
Adversarial Code Review
FreeEnhance code quality through structured adversarial review.
Free · Opens the source repo
What Adversarial Code Review does
The Adversarial Code Review skill provides a structured approach to reviewing code changes, focusing on identifying potential issues through a systematic and adversarial lens. This skill is designed for developers who want to ensure the robustness of their code by using a workflow that emphasizes thoroughness and critical examination. It guides users through a series of steps that facilitate a comprehensive review process, leveraging subagents when available to enhance the workflow.
The skill operates by executing a well-defined sequence of steps, starting with the gathering of context and moving through various stages of review and triage. Each step is encapsulated in its own file, ensuring that the process is disciplined and easy to follow. The workflow is designed to minimize noise and filler, allowing reviewers to focus on the critical aspects of the code being examined. The use of persistent facts and configuration loading ensures that the review is contextualized and tailored to the specific project and team needs.
This skill is particularly useful in collaborative environments where code changes are frequent and require careful scrutiny. By following the structured steps, developers can systematically address potential vulnerabilities and gaps in verification, ultimately leading to higher quality code and fewer issues in production. The adversarial approach encourages a mindset of critical thinking and thoroughness, making it suitable for teams that prioritize code quality and security.
While the skill is powerful in enhancing code review processes, it requires adherence to its structured workflow. Users must be prepared to engage with the step-by-step instructions and provide necessary inputs at checkpoints. This makes it less suitable for quick, informal reviews where speed is prioritized over thoroughness.
When to use it
Use this skill when you need a rigorous, step-by-step process for reviewing code changes, especially in collaborative projects.
When not to use it
Avoid this skill for quick, informal code reviews where a less structured approach may be more efficient.
What you can build with it
Collaborative Code Review
When working in a team, use this skill to ensure that all code changes are rigorously reviewed and vetted for quality.
Security Audits
Utilize the adversarial approach to identify potential vulnerabilities in code during security audits.
Code Quality Assurance
Implement this skill in your development process to maintain high standards of code quality and reliability.
How to install Adversarial Code Review
View source1. Install with the skills CLI
npx skills add bmad-code-org/bmad-method/bmad-code-review --agent claude-code2. Or install it manually
Download the skill folder and drop it into ~/.claude/skills/ for all projects, or .claude/skills/ to scope it to one repo. Restart Claude Code so it picks up the new skill.
Anthropic's agentic coding CLI, and the reference implementation of Agent Skills. Drop a skill folder into ~/.claude/skills and Claude Code loads it automatically whenever a task matches the skill's description. Claude Code docs
Inside SKILL.md
Written by bmad-code-orgCode Review Workflow
Goal: Review code changes adversarially. No noise, no filler.
Subagents, when the capability is available, are an important part of this workflow. Use them as directed by the workflow steps. If you need an explicit user instruction to run them, ask once now for the whole workflow run.
Conventions
- Bare paths (e.g.
checklist.md) resolve from the skill root. {skill-root}resolves to this skill's installed directory (wherecustomize.tomllives).{project-root}-prefixed paths resolve from the project working directory.{skill-name}resolves to the skill directory's basename.
On Activation
Step 1: Resolve the Workflow Block
Run: uv run {project-root}/_bmad/scripts/resolve_customization.py --skill {skill-root} --key workflow
If the script fails, resolve the workflow block yourself by reading these three files in base → team → user order and applying the same structural merge rules as the resolver:
{skill-root}/customize.toml— defaults{project-root}/_bmad/custom/{skill-name}.toml— team overrides{project-root}/_bmad/custom/{skill-name}.user.toml— personal overrides
Any missing file is skipped. Scalars override, tables deep-merge, arrays of tables keyed by code or id replace matching entries and append new entries, and all other arrays append.
Step 2: Execute Prepend Steps
Execute each entry in {workflow.activation_steps_prepend} in order before proceeding.
Step 3: Load Persistent Facts
Treat every entry in {workflow.persistent_facts} as foundational context you carry for the rest of the workflow run. Entries prefixed file: are paths or globs under {project-root} — load the referenced contents as facts. All other entries are facts verbatim.
Step 4: Load Config
Load config from {project-root}/_bmad/bmm/config.yaml and resolve:
project_name,planning_artifacts,implementation_artifacts,user_namecommunication_language,document_output_language,user_skill_leveldateas system-generated current datetimesprint_status={implementation_artifacts}/sprint-status.yamlproject_context=**/project-context.md(load if exists)- YOU MUST ALWAYS SPEAK OUTPUT in your Agent communication style with the config
{communication_language}
Step 5: Greet the User
Greet {user_name}, speaking in {communication_language}.
Step 6: Execute Append Steps
Execute each entry in {workflow.activation_steps_append} in order.
Activation is complete. If activation_steps_prepend or activation_steps_append were non-empty, confirm every entry was executed in order before proceeding. Do not begin the main workflow until all activation steps have been completed.
WORKFLOW ARCHITECTURE
This uses step-file architecture for disciplined execution:
- Micro-file Design: Each step is self-contained and followed exactly
- Just-In-Time Loading: Only load the current step file
- Sequential Enforcement: Complete steps in order, no skipping
- State Tracking: Persist progress via in-memory variables
- Append-Only Building: Build artifacts incrementally
Step Processing Rules
- READ COMPLETELY: Read the entire step file before acting
- FOLLOW SEQUENCE: Execute sections in order
- WAIT FOR INPUT: Halt at checkpoints and wait for human
- LOAD NEXT: When directed, read fully and follow the next step file
Critical Rules (NO EXCEPTIONS)
- NEVER load multiple step files simultaneously
- ALWAYS read entire step file before execution
- NEVER skip steps or optimize the sequence
- ALWAYS follow the exact instructions in the step file
- ALWAYS halt at checkpoints and wait for human input
FIRST STEP
Read fully and follow: ./steps/step-01-gather-context.md
Frequently asked questions about Adversarial Code Review
Similar skills
Quality Playbook Generator
Run comprehensive quality audits on any codebase.
PR Draft Summary
Automate PR summary generation for openai-agents-python.
Final Release Review
Streamline your release candidate audits with ease.
Unit Test Vue Pinia
Efficiently write and review unit tests for Vue 3 applications.
Slang Shader Expert
Optimize and integrate Slang shaders with ease.
Telemetry Standards
Ensure consistent event tracking in Supabase Studio.
