review-walkthrough

An agent skill by trailofbits, from trailofbits/skills. Tags: analysis, documentation, review, ui-ux, web.

What it does

Generates an interactive HTML walkthrough for reviewing code changes. Use only when explicitly called.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add trailofbits/skills --skill review-walkthrough

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/trailofbits/skills
cp -r skills/plugins/review-walkthrough/skills/review-walkthrough ~/.claude/skills/review-walkthrough

Safety box score

Grade B, low risk: 11 of 100 risk points, rated 2026-09-21. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill renders a standalone HTML walkthrough from the current Git diff and the reviewer’s chosen output path. Its main risks are a small amount of local command execution for patch parsing, arbitrary-file output writes, and the ability to generate a ready-to-run GitHub review command that will post comments if the user executes it.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	1 (low)	`scripts/render_walkthrough.py` shells out to Git with `subprocess.run(["git", "apply", "--numstat", "-z", "--"], ...)`; this is bounded, but it is still local command execution.
Network access	0 (none)	The shipped code does not fetch remote content or send data to remote hosts; the only external action it prepares is a user-run `gh api` command, not an automatic network call.
Filesystem reach	1 (low)	The renderer writes to the caller-supplied `--output` path via `args.output.write_text(...)`, with only a self-collision check against the input, diff, and template files.
Secrets & credentials	0 (none)	The skill does not read credential stores, ask for tokens, or touch `.env`/keychain/browser-session data.
Privilege & persistence	0 (none)	There is no `sudo`, global install, service registration, or shell-startup/OS configuration change in the shipped files.
Instruction hijack surface	0 (none)	The files contain no prompt-injection or hidden instructions to ignore safeguards; the HTML sanitizer is defensive, not coercive.
Irreversible actions	1 (low)	`template.html` can construct a `gh api` POST payload for PR reviews, but it only copies a command and explicitly does not execute or post it automatically.
Transparency	0 (none)	All shipped source is plain text and readable; there are no binaries, downloaded installers, base64 blobs, or unpinned remote code.

Before installing

Read `scripts/render_walkthrough.py` and confirm you are comfortable with its `git apply --numstat` subprocess call.
Decide whether you want the generated HTML written outside the repo; the tool will write to any `--output` path you choose.
If you plan to use the copied `gh api` command, inspect the payload fields (`commit_id`, `comments`, `event`, and optional `body`) before running it.

Rated 2026-09-21 by an automated review of 5 files from the skill's repository.

Source

Repository: trailofbits/skills (all skills from this repository)
Path: plugins/review-walkthrough/skills/review-walkthrough/SKILL.md
Branch: main
Collection: review-walkthrough
Updated: 2026-09-19

principle-minimize-reader-load — Apply when reviewing or shaping code that's hard to trace.
get-pr-comments — Fetch and summarize review comments from the active pull request
show-me-your-work — Keep a reviewable decision trail for long-running or unattended work: a TSV log with one row per decision (what, why, evidence, result).
stitch::extract-design-md — Extract a comprehensive design system (DESIGN.md) directly from frontend source code — React, Vue, Svelte, Angular, plain HTML/CSS.
what-did-i-get-done — Summarize authored commits over a user-specified time period into a concise update
ask-sonner — Guide to Sonner, the React toast library — install and wire up the Toaster, pick the right toast() call, promise and loading toasts, updating.