Vibe Coder: Code Review Skill (On-Call, Security, Deployability)

A code review checklist + structured prompt that forces a review to be:

• operationally realistic (on-call mindset),
• security-aware (trust boundaries + data flow),
• test-driven (prove promises),
• deployable (observe + rollback).

Links

• Article: (https://www.theneuron.ai/explainer-articles/10-vibe-coding-questions-beginners-dont-know-to-ask-but-should/)
• Repo: (https://github.com/cnoles1980/Vibe-Coder-Code-Review/)

What this produces

Given a diff/PR description and minimal context, the reviewer outputs a structured review that answers:

1. Explain the diff like I’m the on-call engineer.
2. Assumptions (tested vs untested).
3. Trust boundaries + threat model.
4. Endpoints/jobs/handlers + authn/authz coverage.
5. Untrusted input → sensitive sinks tracing.
6. Sensitive data inventory + where it goes (incl. logs).
7. Failure behavior (timeouts, retries, idempotency, degradation).
8. Tests that prove core promises (happy + edges + “evil input”).
9. Maintainability debt (duplication, deps, style drift).
10. Safe deploy/observe/rollback plan.

How to use

Option A: Use the YAML skill file

Open skill.yaml, paste it into your tool’s skill registry, and call it with:

• PR title/description
• diff (or link + pasted snippets)
• relevant code pointers (routes, handlers, jobs, config)
• runtime context (cloud, DB, queues, auth provider, etc.)

Option B: Copy/paste the prompt

Use prompt.md as your review prompt. Paste in the diff and context.

License

MIT