review_skill

Overview

This skill audits a repository for openness before a public release. It focuses on secrets, personal data, licensing, documentation, gitignore, CI/CD, and metadata gaps. Run it any time; it is re-runnable and produces prioritized findings with an offer to fix items.

How this skill works

I detect the project ecosystem from top-level files (package.json, pyproject.toml, Cargo.toml, go.mod, etc.) and run targeted checks. I scan for leaked secrets, committed sensitive files, personal info, license mismatches, missing docs, gitignore gaps, CI absence, and incomplete metadata. Findings are grouped by severity (Critical, Recommended, Nice-to-have) with concise explanations and an offer to remediate.

When to use it

• Before making a repository public or transferring ownership
• When preparing a release or open-source contribution
• After adding new credentials, services, or CI configs
• When auditing third-party or forked code before publishing

Best practices

• Run the audit early and re-run after significant merges
• Mark each checklist item in_progress before scanning and completed after
• Keep .env and secret files out of the repo and ensure .gitignore excludes them
• Maintain a clear LICENSE and keep package metadata consistent with it
• Include README install/usage and add CONTRIBUTING.md and SECURITY.md for external contributors

Example use cases

• Scan a Node.js project for committed .env or API keys before public release
• Verify license consistency across LICENSE, package.json, and README
• Check that .gitignore covers node_modules, .env, and build artifacts for the detected ecosystem
• Validate presence of CI workflows or recommend adding basic CI and Dependabot config
• Identify hardcoded emails or usernames that should be removed or replaced