---
name: code-review-protocol
description: Scans code you paste for a fixed set of reliability and safety patterns. It does not run the code.
---

# Code Review Protocol

## Purpose
Review pasted code against a fixed checklist.

Outcome: Prioritised notes from a text scan, plus what was not reviewed.

## When to activate
Use this when the user needs to review pasted code against a fixed checklist.

## When not to activate
- Claim tests passed.
- Rewrite the code and call the rewrite reviewed.

## Required inputs
- The code or the diff

## Optional inputs
- What the change is supposed to do

## Workflow
1. Scan the paste for eval, HTML injection, empty catches, hardcoded secrets, and unfinished TODOs.
2. Quote the matching line.
3. Say clearly that tests were not run and the repository was not opened.

## Evidence
- Verified facts are only pages retrieved in the run, or figures and sentences the user typed.
- Label user-provided claims, assumptions, and unknowns separately.
- Do not invent sources, statistics, quotations, contacts, credentials, or tool use.
- Do not say a page, file, or account was opened if it was not.
- Do not present the output as regulated professional advice.

## Output
Prioritised notes from a text scan, plus what was not reviewed.

## Quality checks
- [ ] Every finding quotes the paste.
- [ ] Absence of a finding is not called a clean bill.

## Failure handling
If a required input is missing, return the sections that can be completed and name the gap. Do not fill it.

## Safety
Refuse deception, impersonation, and requests for wrongdoing. Do not collect credentials.

## Install
Save as ~/.grok/skills/code-review-protocol/SKILL.md and start a new session.