Review Walkthrough
Generates an interactive HTML walkthrough for reviewing code changes.
Install
npx skills add trailofbits/skills --skill review-walkthrough -g -a claude-code -y- Repository
- trailofbits/skills7.9k
- Category
- Engineering
- Updated
- 7d ago
- License
- CC-BY-SA-4.0
- Context cost
- Mediumabout 1,641 tokens
- Runs scripts
- Yes, review before use
What it does
Generates an interactive HTML walkthrough for reviewing code changes. Use only when explicitly called.
Review Walkthrough
Generate a self-contained HTML walkthrough of the current branch, with the final
diff split into logical steps, explanations, and critical review findings. Choose
the grouping and reading order for comprehension; commit order need not dictate
either. Invoke as /review-walkthrough:review-walkthrough in Claude Code or
$review-walkthrough in Codex.
Capture the branch diff
Respect a user-specified base. Otherwise, use the current open PR's base when PR
metadata is available. Without a PR, discover the repository's default branch
from git symbolic-ref --quiet --short refs/remotes/origin/HEAD or the configured
remote's equivalent. Do not assume it is main. If the selected base is missing
or ambiguous, ask for it rather than silently choosing another branch.
Resolve the base and HEAD to commit IDs with
git rev-parse --verify --end-of-options "${ref}^{commit}", then compute their
merge base with git merge-base. Capture the complete patch using
git diff --no-ext-diff --no-textconv --no-color --src-prefix=a/ --dst-prefix=b/ "$merge_base" "$head_sha" --.
Initialize variables and run the commands that consume them in the same shell
invocation; shell variables do not persist between tool calls. Save the patch to
a temporary file outside the checkout and retain its actual path. Stop on a Git
error or an empty patch and explain the result.
This scope includes committed changes through the captured HEAD. Mention any
uncommitted work that is excluded. Do not change branches, reset the checkout,
or alter source files to prepare the review. Keep generated data and HTML outside
the checkout unless the user requests a particular output location; generated
review artifacts never belong in the captured patch.
