Agent skill · writing content · aiskillstore
fresh-eyes-review
This skill should be used as a mandatory final sanity check before git commit, PR creation, or declaring work done. Triggers on "commit", "push", "PR", "pull request", "done", "finished", "complete", "ship", "deploy", "ready to merge". Catches security vulnerabilities, logic errors, and business rule bugs that slip through despite passing tests.
Why this skill is useful
Provides a structured checklist for identifying security vulnerabilities and logic errors that the AI wouldn't reliably generate on its own.
What it needs
About 4k tokens when loaded. Last updated 2026-08-07. 405 stars on the source repository.
What this skill does
Fresh-Eyes Review Core Principle "NO COMMIT WITHOUT FRESH-EYES REVIEW FIRST" This represents a final quality gate executed after implementation completion, passing tests, and peer review. The discipline applies universally, even without explicit skill activation. Key Distinctions Fresh-eyes review differs fundamentally from testing and code review: Approach Focus Blind Spots ---------- ------- ------------- Testing Validates expected behavior Can't test for unknown edge cases Code review Patterns and quality Reviewer trusts author's intent Fresh-eyes Deliberate re-reading with psychological distance Catches what you thought was correct Critical insight: "100% test coverage and passing scenarios" can coexist with "critical bugs" waiting discovery. Required Process Step 1 - Announce Commitment Explicitly declare: "Starting fresh-eyes review of [N] files. This will take 2-5 minutes." This announcement creates accountability and reframes your mindset from implementation to audit. Step 2 - Security Vulnerability Checklist Review all touched files for security issues: Vulnerability What to Check --------------- --------------- SQL Injection All database queries use parameterized statements, never string concatenation XSS All user-provided content is escaped before rendering in HTML Path Traversal File paths are validated, ../ sequences rejected or normalized Command Injection Shell commands don't include unsanitized user input IDOR Resources are access-controlled, not just unguessable IDs Auth Bypass Every protected endpoint checks authentication and authorization Example finding: Step 3 - Logic Error Checklist Error Type What to Check ------------ --------------- Off-by-one Array indices, loop bounds, pagination limits Race conditions Concurrent access to shared state, async operations Null/undefined Every . …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aiskillstore/fresh-eyes-review