From rails-agent-skills
Orchestrates multi-pass Rails PR reviews identifying bugs, security vulnerabilities, and architecture issues; assigns severity levels (Critical/Suggestion/Nice-to-have); generates actionable comments with re-review loop for Critical findings.
npx claudepluginhub igmarin/rails-agent-skills --plugin rails-agent-skillsThis skill uses the workspace's default tool permissions.
Orchestrates systematic code review with optional deep dives for security/architecture and response handling.
Reviews Rails pull requests for controller/model conventions, migration safety, query performance, and Rails Way compliance. Covers routing, ActiveRecord, security, caching, and background jobs.
Reviews Rails code changes: strict for modifications to existing code, pragmatic for new isolated code. Flags regressions, convention violations, and provides actionable feedback with approval status.
Analyzes code diffs/files for bugs, security vulnerabilities (SQLi, XSS, insecure deserialization), code smells, N+1 queries, naming issues, architecture; outputs prioritized review reports for PRs, audits, refactoring.
Share bugs, ideas, or general feedback.
Orchestrates systematic code review with optional deep dives for security/architecture and response handling.
Load primary review skill:
Concrete checklist per changed file:
before_action callbacks match route constraints and cover all sensitive actions.save, .update, .destroy call has error handling or a ! bang with rescuepermit!where/find calls inside loops (N+1 risk) and flag for extractionauthorize (or equivalent policy check) is called before rendering any resourcedependent: options to prevent orphaned recordsbefore_save, after_create, etc.) for side-effects that cross domain boundariesOutput format per file: [CRITICAL|SUGGESTION|NICE-TO-HAVE] <file>:<line> — <finding>
Example Critical finding comment:
[CRITICAL] app/controllers/orders_controller.rb:42 — Missing authorisation check;
any authenticated user can access another user's order. Add `authorize @order`
before rendering.
Example Suggestion comment:
[SUGGESTION] app/models/order.rb:17 — `Order.where(user: current_user)` called
inside a loop; extract to a scoped query to avoid N+1.
Decision Gate — Security Check:
Branch A — Security Review (if triggered):
Decision Gate — Architecture Check:
Branch B — Architecture Review (if triggered):
Decision Gate — Findings Assessment:
| Finding Level | Action |
|---|---|
| None/minor | Proceed to merge |
| Critical | Must fix before merge |
| Suggestion | Fix in this PR or ticket separately |
If Critical findings:
Proceed-to-merge summary format:
## Review Complete — Approved for Merge
- Critical findings: 0 remaining
- Suggestions addressed: <n> fixed, <n> ticketed as <TICKET-IDs>
- Files reviewed: <list>
- Re-review cycles: <n>
If Suggestions only:
| Level | Definition | Action Required |
|---|---|---|
| Critical | Security vulnerability, data loss, production risk | Fix before merge |
| Suggestion | Improvement opportunity, tech debt | Fix now or ticket |
| Nice to have | Optional enhancement | Does not block |