Pre-Merge Bug and Risk Review
Get severity-ranked bugs with trigger paths, regression tests, and a scoped merge verdict for your diff or pull request.
Before & after
Same prompt, same agent — the only difference is the skill.
I'd be happy to review your PR. A good code review typically checks: - Correctness: does the logic do what it should - Edge cases: are they handled - Readability: is the code clear - Style: does it match conventions - Tests: is there adequate coverage - Security: any vulnerabilities Share the diff and I'll give you specific feedback. Generally it helps to review in passes — correctness first, then style, then nitpicks. What does the PR change?
Structured review pass — findings grouped by what they'd actually do to
you, most severe first. Coverage over politeness: I report it, you
decide.
CORRECTNESS (blocks merge)
▸ src/api.ts:44 — the error path returns undefined, and the caller at
:81 does .length on it. Null-input crash. This is the merge-blocker.
▸ src/parse.ts:23 — off-by-one: loop runs to <= length, reads one past
the array. Silent on happy path, wrong on the boundary.
RISK FLAGS (should-fix before merge)
▸ auth/token.ts:12 — token compared with ===, not a constant-time
compare. Timing-attack surface on an auth path.
▸ No test covers the error branch above — which is exactly why it
shipped.
STYLE / CONSISTENCY (non-blocking)
▸ Mixed async styles in one file (.then and await). Pick one.
▸ src/util.ts:30 — magic number 86400, name it SECONDS_PER_DAY.
WHAT'S GOOD
The refactor consolidates three duplicated fetch calls into one — right
call, and it makes the correctness fix above a one-line change instead
of three.
VERDICT
Block on the two correctness items. The security and test gaps I'd fix
in the same PR since the files are already open; style can follow.
Paste the diff and I'll run the real pass line by line.About this skill
“The tests pass, but what did this change break?” This review traces a diff through its callers, state changes, and failure paths, then turns supported defects into findings a developer can act on. Correctness and data risks lead; convention notes stay separate.
What it does
- Compares changed behavior with the baseline to distinguish new regressions from existing problems.
- Traces inputs, permissions, state transitions, side effects, and returned results across relevant code.
- Checks failure paths such as retries, partial writes, malformed input, and concurrent requests when the change makes them relevant.
- Gives each bug a precise location, triggering condition, consequence, and targeted regression case.
- Separates merge blockers, nonblocking defects, optional style notes, and unresolved verification gaps.
- Produces a merge verdict bounded by the code and checks actually reviewed.
What you get
A concise review with severity-ranked findings, supporting evidence, suggested fix direction, and a scoped merge verdict. Small requests receive a focused answer; larger diffs receive a coverage summary and prioritized follow-up checks.
Best for
Developers and maintainers reviewing a diff, pull request, or combined set of commits before merge, especially when passing tests leave uncertainty about behavior outside the happy path.
SKILL.md preview
---
name: pre-merge-bug-and-risk-review
description: Reviews a diff or pull request for correctness, convention drift, and merge risk by tracing changed behavior, comparing the baseline, and attaching trigger paths and regression cases to supported findings. Use when the user says "review this PR", "check this diff before merge", "find bugs in these commits", "the tests pass but something feels wrong", "my endpoint keeps failing on retries", "does this change break existing callers", or "check correctness and style".
---
# Pre-Merge Bug and Risk Review
… (sign up to view the full skill)More development skills
View all Development skills →Performance Bottleneck Profiling: Node, Python, Go
Classifies a slowdown, gives exact profiler commands, reads the output, and proves the fix with same-conditions p95/p99 numbers.
Feature Scaffolding with Working Tests
Turn a short feature spec into code, runnable tests, and integration wiring that match your existing project.
Feature Flag Rollouts and Kill Switches
Design staged flag rollouts, verify rollback paths, and audit flag debt with explicit defaults, gates, and retirement plans.
Microcontroller Firmware and RTOS Engineering
Build and debug MCU firmware with bounded ISR/RTOS timing, safe DMA ownership, and measured power budgets.