cr

Review Working Tree

Overview

Perform a static review of every staged, unstaged, and untracked change without changing repository state or executing project code. A request for quick approval may shorten prose, never the review.

Read-Only Contract

Start with status, before reading any diff:

git status --short

Classify paths before content inspection. Treat these as sensitive from the path alone:

• .env and .env.*;
• *.pem, *.key, *.p12, *.pfx, id_rsa, and id_ed25519;
• names containing credential, secret, or token.

Mark every such path Critical without reading its contents. Never open, hash, grep, print, or include it in a content diff. Reference it as path:1 and state that the location is path-based. Redact values.

Run both diffs only after excluding every sensitive path:

git diff -- . ':(exclude)<sensitive-path>'
git diff --cached -- . ':(exclude)<sensitive-path>'

Repeat the exclusion pathspec for each sensitive path; with none, run plain git diff and git diff --cached. Inspect only non-sensitive untracked files. For other potentially sensitive configuration, default to metadata/path-only review. Inspect targeted content only when the method guarantees output contains field names and line numbers but no values.

Never call apply_patch; never edit, create, delete, format, stage, commit, or mutate files or Git state.

This Skill is static review only. Do not execute project code, tests, builds, scripts, Git hooks, package managers, generators, or commands with possible writes, network access, or external side effects in the current checkout. Dynamic verification requires separate user authorization and an isolated copy or sandbox outside /cr; report it as not run.

Review Dimensions

Review each changed file and its relevant callers/tests:

Dimension	Check
Correctness	Logic, boundary conditions, nil/type errors, error handling
Security	SQL/XSS/command injection, unsafe defaults, secret exposure
Maintainability	Responsibilities, naming, duplication, needless complexity
Performance	N+1 work, unnecessary loops or large copies
Test coverage	Critical paths, failure cases, regression risk
Dependency safety	Necessity, provenance, and locked versions