candid-review_skill

Overview

This skill runs a configurable, project-aware code review before commit or PR, combining Radical Candor principles (care personally, challenge directly) with concrete, actionable fixes. It reads project standards from Technical.md, inspects git changes (staged, unstaged, or branch diffs), and reports categorized issues with suggested fixes. It can track selected issues as TODOs and optionally apply and auto-commit fixes when enabled.

How this skill works

The skill detects changes by querying the git repo (staged → unstaged → branch diff against merge target branches) and loads merge target branches from CLI flags or config files with sensible fallbacks. It loads project standards from Technical.md if present, sets tone and commit behavior from CLI or configs, gathers architectural context by reading full files and recent history, then categorizes findings (Critical, Major, Standards, Code Smell, Edge Case, Architectural). For large or complex changes it can dispatch a subagent for parallel deep analysis and then merge results into a unified review. Selected fixes can be tracked as TODOs and, if auto-commit is enabled, committed with a standardized commit message and co-author tag.

When to use it

• Before creating a PR to catch production-critical issues early
• When you want reviews that follow project-specific Technical.md rules
• If you need a configurable tone (harsh or constructive) for feedback
• When you want automated application and tracking of straightforward fixes
• To compare current changes to previous reviews using re-review mode

Best practices

• Provide --merge-target flags or maintain .candid/config.json to ensure correct branch diffs
• Include a clear Technical.md at repo root to enable Standards checks
• Use --focus to limit review scope (security, performance, architecture, edge-case)
• Exclude generated or vendor files with --exclude patterns to reduce noise
• Run in dry mode first; enable --auto-commit only when fixes are well-understood

Example use cases

• Review a staged feature branch for null-safety and auth flaws before committing
• Run a security-focused pass (--focus security) to surface XSS/SQL injection risks
• Enforce project coding standards by flagging Technical.md violations as Standards
• Automatically fix low-risk linting and formatting issues and commit them
• Re-run review in --re-review mode to see unresolved issues vs. previous review