review-code-risklisted

# Review Code Risk Find and fix **risks in an implemented fix before the PR is opened**. Humans and LLMs share a positive test strategy: reading a coherent diff that compiles and passes its tests pulls toward confirming it. This skill replaces "the fix looks right" with deliberate disconfirmation — search for the ways the change fails to resolve its issue, regresses, or hides a band-aid, then close them in the diff. **Scope: the fix, anchored to intent — not the design, not generic code quality.** The anchor is the diff together with the issue it claims to resolve and the plan it was built from. If the target is a plan, spec, or RFC before implementation, this is the wrong skill — say so and stop (that is review-plan-risk). If the request is line-level bug-hunting, simplification, or a security sweep with no intent to verify, say so and stop (that is code-review / coderabbit / security-review). This skill's distinct question is **intent alignment**: did THIS change resolve THAT issue, per THAT plan, without opening a new failure path — a question generic code review does not ask. ## Step 1 — Scan the fix Read the **anchor triple** in full: - **The diff** — the committed change under review, taken against the branch's fork point, not the base tip: `git diff $(git merge-base origin/<base> HEAD)..HEAD`, or the three-dot `git diff origin/<base>...HEAD` which resolves the merge-base for you (`<base>` is usually master). The fork-point form avoids pulling in commits the base a