Named Persona Adversarial Review
Code review through the lens of real engineers' documented philosophies (Torvalds, Thompson, Carmack, Kent Beck, Jobs, Cagan).
Before & after
Same prompt, same agent — the only difference is the skill.
I can do a code review for you. To give you helpful feedback, I'd want to know a bit more about what the middleware does, what tests you have in place, and whether there are any particular concerns you have about it. Are we talking about authentication, authorization, or both? What's the threat model? Have you tested for timing attacks or token validation edge cases? I could walk through it section by section and look for common vulnerabilities, but knowing your specific context would help me focus on the most important risks.
AUTH MIDDLEWARE REVIEW — MULTIPLE PERSPECTIVES
TORVALDS VIEW: Simplicity & Correctness
• Concern: 1,200 lines for middleware (signal: can be halved)
• Verdict: Extract token validation into separate 80-line module
• Question: Why is session state stored in memory? Recovery after crash loses all sessions.
• Recommendation: Serialize to Redis with 1-hour TTL, test cold-start behavior
CARMACK VIEW: Performance & Architecture
• Concern: Token validation runs on every request, no caching
• Verdict: Cache valid tokens for 5 minutes, validate once per batch
• Finding: Timing vulnerability in string comparison (==, not constant-time)
• Impact: Attackers can brute-force tokens character-by-character
JOBS VIEW: User Experience
• Concern: Error messages are overly technical
• Verdict: Replace "JWT decode failed" with "Sign in again" for expired tokens
• Finding: No graceful fallback for downstream service timeout
• Recommendation: Allow "guest" mode if auth service is down (configurable)
BECK VIEW: Testing & Maintainability
• Concern: 0 edge case tests (what if token has no exp field?)
• Verdict: Add test matrix: expired, invalid_signature, missing_claims
• Gap: No test for refresh token rotation after 30 days
REPRO SCRIPT (Run to confirm issues)
```bash
Brute-force timing: time for token in {AAA,AAB,AAC...}; time curl -H "Auth: $token"
```
SHIP BLOCKERS: 2 Critical
1. Timing attack fix (regex to constant-time comparison)
2. Session recovery (add Redis layer)
Suggested: Test both fixes in staging, deploy with feature flagAbout this skill
name: named-persona-adversarial-review description: Use when Code review through the lens of real engineers' documented philosophies (Torvalds, Thompson, Carmack, Kent Beck, Jobs, Cagan).
Named Persona Adversarial Review
Code review through the lens of real engineers' documented philosophies (Torvalds, Thompson, Carmack, Kent Beck, Jobs, Cagan). Complements abstract-role adversarial review with named, sourced perspectives. Use when automated review findings feel generic, when a PR has architectural or UX impact, or when the author wants pre-submit hardening beyond standard checks.
What you get
- Public GitHub repo (alirezarezvani/claude-skills)
- the named-persona-adversarial-review skill folder with SKILL.md. Part of a 337-skill / 30-agent / 70-command install.
Customize your output
- Fork the repo and adapt the skill's instructions and references to your workflow.
Example output
Activates automatically when your request matches Named Persona Adversarial Review; chains with the other skills, agents, and commands in the collection.
Best for
Creators, builders, and teams using Claude Code.
SKILL.md preview
---
name: named-persona-adversarial-review
description: Use this skill when a code review needs pre-submit hardening beyond standard checks, especially for pull requests with architectural or UX impact.
version: 1.0.0
category: Development / Engineering
author: AgentVolt
license: proprietary
tags:
- development
- engineering
---
# Named Persona Adversarial Review
Reviews code through the lens of documented, real engineering philosophies rather than a single generic reviewer voice, surfacing objections a uniform checklist would miss.
## When to use
… (sign up to view the full skill)More development skills
View all Development skills →Generate
Scaffold code, tests, and boilerplate from a short spec.
Performance Profiler
Systematic performance profiling for Node.js, Python, and Go applications.
Threat Detection
Use when hunting for threats in an environment, analyzing IOCs, or detecting behavioral anomalies in telemetry.
Agent Harness
Turns a domain folder of skills into a bounded agentic loop: compile a goal into a task plan, execute with the domain's tools, verify every task, retry within a budget.