--- name: adversarial-reviewer-ce435bc59caf description: Stress-test a code change for concrete correctness defects, unsafe assumptions, and failure modes. Use when the user explicitly asks for an adversarial review, a deep bug hunt, or to tear a change apart, or to check your own change before submitting it. Do not use for ordinary review, style feedback, or general improvement suggestions. --- # Adversarial code review Look for defects that survive an ordinary review. Treat the implementation's assumptions as claims to verify, while keeping every finding tied to evidence. ## Establish the review boundary 1. Identify the exact diff, branch, pull request head, or files under review. 2. Read the surrounding code needed to understand data flow and invariants. 3. Check repository instructions and the tests that define expected behavior. 4. Compare the change with its stated purpose. Trace the scenario and configuration from the issue, discussion, or accepted design it addresses through the real code, and treat each claim in the description and changeset as something to verify. 5. Separate defects introduced by the reviewed change from unrelated observations. Report an out-of-scope issue only when it materially affects the change's safety. Do not modify code, post a review, or expand the review target unless the user asks. ## Hunt for failures Choose the checks that fit the change instead of mechanically applying every category. - **Logic and boundaries:** empty and single-item inputs, pagination edges, invalid state transitions, locale handling, Unicode, maximum values, and repeat invocation. - **Errors and cleanup:** swallowed failures, partial cleanup, misleading status codes, exposed internals, missing timeouts, and unbounded retries. - **State and concurrency:** stale reads, lost updates, time-of-check/time-of-use races, duplicate delivery, non-idempotent retries, leaked listeners, and shared mutable state. - **Authorization and trust:** missing permission checks, confused caller identity, CSRF, unsafe redirects, injection, path traversal, secret exposure, and trust transferred across a boundary without validation. - **Data integrity:** partial writes, migration restart behavior, dialect differences, uniqueness assumptions, destructive cascades, and old/new version compatibility. - **Resources and performance:** unbounded collections, repeated round trips, retained resources, logged-out hot-path regressions, and work that scales with attacker-controlled input. - **Scope:** the same defect left in place elsewhere, such as sibling call sites, other storage backends or render paths, and data already stored in the old shape. - **Interfaces:** exported types, generated schemas, generated types, and documentation that no longer match the new behavior. Trace concrete inputs and event sequences through the real implementation. Run focused tests or a minimal reproduction when that is the fastest way to establish a claim. Do not infer a bug solely from an unfamiliar pattern. ## Findings standard A finding needs all of the following: - the violated behavior or invariant; - the exact code location; - a concrete trigger or execution path; - the observable consequence; - a proportionate fix direction. Use calibrated language. State confirmed defects directly. Label an unresolved concern as uncertain and explain what evidence is missing. Do not turn naming, formatting, optional hardening, or personal design preference into a correctness finding. Prioritize by impact and likelihood: - **Critical:** exploitable security issue, unrecoverable data loss, or broad production outage. - **High:** likely user-visible wrong behavior, authorization bypass, or recoverable data corruption. - **Medium:** real failure under a plausible edge case, race, or sustained load. - **Low:** limited correctness issue with small impact. Omit purely cosmetic observations. ## Report Lead with findings, ordered by severity. For each finding, include a short title, file and line, the failing scenario, impact, and fix direction. Keep line ranges tight. If no actionable defects are supported by the evidence, say so. Mention meaningful residual risks or untested boundaries, but do not manufacture findings to make the review appear thorough. --- Source attribution: emdash-cms Original project: https://github.com/emdash-cms/emdash/blob/2e103a45aa1b680318022c59e8cc0af0629c3ca3/skills/adversarial-reviewer/SKILL.md License: MIT License information: https://opensource.org/license/mit Original upstream instructions; downloaded from Mega AI Hub. ## Upstream license notice The MIT License Copyright 2026 Cloudflare Inc. Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the “Software”), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. # Mega AI Hub resource metadata Creator / publisher: emdash-cms Original project: https://github.com/emdash-cms/emdash/blob/2e103a45aa1b680318022c59e8cc0af0629c3ca3/skills/adversarial-reviewer/SKILL.md Attribution basis: Source repository record Fields of work: Development & Engineering, Product Management Roles: Backend Developer, DevOps / SRE, Product Manager, QA / Test Engineer, Technical Product Manager Specialties: Testing Tools: Tool not specified Country applicability: Country not specified Classification basis: Source catalog labels Instruction SHA-256: 2627b56d96aa6326b48b140aab490570b78c2c096909c409e19a62f8f10326c2