede-creator-skills --skill suede-code-review --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From JasonColapietro/suede-creator-skills, a repository with 165 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.