code-polish
Use to polish recently changed code: simplify for readability/maintainability and run a risk-profiled review that autonomously applies fixes. Default runs both passes; pass --simplify or --review for one. Covers code/PR review, audits, bug/security checks, reviewing diffs or changes, cleanup, refactoring, and reducing complexity.
Security Assessment
About code-polish
The code-polish skill runs a combined pipeline on recently changed code: a full simplification pass for readability and maintainability, followed by an exhaustive, risk-profiled review with fixes applied, ending in a single user-facing report. It resolves scope once and avoids duplicate broad checks across the two phases.
It first resolves scope (explicit paths, commit, or range; otherwise files modified earlier in the session; otherwise all uncommitted files) and emits an authoritative resolved-scope block, excluding generated, vendored, bulk, and low-signal files. The simplify phase applies a high-confidence simplification checklist while preserving behavior, public contracts, side effects, logging, telemetry, retries, and error semantics. The review phase applies correctness, security, data-integrity, shell and config safety, and regression checks, selects review profiles triggered by the touched risk surfaces, and applies fixes in severity order. It then runs targeted final verification and produces a structured report. It orchestrates the sibling code-simplify and code-review skills.
It is most useful for polishing recent changes before committing or opening a pull request, when a developer wants both cleanup and a thorough review with fixes in one pass.
FAQ
What does code-polish do?
It runs a full simplification pass and then a risk-profiled review with fixes on recently changed code, producing one combined report.
How does it decide what to work on?
It resolves scope once: explicit paths/commit/range if given, otherwise files modified earlier in the session, otherwise all uncommitted files, and emits an authoritative resolved-scope block.
What does the review phase check?
Core correctness, security, data integrity, shell and config safety, regression, and any review profiles triggered by the touched risk surfaces, applying fixes in severity order.
Does it change behavior?
The simplify phase is constrained to preserve behavior, public contracts, side effects, logging, telemetry, retries, and error semantics.
What is in the final report?
Scope, simplifications, review findings and fixes (ordered from critical to low), verification including skipped checks, and residual risks.
Install code-polish
Quick Setup:
- Copy the skill folder to
.claude/skills/ - Claude will automatically detect and use the skill
Repository
paulrberg/agent-skills