New to Claude Skills? Learn how to install them →

bmad-code-org on GitHub

Adversarial Code Review

Free

Enhance code quality through structured adversarial review.

Get this skill

Free · Opens the source repo

What Adversarial Code Review does

The Adversarial Code Review skill provides a structured approach to reviewing code changes, focusing on identifying potential issues through a systematic and adversarial lens. This skill is designed for developers who want to ensure the robustness of their code by using a workflow that emphasizes thoroughness and critical examination. It guides users through a series of steps that facilitate a comprehensive review process, leveraging subagents when available to enhance the workflow.

The skill operates by executing a well-defined sequence of steps, starting with the gathering of context and moving through various stages of review and triage. Each step is encapsulated in its own file, ensuring that the process is disciplined and easy to follow. The workflow is designed to minimize noise and filler, allowing reviewers to focus on the critical aspects of the code being examined. The use of persistent facts and configuration loading ensures that the review is contextualized and tailored to the specific project and team needs.

This skill is particularly useful in collaborative environments where code changes are frequent and require careful scrutiny. By following the structured steps, developers can systematically address potential vulnerabilities and gaps in verification, ultimately leading to higher quality code and fewer issues in production. The adversarial approach encourages a mindset of critical thinking and thoroughness, making it suitable for teams that prioritize code quality and security.

While the skill is powerful in enhancing code review processes, it requires adherence to its structured workflow. Users must be prepared to engage with the step-by-step instructions and provide necessary inputs at checkpoints. This makes it less suitable for quick, informal reviews where speed is prioritized over thoroughness.

When to use it

Use this skill when you need a rigorous, step-by-step process for reviewing code changes, especially in collaborative projects.

When not to use it

Avoid this skill for quick, informal code reviews where a less structured approach may be more efficient.

What you can build with it

Collaborative Code Review

When working in a team, use this skill to ensure that all code changes are rigorously reviewed and vetted for quality.

Security Audits

Utilize the adversarial approach to identify potential vulnerabilities in code during security audits.

Code Quality Assurance

Implement this skill in your development process to maintain high standards of code quality and reliability.

How to install Adversarial Code Review

View source

1. Install with the skills CLI

npx skills add bmad-code-org/bmad-method/bmad-code-review --agent claude-code

2. Or install it manually

Download the skill folder and drop it into ~/.claude/skills/ for all projects, or .claude/skills/ to scope it to one repo. Restart Claude Code so it picks up the new skill.

Anthropic's agentic coding CLI, and the reference implementation of Agent Skills. Drop a skill folder into ~/.claude/skills and Claude Code loads it automatically whenever a task matches the skill's description. Claude Code docs

Inside SKILL.md

Written by bmad-code-org

Code Review Workflow

Goal: Review code changes adversarially. No noise, no filler.

Subagents, when the capability is available, are an important part of this workflow. Use them as directed by the workflow steps. If you need an explicit user instruction to run them, ask once now for the whole workflow run.

Conventions

  • Bare paths (e.g. checklist.md) resolve from the skill root.
  • {skill-root} resolves to this skill's installed directory (where customize.toml lives).
  • {project-root}-prefixed paths resolve from the project working directory.
  • {skill-name} resolves to the skill directory's basename.

On Activation

Step 1: Resolve the Workflow Block

Run: uv run {project-root}/_bmad/scripts/resolve_customization.py --skill {skill-root} --key workflow

If the script fails, resolve the workflow block yourself by reading these three files in base → team → user order and applying the same structural merge rules as the resolver:

  1. {skill-root}/customize.toml — defaults
  2. {project-root}/_bmad/custom/{skill-name}.toml — team overrides
  3. {project-root}/_bmad/custom/{skill-name}.user.toml — personal overrides

Any missing file is skipped. Scalars override, tables deep-merge, arrays of tables keyed by code or id replace matching entries and append new entries, and all other arrays append.

Step 2: Execute Prepend Steps

Execute each entry in {workflow.activation_steps_prepend} in order before proceeding.

Step 3: Load Persistent Facts

Treat every entry in {workflow.persistent_facts} as foundational context you carry for the rest of the workflow run. Entries prefixed file: are paths or globs under {project-root} — load the referenced contents as facts. All other entries are facts verbatim.

Step 4: Load Config

Load config from {project-root}/_bmad/bmm/config.yaml and resolve:

  • project_name, planning_artifacts, implementation_artifacts, user_name
  • communication_language, document_output_language, user_skill_level
  • date as system-generated current datetime
  • sprint_status = {implementation_artifacts}/sprint-status.yaml
  • project_context = **/project-context.md (load if exists)
  • YOU MUST ALWAYS SPEAK OUTPUT in your Agent communication style with the config {communication_language}

Step 5: Greet the User

Greet {user_name}, speaking in {communication_language}.

Step 6: Execute Append Steps

Execute each entry in {workflow.activation_steps_append} in order.

Activation is complete. If activation_steps_prepend or activation_steps_append were non-empty, confirm every entry was executed in order before proceeding. Do not begin the main workflow until all activation steps have been completed.

WORKFLOW ARCHITECTURE

This uses step-file architecture for disciplined execution:

  • Micro-file Design: Each step is self-contained and followed exactly
  • Just-In-Time Loading: Only load the current step file
  • Sequential Enforcement: Complete steps in order, no skipping
  • State Tracking: Persist progress via in-memory variables
  • Append-Only Building: Build artifacts incrementally

Step Processing Rules

  1. READ COMPLETELY: Read the entire step file before acting
  2. FOLLOW SEQUENCE: Execute sections in order
  3. WAIT FOR INPUT: Halt at checkpoints and wait for human
  4. LOAD NEXT: When directed, read fully and follow the next step file

Critical Rules (NO EXCEPTIONS)

  • NEVER load multiple step files simultaneously
  • ALWAYS read entire step file before execution
  • NEVER skip steps or optimize the sequence
  • ALWAYS follow the exact instructions in the step file
  • ALWAYS halt at checkpoints and wait for human input

FIRST STEP

Read fully and follow: ./steps/step-01-gather-context.md

Frequently asked questions about Adversarial Code Review

Similar skills