[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6F3YYQ7HYQSEHCBTMFWR8FR":3,"skill-same:01M6F3YYQ7HYQSEHCBTMFWR8FR":48},{"skillNo":4,"name":5,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":21,"linkOnly":22,"markdownContent":23,"markdownBody":23,"frontMatter":24,"refName":25,"commitSha":26,"skillDirectory":27,"forksCount":28,"repositoryHtmlUrl":29,"repositoryHomepageUrl":30,"ownerHtmlUrl":31,"ownerBlogUrl":6,"ownerDescription":32,"updatedAt":33,"install":34,"resources":47},"01M6F3YYQ7HYQSEHCBTMFWR8FR","fix-review",null,"ComeOnOliver\u002Fskillshub","ComeOnOliver","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F43215937?v=4","01M6E5JNFECJAAVFE0W7SMWWD2","Haoran Shu","01M6E5JNNDQS7AJZDYFQ8TPZCK",66,"MIT","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002FelizaOS\u002Feliza\u002Ffix-review\u002FSKILL.md",[],[18,19,20],"review","fix","fix review","2026-11-10 10:12:30",false,"# Fix Review\n\nDifferential analysis to verify commits address security findings without introducing bugs.\n\n## When to Use\n\n- Reviewing fix branches against security audit reports\n- Validating that remediation commits actually address findings\n- Checking if specific findings (TOB-XXX format) have been fixed\n- Analyzing commit ranges for bug introduction patterns\n- Cross-referencing code changes with audit recommendations\n\n## When NOT to Use\n\n- Initial security audits (use audit-context-building or differential-review)\n- Code review without a specific baseline or finding set\n- Greenfield development with no prior audit\n- Documentation-only changes\n\n---\n\n## Rationalizations (Do Not Skip)\n\n| Rationalization | Why It's Wrong | Required Action |\n|-----------------|----------------|-----------------|\n| \"The commit message says it fixes TOB-XXX\" | Messages lie; code tells truth | Verify the actual code change addresses the finding |\n| \"Small fix, no new bugs possible\" | Small changes cause big bugs | Analyze all changes for anti-patterns |\n| \"I'll check the important findings\" | All findings matter | Systematically check every finding |\n| \"The tests pass\" | Tests may not cover the fix | Verify fix logic, not just test status |\n| \"Same developer, they know the code\" | Familiarity breeds blind spots | Fresh analysis of every change |\n\n---\n\n## Quick Reference\n\n### Input Requirements\n\n| Input | Required | Format |\n|-------|----------|--------|\n| Source commit | Yes | Git commit hash or ref (baseline before fixes) |\n| Target commit(s) | Yes | One or more commit hashes to analyze |\n| Security report | No | Local path, URL, or Google Drive link |\n\n### Finding Status Values\n\n| Status | Meaning |\n|--------|---------|\n| FIXED | Code change directly addresses the finding |\n| PARTIALLY_FIXED | Some aspects addressed, others remain |\n| NOT_ADDRESSED | No relevant changes found |\n| CANNOT_DETERMINE | Insufficient context to verify |\n\n---\n\n## Workflow\n\n### Phase 1: Input Gathering\n\nCollect required inputs from user:\n\n```\nSource commit:  [hash\u002Fref before fixes]\nTarget commit:  [hash\u002Fref to analyze]\nReport:         [optional: path, URL, or \"none\"]\n```\n\nIf user provides multiple target commits, process each separately with the same source.\n\n### Phase 2: Report Retrieval\n\nWhen a security report is provided, retrieve it based on format:\n\n**Local file (PDF, MD, JSON, HTML):**\nRead the file directly using the Read tool. Claude processes PDFs natively.\n\n**URL:**\nFetch web content using the WebFetch tool.\n\n**Google Drive URL that fails:**\nSee `references\u002Freport-parsing.md` for Google Drive fallback logic using `gdrive` CLI.\n\n### Phase 3: Finding Extraction\n\nParse the report to extract findings:\n\n**Trail of Bits format:**\n- Look for \"Detailed Findings\" section\n- Extract findings matching pattern: `TOB-[A-Z]+-[0-9]+`\n- Capture: ID, title, severity, description, affected files\n\n**Other formats:**\n- Numbered findings (Finding 1, Finding 2)\n- Severity-based sections (Critical, High, Medium, Low)\n- JSON with `findings` array\n\nSee `references\u002Freport-parsing.md` for detailed parsing strategies.\n\n### Phase 4: Commit Analysis\n\nFor each target commit, analyze the commit range:\n\n```bash\n# Get commit list from source to target\ngit log \u003Csource>..\u003Ctarget> --oneline\n\n# Get full diff\ngit diff \u003Csource>..\u003Ctarget>\n\n# Get changed files\ngit diff \u003Csource>..\u003Ctarget> --name-only\n```\n\nFor each commit in the range:\n1. Examine the diff for bug introduction patterns\n2. Check for security anti-patterns (see `references\u002Fbug-detection.md`)\n3. Map changes to relevant findings\n\n### Phase 5: Finding Verification\n\nFor each finding in the report:\n\n1. **Identify relevant commits** - Match by:\n   - File paths mentioned in finding\n   - Function\u002Fvariable names in finding description\n   - Commit messages referencing the finding ID\n\n2. **Verify the fix** - Check that:\n   - The root cause is addressed (not just symptoms)\n   - The fix follows the report's recommendation\n   - No new vulnerabilities are introduced\n\n3. **Assign status** - Based on evidence:\n   - FIXED: Clear code change addresses the finding\n   - PARTIALLY_FIXED: Some aspects fixed, others remain\n   - NOT_ADDRESSED: No relevant changes\n   - CANNOT_DETERMINE: Need more context\n\n4. **Document evidence** - For each finding:\n   - Commit hash(es) that address it\n   - Specific file and line changes\n   - How the fix addresses the root cause\n\nSee `references\u002Ffinding-matching.md` for detailed matching strategies.\n\n### Phase 6: Output Generation\n\nGenerate two outputs:\n\n**1. Report file (`FIX_REVIEW_REPORT.md`):**\n\n```markdown\n# Fix Review Report\n\n**Source:** \u003Ccommit>\n**Target:** \u003Ccommit>\n**Report:** \u003Cpath or \"none\">\n**Date:** \u003Cdate>\n\n## Executive Summary\n\n[Brief overview: X findings reviewed, Y fixed, Z concerns]\n\n## Finding Status\n\n| ID | Title | Severity | Status | Evidence |\n|----|-------|----------|--------|----------|\n| TOB-XXX-1 | Finding title | High | FIXED | abc123 |\n| TOB-XXX-2 | Another finding | Medium | NOT_ADDRESSED | - |\n\n## Bug Introduction Concerns\n\n[Any potential bugs or regressions detected in the changes]\n\n## Per-Commit Analysis\n\n### Commit abc123: \"Fix reentrancy in withdraw()\"\n\n**Files changed:** contracts\u002FVault.sol\n**Findings addressed:** TOB-XXX-1\n**Concerns:** None\n\n[Detailed analysis]\n\n## Recommendations\n\n[Any follow-up actions needed]\n```\n\n**2. Conversation summary:**\n\nProvide a concise summary in the conversation:\n- Total findings: X\n- Fixed: Y\n- Not addressed: Z\n- Concerns: [list any bug introduction risks]\n\n---\n\n## Bug Detection\n\nAnalyze commits for security anti-patterns. Key patterns to watch:\n- Access control weakening (modifiers removed)\n- Validation removal (require\u002Fassert deleted)\n- Error handling reduction (try\u002Fcatch removed)\n- External call reordering (state after call)\n- Integer operation changes (SafeMath removed)\n- Cryptographic weakening\n\nSee `references\u002Fbug-detection.md` for comprehensive detection patterns and examples.\n\n---\n\n## Integration with Other Skills\n\n**differential-review:** For initial security review of changes (before audit)\n\n**issue-writer:** To format findings into formal audit reports\n\n**audit-context-building:** For deep context when analyzing complex fixes\n\n---\n\n## Tips for Effective Reviews\n\n**Do:**\n- Verify the actual code change, not just commit messages\n- Check that fixes address root causes, not symptoms\n- Look for unintended side effects in adjacent code\n- Cross-reference multiple findings that may interact\n- Document evidence for every status assignment\n\n**Don't:**\n- Trust commit messages as proof of fix\n- Skip findings because they seem minor\n- Assume passing tests mean correct fixes\n- Ignore changes outside the \"fix\" scope\n- Mark FIXED without clear evidence\n\n---\n\n## Reference Files\n\nFor detailed guidance, consult:\n\n- **`references\u002Ffinding-matching.md`** - Strategies for matching commits to findings\n- **`references\u002Fbug-detection.md`** - Comprehensive anti-pattern detection\n- **`references\u002Freport-parsing.md`** - Parsing different report formats, Google Drive fallback\n",{},"main","def8531e65114c0fca8fb8551c1871ee0eed705c","skills\u002FelizaOS\u002Feliza\u002Ffix-review",24,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub","https:\u002F\u002Fskillshub.wtf","https:\u002F\u002Fgithub.com\u002FComeOnOliver","AI & Blockchain Engineer\r\n","2026-06-24 22:07:19",{"source":7,"skillName":5,"commands":35,"prompt":45,"zipAvailable":46},[36,39,42],{"tool":37,"command":38},"npx","npx skills add ComeOnOliver\u002Fskillshub --skill fix-review",{"tool":40,"command":41},"bunx","bunx skills add ComeOnOliver\u002Fskillshub --skill fix-review",{"tool":43,"command":44},"pnpm","pnpm dlx skills add ComeOnOliver\u002Fskillshub --skill fix-review","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002FelizaOS\u002Feliza\u002Ffix-review\u002FSKILL.md",true,[],[49,63,73,82,88,95],{"skillNo":50,"name":51,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":52,"categories":53,"keywords":59,"publishedAt":21},"01M6FKJN13GMG4KY57J3QD8GY5","model-hierarchy-skill","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzscole\u002Fmodel-hierarchy-skill\u002Fmodel-hierarchy-skill\u002FSKILL.md",[54],{"categoryNo":55,"categoryName":56,"taxonomyType":57,"taxonomyTypeDesc":58},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[60,61,62],"model","model hierarchy","model hierarchy skill",{"skillNo":64,"name":65,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":66,"categories":67,"keywords":69,"publishedAt":21},"01M6FKJJJ6GCAMR4PPPRD12M5X","zoom-mcp","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fzoom-mcp\u002FSKILL.md",[68],{"categoryNo":55,"categoryName":56,"taxonomyType":57,"taxonomyTypeDesc":58},[70,71,72],"MCP","zoom","zoom mcp",{"skillNo":74,"name":75,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":76,"categories":77,"keywords":78,"publishedAt":21},"01M6FKJE3KYT3KPEZMEEHYKA6K","zoom-apps-sdk","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fzoom-apps-sdk\u002FSKILL.md",[],[79,80,81,71],"sdk","zoom apps sdk","apps",{"skillNo":83,"name":84,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":85,"categories":86,"keywords":87,"publishedAt":21},"01M6FKJ9EDH9Q5VWDF8HAJRSP0","windows","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwindows\u002FSKILL.md",[],[84],{"skillNo":89,"name":90,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":91,"categories":92,"keywords":94,"publishedAt":21},"01M6FKJ666BEEFC3AE9GJ72Q93","whiteboard","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwhiteboard\u002FSKILL.md",[93],{"categoryNo":55,"categoryName":56,"taxonomyType":57,"taxonomyTypeDesc":58},[90],{"skillNo":96,"name":97,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":98,"categories":99,"keywords":100,"publishedAt":21},"01M6FKJ21WFCDGTJQ2Q91T9DVW","websockets","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwebsockets\u002FSKILL.md",[],[97]]