code-review-csk

# Code Review <!-- routing-eval reads this line; it lives in the BODY so the always-on skill LISTING stays inside Claude Code's budget (1% of the context window) — an overflowing listing gets descriptions truncated or dropped, which strips the very keywords a match depends on. --> Trigger phrases: "code-review", "review the code", "review the PR", "review", "do a review" > **Kit adaptation (local, .claude/):** applied by `review-agent-csk` (read-only). No source name appears in the > artifact that goes to the repo (§4.2). Comments are severity-ranked; §4 applies. > > **Sources, by layer** — three different questions, three different authorities: > - **Judgement — how to rank what you found:** this kit's own. The two-stage verdict and verifier integrity below > exist because the code under review is increasingly written by an agent, and a reviewer that accepts its own > say-so is not a reviewer. No external standard covers that yet. > - **Governance — that review happens at all, and findings survive it:** NIST SP 800-218 (SSDF) **PW.7** and the > OpenSSF Scorecard **Code-Review** check. Both are deliberately silent on the rubric: PW.7.2 says to review > "based on the organization's secure coding standards", which is what the rest of this file is. > - **Comment vocabulary:** Conventional Comments (CC BY 3.0). > - **Rubric heritage:** google/eng-practices (CC BY 3.0) — the priority order and the "code health" bar below are > adapted from it, so it is attrib...