- Home
- Skills
- Code Quality & Review
- Repo Review Pro - severity-rated audit of any public repo
Works with the AI tools you already use
Repo Review Pro - severity-rated audit of any public repo
Outputs an action-ready review package with fix priorities, not a wall of prose.
$5
Repo Review Pro - severity-rated audit of any public repo
Example session with this skill installed
Run a Code Review on the repo 'acme/solana-pay-kit'. Focus on security and auth logic. I've approved a budget of $0.15.
- Read your context and instructions
- Compiled the repo review pro
- Generated the document
I have completed the review for acme/solana-pay-kit. Total API spend was $0.115. The health check indicates a stable repo with a recent commit lag, and the code review identified 1 critical security flaw in the webhook handling.
review_acme-solana-pay-kit_2024-05-20
Verdict
ADOPT-WITH-FIXES. The core logic is sound and follows Solana best practices, but a critical vulnerability in signature verification must be patched before production use.
Findings Grouped by File
| Severity | Location | Finding | Fix |
|---|---|---|---|
| CRITICAL | src/webhook.ts:42 | Webhook signature is not verified before processing payment events. | Implement nacl.sign.detached.verify using the merchant public key. |
| WARNING | src/transaction.ts:108 | Hardcoded transaction timeout of 60s may cause drops during congestion. | Move timeout to a configurable environment variable. |
| SUGGESTION | src/index.ts:12 | Missing JSDoc for main entry point exports. | Add documentation for the public API surface. |
Top 3 Priority Fixes
- Verify Webhook Signatures: Immediate risk of spoofed payment notifications.
- Externalize Timeouts: Improve reliability for mainnet network spikes.
- Update Dependencies:
solana/web3.jsis two minor versions behind.
What is Genuinely Good
- Clean Abstractions: The transaction building logic is highly modular.
- Excellent Examples: The
/examplesfolder provides clear, working starter code. - Modern Tooling: Uses TypeScript 5.x and Vitest for a clean development experience.
Next steps
- Review the full
01_findings.mdfor style and maintainability suggestions. - I can perform a side-by-side comparison with the
solana-labs/payrepository. - Would you like me to draft the fix for the webhook signature verification?
Static review of publicly visible files fetched on 2024-05-20. Not a substitute for running the test suite, CI, or a full manual audit.
repo-review-pro-severity-rated-audit-of-.pdf
PDF · document
Example file from a real run - the skill writes it into your workspace.
Connects securely to your tools. The creator never sees your data.
What you get
About this skill
Audit any public GitHub repository like a senior reviewer — repo health metrics (stars/forks/issues/activity, ~$0.005), targeted fetch of key files (~$0.005 each), and a structured Opus-class code review (~$0.08) with findings grouped BY FILE and severity-rated (critical / warning / suggestion) exactly as engineering teams expect. Outputs an action-ready review package with fix priorities, not a wall of prose. Use for due-diligence on a dependency, reviewing a contractor's repo, prepping an OSS contribution, or a second opinion on your own project. Total API cost is always estimated and confirmed BEFORE any paid call (typically $0.10–0.20).
How to install
Works the same in every agent - Claude, Cursor, Codex, Copilot and 20+ more.
- 1
Download the ZIP
Free skills download straight away. Paid skills unlock right after purchase.
- 2
Unzip into your skills folder
Every agent reads skills from one folder on your machine. Drop the unzipped folder in there.
- 3
Ask your agent to use it
Restart the agent if it was already running. It picks the skill up automatically - no config needed.
Skills folder by agent
Click the path to copy it. Create the folder if it does not exist yet.
Reviews
No reviews yet
Be one of the first to try it. Every listed skill passes our trust checks below.
Security scanned
Passed our 8-point scan before listing
Fresh listing
Recently published to Agensi
30-day refund
Not a fit? Get your money back
Trust & safety
Security scanned
Verified clean 1 month ago
- Passed all security checks, Safe to install