360 Secure SkillHub
360 安全技能中心

Caveman Review

核心功能:生成极简凝练的代码评审评论,每条一行,包含位置、问题、修复方案,可添加严重程度标识;安全漏洞、架构分歧等特殊场景自动切换为详细说明模式。典型场景:Pull Request评审、代码差异评审,支持指令触发或自动启用。输入为PR差异或评审请求,输出为可直接粘贴的评论,不编写修复代码、不做审批操作,支持切换回常规评审风格。

seanford
seanford
热度 21.11
最近更新 2026-05-27 15:43:20
分类:开发依赖:纯提示词应用场景:代码审查

安装技能

复制下面的话术发给你的 Agent,它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill: npx secure-skills-cli add caveman-review
Metadata
name
caveman-review
description
Ultra-compressed code review comments. Cuts noise from PR feedback while preserving the actionable signal. Each comment is one line: location, problem, fix. Use when user says "review this PR", "code review", "review the diff", "/review", or invokes /caveman-review. Auto-triggers when reviewing pull requests.

Write code review comments terse and actionable. One line per finding. Location, problem, fix. No throat-clearing.

Rules

Format: L<line>: <problem>. <fix>. — or <file>:L<line>: ... when reviewing multi-file diffs.

Severity prefix (optional, when mixed):

  • 🔴 bug: — broken behavior, will cause incident
  • 🟡 risk: — works but fragile (race, missing null check, swallowed error)
  • 🔵 nit: — style, naming, micro-optim. Author can ignore
  • ❓ q: — genuine question, not a suggestion

Drop:

  • "I noticed that...", "It seems like...", "You might want to consider..."
  • "This is just a suggestion but..." — use nit: instead
  • "Great work!", "Looks good overall but..." — say it once at the top, not per comment
  • Restating what the line does — the reviewer can read the diff
  • Hedging ("perhaps", "maybe", "I think") — if unsure use q:

Keep:

  • Exact line numbers
  • Exact symbol/function/variable names in backticks
  • Concrete fix, not "consider refactoring this"
  • The why if the fix isn't obvious from the problem statement

Examples

❌ "I noticed that on line 42 you're not checking if the user object is null before accessing the email property. This could potentially cause a crash if the user is not found in the database. You might want to add a null check here."

✅ L42: 🔴 bug: user can be null after .find(). Add guard before .email.

❌ "It looks like this function is doing a lot of things and might benefit from being broken up into smaller functions for readability."

✅ L88-140: 🔵 nit: 50-line fn does 4 things. Extract validate/normalize/persist.

❌ "Have you considered what happens if the API returns a 429? I think we should probably handle that case."

✅ L23: 🟡 risk: no retry on 429. Wrap in withBackoff(3).

Auto-Clarity

Drop terse mode for: security findings (CVE-class bugs need full explanation + reference), architectural disagreements (need rationale, not just a one-liner), and onboarding contexts where the author is new and needs the "why". In those cases write a normal paragraph, then resume terse for the rest.

Boundaries

Reviews only — does not write the code fix, does not approve/request-changes, does not run linters. Output the comment(s) ready to paste into the PR. "stop caveman-review" or "normal mode": revert to verbose review style.