# Review Walkthrough

Generates an interactive HTML walkthrough for reviewing code changes.

- Repository: https://github.com/trailofbits/skills (7935 stars)
- Category: Engineering
- License: CC-BY-SA-4.0
- Last updated: 2026-10-28
- Runs scripts: yes, review before use

## Install

Claude Code: `npx skills add trailofbits/skills --skill review-walkthrough -g -a claude-code -y`
Codex: `npx skills add trailofbits/skills --skill review-walkthrough -g -a codex -y`
Cursor: `npx skills add trailofbits/skills --skill review-walkthrough -g -a cursor -y`
Gemini CLI: `npx skills add trailofbits/skills --skill review-walkthrough -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add trailofbits/skills`

## Description

Generates an interactive HTML walkthrough for reviewing code changes. Use only when explicitly called.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Review Walkthrough

Generate a self-contained HTML walkthrough of the current branch, with the final
diff split into logical steps, explanations, and critical review findings. Choose
the grouping and reading order for comprehension; commit order need not dictate
either. Invoke as `/review-walkthrough:review-walkthrough` in Claude Code or
`$review-walkthrough` in Codex.

## Capture the branch diff

Respect a user-specified base. Otherwise, use the current open PR's base when PR
metadata is available. Without a PR, discover the repository's default branch
from `git symbolic-ref --quiet --short refs/remotes/origin/HEAD` or the configured
remote's equivalent. Do not assume it is `main`. If the selected base is missing
or ambiguous, ask for it rather than silently choosing another branch.

Resolve the base and `HEAD` to commit IDs with
`git rev-parse --verify --end-of-options "${ref}^{commit}"`, then compute their
merge base with `git merge-base`. Capture the complete patch using
`git diff --no-ext-diff --no-textconv --no-color --src-prefix=a/ --dst-prefix=b/ "$merge_base" "$head_sha" --`.
Initialize variables and run the commands that consume them in the same shell
invocation; shell variables do not persist between tool calls. Save the patch to
a temporary file outside the checkout and retain its actual path. Stop on a Git
error or an empty patch and explain the result.

This scope includes committed changes through the captured `HEAD`. Mention any
uncommitted work that is excluded. Do not change branches, reset the checkout,
or alter source files to prepare the review. Keep generated data and HTML outside
the checkout unless the user requests a particular output location; generated
review artifacts never belong in the captured patch.

The rest: https://github.com/trailofbits/skills/blob/HEAD/plugins/review-walkthrough/skills/review-walkthrough/SKILL.md