// Agents and skills //

runs in Claude Code

A Claude Code skill that has Claude review a code change before it goes to production. It's for people who code with an agent and want a real second read on what was written, by themselves or by another agent. Claude reads, verifies, fixes the minimum, and reports; pushing the code, applying migrations to the remote database, and agreeing to ship with open findings are on you. The core idea: whoever looks for the defect and whoever decides whether it exists are separate reads. Reviewers with separate lenses (database and deployment, security and boundaries, behavior, test quality) look for real defects. Then a second read tries to refute each finding by following the actual code path. Only what survives both gets fixed. It starts from git, not from the author's description, and picks the review that fits: docs only, a change outside sensitive zones, a sensitive zone (database, payments, login and permissions, or secrets), a change that's too big, or code from another agent, where the "everything passed" report is treated as a claim. What it delivers: the review scope taken from git, with files grouped by zone and the lenses the change calls for; findings in a fixed format (title, file and line, severity, and the concrete failure scenario; no scenario, no finding); adversarial verification, with a verdict of confirmed, partly confirmed, refuted, or unverified, and severity downgraded in the open; minimal fixes, re-verified against the original finding; and a report to the owner that answers "can I ship?" and separates what was verified by running, what was only read, and what wasn't checked. It comes with four reference sheets, five templates (the roles of each reader, the finding, the report, a filled-in fictional example, and the project's zone config), and a script, escopo.py, that only reads git and prints the base, the files by zone, the lenses requested, and the warnings: change too big, migration bundled with code, test file removed, and environment file in the diff. Limitations: review by reading doesn't prove the absence of defects. It doesn't catch what only shows up at runtime (races, performance, memory), what's outside the diff, or what no lens asks about; it isn't a security audit of the whole system and doesn't replace automated tests. The script decides the zone by file path, not by content, so the skill says to add a lens by hand when needed. The method came from a real review done with several agents; the multi-pass review by a single agent and the separate test lens are part of the method's design, without that prior use, and with one agent the report says "limited independence." The method's numbers (800 lines or 40 files per review, four checks per lens, two rounds of fixes) are a starting point, not a measurement. The lens questions came from a web app with a relational database; for other kinds of systems, they need to be rewritten. With several agents the review costs more: three lenses and six findings to verify make twelve reads, and the skill states the number up front. Requirements: git and Python 3.8 or newer, only for the script, which uses only the standard library, doesn't access the network, doesn't change the repository, and doesn't open environment files (from a .env only the name comes out). To install, unzip the .zip into ~/.claude/skills/.

• Runs in Claude Code
• Intermediate