Adversarial Code Review

VerifiedCaution

Review code changes adversarially using parallel review layers and structured triage for actionable results.

Sby Skills Guide Bot
DevelopmentAdvanced
7/22/2026
Claude CodeCursor
#code-review#adversarial-review#parallel-subagents#triage#bmad

Recommended for

Automated summary

This skill runs an adversarial code review by launching several parallel review layers (Blind Hunter, Edge Case Hunter, Acceptance Auditor) and then triaging the findings into actionable categories.

Strengths

  • Three complementary review layers (blind, edge-case, acceptance) run in parallel to cover more blind spots
  • Structured triage turns raw findings into actionable categories instead of a noisy list
  • Layered customization (base → team → user) through customize.toml and a resolver script
  • Step-file architecture with explicit checkpoints and just-in-time loading of each step

Limitations

  • Expects a project already scaffolded with _bmad, resolve_customization.py, and bmm/config.yaml
  • The parallel layers depend on subagent support; without it the review is degraded
  • Activation is ceremonious (resolver, persistent facts, config, greeting) before review even starts
When to use it

Use it when a set of changes needs a rigorous pass before merging and you want triaged findings rather than a casual opinion.

When not to use it

Avoid it on a repo without the _bmad scaffolding and config files, or for a quick read of a single small file.

Security analysis

Caution
Quality score86/100

No destructive, exfiltration, or obfuscated behavior is present. The skill is a legitimate code-review orchestration workflow, but it executes a project-local Python resolver and follows customization/activation configuration that could influence behavior, so it warrants caution rather than outright safe.

Findings
  • •Instructs execution of a project-local Python script at `{project-root}/_bmad/scripts/resolve_customization.py` without checking its contents or integrity.
  • •Loads and follows project/team/user customization TOML files, including `activation_steps_prepend`, `activation_steps_append`, and `persistent_facts`, which could contain arbitrary instructions or file references.
  • •Uses subagents and asks for blanket permission to run them for the workflow, increasing scope of autonomous behavior.
How this analysis is made

Examples

Full review run
run code review on the changes in this branch
Review a diff
review this code — I just refactored the payment module, check it adversarially
Pre-merge check
Run the code review workflow on my uncommitted changes and triage anything that would block the merge

name: bmad-code-review description: 'Review code changes adversarially using parallel review layers (Blind Hunter, Edge Case Hunter, Acceptance Auditor) with structured triage into actionable categories. Use when the user says "run code review" or "review this code"'

Code Review Workflow

Goal: Review code changes adversarially using parallel review layers and structured triage.

Your Role: You are an elite code reviewer. You gather context, launch parallel adversarial reviews, triage findings with precision, and present actionable results. No noise, no filler.

Subagents, when the capability is available, are an important part of this workflow. Use them as directed by the workflow steps. If you need an explicit user instruction to run them, ask once now for the whole workflow run.

Conventions

  • Bare paths (e.g. checklist.md) resolve from the skill root.
  • {skill-root} resolves to this skill's installed directory (where customize.toml lives).
  • {project-root}-prefixed paths resolve from the project working directory.
  • {skill-name} resolves to the skill directory's basename.

On Activation

Step 1: Resolve the Workflow Block

Run: python3 {project-root}/_bmad/scripts/resolve_customization.py --skill {skill-root} --key workflow

If the script fails, resolve the workflow block yourself by reading these three files in base → team → user order and applying the same structural merge rules as the resolver:

  1. {skill-root}/customize.toml — defaults
  2. {project-root}/_bmad/custom/{skill-name}.toml — team overrides
  3. {project-root}/_bmad/custom/{skill-name}.user.toml — personal overrides

Any missing file is skipped. Scalars override, tables deep-merge, arrays of tables keyed by code or id replace matching entries and append new entries, and all other arrays append.

Step 2: Execute Prepend Steps

Execute each entry in {workflow.activation_steps_prepend} in order before proceeding.

Step 3: Load Persistent Facts

Treat every entry in {workflow.persistent_facts} as foundational context you carry for the rest of the workflow run. Entries prefixed file: are paths or globs under {project-root} — load the referenced contents as facts. All other entries are facts verbatim.

Step 4: Load Config

Load config from {project-root}/_bmad/bmm/config.yaml and resolve:

  • project_name, planning_artifacts, implementation_artifacts, user_name
  • communication_language, document_output_language, user_skill_level
  • date as system-generated current datetime
  • sprint_status = {implementation_artifacts}/sprint-status.yaml
  • project_context = **/project-context.md (load if exists)
  • CLAUDE.md / memory files (load if exist)
  • YOU MUST ALWAYS SPEAK OUTPUT in your Agent communication style with the config {communication_language}

Step 5: Greet the User

Greet {user_name}, speaking in {communication_language}.

Step 6: Execute Append Steps

Execute each entry in {workflow.activation_steps_append} in order.

Activation is complete. If activation_steps_prepend or activation_steps_append were non-empty, confirm every entry was executed in order before proceeding. Do not begin the main workflow until all activation steps have been completed.

WORKFLOW ARCHITECTURE

This uses step-file architecture for disciplined execution:

  • Micro-file Design: Each step is self-contained and followed exactly
  • Just-In-Time Loading: Only load the current step file
  • Sequential Enforcement: Complete steps in order, no skipping
  • State Tracking: Persist progress via in-memory variables
  • Append-Only Building: Build artifacts incrementally

Step Processing Rules

  1. READ COMPLETELY: Read the entire step file before acting
  2. FOLLOW SEQUENCE: Execute sections in order
  3. WAIT FOR INPUT: Halt at checkpoints and wait for human
  4. LOAD NEXT: When directed, read fully and follow the next step file

Critical Rules (NO EXCEPTIONS)

  • NEVER load multiple step files simultaneously
  • ALWAYS read entire step file before execution
  • NEVER skip steps or optimize the sequence
  • ALWAYS follow the exact instructions in the step file
  • ALWAYS halt at checkpoints and wait for human input

FIRST STEP

Read fully and follow: ./steps/step-01-gather-context.md

From the file to a first result

The download contains exactly the content displayed on this page. This copy may differ from the latest version in the source repository.

View the source and supporting files

This download contains SKILL.md only. Any scripts, references, templates and dependencies are not included. Get the required files from the source, preserving their directory structure, before continuing.

1. Download the file

Download SKILL.md

From the root of a test project, save the file as .skill-downloads/adversarial-code-review-mrwakeum/SKILL.md, or use the command below. This folder is for inspecting the skill before installation.

Command for macOS/Linux or WSL: requires a POSIX shell and curl. On Windows without WSL, use the download button and create the folder manually.

mkdir -p '.skill-downloads/adversarial-code-review-mrwakeum' && curl --fail --show-error --location 'https://skills-guides.com/api/skills/adversarial-code-review-mrwakeum/download' --output '.skill-downloads/adversarial-code-review-mrwakeum/SKILL.md.part' && mv '.skill-downloads/adversarial-code-review-mrwakeum/SKILL.md.part' '.skill-downloads/adversarial-code-review-mrwakeum/SKILL.md'

2. Check prerequisites

Read SKILL.md before using it. If it references scripts or external services, inspect them and prepare the required access in your test environment.

No recognized prerequisites section in this file. This does not mean it is self-contained: libraries, tools and access requirements may be mentioned elsewhere in the content or source repository.

The platforms on this page are catalog indications. The paths below follow tool documentation; they do not prove this skill has been run in those tools. No minimum tool version is confirmed for this listing.

3. Load the skill

After inspection, copy the complete folder into your project using one of the commands below, then open a new tool session. The command stops if a folder with the same name already exists: compare the files before replacing it.

Claude Code
test -f '.skill-downloads/adversarial-code-review-mrwakeum/SKILL.md' && test -s '.skill-downloads/adversarial-code-review-mrwakeum/SKILL.md' && mkdir -p '.claude/skills' && test ! -e '.claude/skills/bmad-code-review' && cp -R '.skill-downloads/adversarial-code-review-mrwakeum' '.claude/skills/bmad-code-review'

Cursor
test -f '.skill-downloads/adversarial-code-review-mrwakeum/SKILL.md' && test -s '.skill-downloads/adversarial-code-review-mrwakeum/SKILL.md' && mkdir -p '.cursor/skills' && test ! -e '.cursor/skills/bmad-code-review' && cp -R '.skill-downloads/adversarial-code-review-mrwakeum' '.cursor/skills/bmad-code-review'

OpenSkills

OpenSkills must already be installed. The local install/read procedure is checked with OpenSkills 1.5.0, which requires Node.js ≥ 20.6.0. Catalog slugs are not resolved automatically.

Official OpenSkills installation
openskills install './.skill-downloads/adversarial-code-review-mrwakeum'

openskills read 'adversarial-code-review-mrwakeum'

Reading should display the installed file content and its base directory. It does not run the skill or install its dependencies.

For an agent that reads AGENTS.md, then sync the index. This command changes AGENTS.md: review the diff before using it.

openskills sync

Manual method or another tool: attach SKILL.md to a conversation, or open it in an agent that can read files. Include any required supporting resources. No universal folder is recognized by every tool.

4. Try a first task

Use a short, synthetic input: an API endpoint, a small document or an interface brief. In a new conversation, attach the file or give the agent its path, then adapt this request:

Read .skill-downloads/adversarial-code-review-mrwakeum/SKILL.md and apply its instructions to this example: [describe a test input]. Identify any missing files, dependencies or access. Produce the result requested by the skill without inventing data or running unreviewed scripts.

Expected result: output matching the skill instructions, or a precise list of missing prerequisites. A read confirmation alone does not validate a first use. If an external resource is unavailable, that path remains untested.

Related skills