mcpField
C
classifying-review-findings

classifying-review-findings

github.com/bitwardenTesting & quality16299 installsUpdated today
Repository

About classifying-review-findings

A code-review skill for deciding whether a reported issue qualifies as a finding and assigning it a severity. It requires evidence from the execution path and rejects unsupported or subjective suggestions.

Key features

  1. 01Five severity categories
  2. 02Execution-path evidence checks
  3. 03Rejects unsupported findings
  4. 04Criteria for measurable suggestions

Use cases

  1. 01Classifying verified code-review findings
  2. 02Filtering out speculative reports
  3. 03Assessing proposed improvements

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/bitwarden/ai-plugins --skill classifying-review-findings

After installing, type/classifying-review-findingsin Claude Code to confirm it loaded.

Details

From the project README

Classifying Review Findings

Severity Categories

EmojiCategoryCriteria
❌CRITICALWill break, crash, expose data, or violate requirements
⚠️IMPORTANTMissing error handling, unhandled edge cases, could cause bugs
♻️DEBTDuplicates patterns, violates conventions, needs rework within 6 months
🎨SUGGESTEDMeasurably improves security, reduces complexity by 3+, eliminates bug classes
❓QUESTIONRequires human knowledge - unclear requirements, intent, or system conflicts

ALWAYS use hybrid emoji + text format for each finding (if multiple severities apply, use the most severe: ❌ > ⚠️ > ♻️ > 🎨 > ❓):

Before Classifying

Verify ALL three:

  1. Can you trace the execution path showing incorrect behavior?
  2. Is this handled elsewhere (error boundaries, middleware, validators)?
  3. Are you certain about framework behavior and language semantics?

If any answer is "no" or "unsure" → DO NOT classify as a finding.

Not Valid Findings (Reject)

  • Praise ("great implementation")
  • Vague suggestions ("could be simpler")
  • Style preferences without enforced standard
  • Naming nitpicks unless actively misleading
  • PR metadata issues (title, description, test plan) - handled by summary skill, not classified here
  • Renovate/Dependabot minor/patch updates to existing dependencies with passing CI — these are routine Stage 5 monitoring, not reviewable findings

Suggested Improvements (🎨) Criteria

Only suggest improvements that provide measurable value:

  1. Security gain - Eliminates entire vulnerability class (SQL injection, XSS, etc.)
  2. Complexity reduction - Reduces cyclomatic complexity by 3+, eliminates nesting level
  3. Bug prevention - Makes entire category of bugs impossible (type safety, null safety)
  4. Performance gain - Reduces O(n²) to O(n), eliminates N+1 queries (provide evidence)

Provide concrete metrics:

  • ❌ "This could be simpler"
  • ✅ "This has cyclomatic complexity of 12; extracting validation logic would reduce to 6"

If you can't measure the improvement, don't suggest it.

Comments

Markdown supported