pos-ai: Skill for Claude Code

Parallel Review

Run three independent review agents simultaneously, then synthesize a unified report. This implements the parallel workflow pattern — each agent specializes in one review domain, and their findings are merged into a severity-ranked report.

Setup

Before starting: identify the project context, read status.yaml, run git status and git diff --stat to understand what changed.

Process

Step 1: Identify Scope

Determine the review target:

• If recent changes: git diff --name-only or git diff HEAD~1 --name-only
• If specific files: use the file list provided by the user
• If full project: scan src/ or equivalent source directory

Capture the file list and diff summary — you'll pass this to all three agents.

Step 2: Launch Three Review Agents in Parallel

Spawn exactly 3 Agent calls in a single message (parallel execution). Each agent gets the same file list but different review focus.

Agent 1 — Code Quality Review:

Review these files for code quality:
{file list and diff}

Check for:
- Functions longer than 30 lines
- Duplicated logic (more than 2 occurrences)
- TypeScript `any` types
- Missing error handling on async operations
- N+1 query patterns or SELECT *
- Naming convention violations
- Single responsibility violations
- Dead code or unused imports

For each finding, report: severity (critical/warning/suggestion), file:line, description, and recommended fix.

Agent 2 — Security Audit:

Review these files for security vulnerabilities:
{file list and diff}

Check OWASP Top 10:
- Hardcoded secrets or credentials
- SQL injection (raw queries, string interpolation in SQL)
- XSS (innerHTML, v-html, dangerouslySetInnerHTML)
- Command injection (exec, system, shell_exec)
- Broken access control (missing auth checks)
- Insecure dependencies (check package.json/composer.json)
- SSRF risks (unvalidated URLs)
- Missing input validation at system boundaries

For each finding, report: severity (critical/high/medium/low), file:line, OWASP category, description, and fix.