plurano-merge-train · Nov 1, 2026 · Oct 31, 2026 · Nov 1, 2026 · Nov 1, 2026 · Nov 1, 2026
diff --git a/.codacy.yml b/.codacy.yml
@@ -0,0 +1,46 @@
+---
+# SPDX-FileCopyrightText: 2026 Lusoris <lusoris@pm.me>
+# SPDX-License-Identifier: EUPL-1.2
+# Codacy reads this file from the default branch for every analysis, and a pull request's
+# changes to it apply to that pull request's analysis too
+# (https://docs.codacy.com/repositories-configure/codacy-configuration-file/, read 2026-11-01).
+# Once it exists, ignored-files settings in the Codacy UI no longer apply: every exclusion
+# lives here, one narrow pattern per judged false positive, each naming its verdict.
+engines:
+  markdownlint:
+    exclude_paths:
+      # MD024 (no duplicate headings): this repository lints Markdown with
+      # tools/markdownlint/markdownlint-cli2.yaml, where MD024 is siblings_only: true, so a
+      # heading repeated under a different parent is the declared style. The adopted reference
+      # guides repeat section names such as checklists and examples under each topic (28
+      # findings on pull request 27). The repository's own Markdown gate still lints these files.
+      # Verdict: FACT peritia-decided-codacy-trial-verdict-27-md024.
+      - "skills/*/reference/**"
+  agentlinter:
+    exclude_paths:
+      # skill-safety dangerous-commands: the XSS prevention guide names eval(), new Function()
+      # and 'unsafe-eval' as patterns a reviewer refuses (5 findings on pull request 27); the
+      # guide runs nothing. Verdict: FACT peritia-decided-codacy-trial-verdict-27-xss-eval.
+      - "skills/code-review-skill/reference/cross-cutting/xss-prevention.md"
+  opengrep:
+    exclude_paths:
+      # javascript path traversal (non-literal fs filename): a pattern rule that fires on every
+      # variable path. normalize.mjs resolves each path and refuses anything outside the root
+      # (exit 2); test_normalize.mjs proves both sides and runs in make test (17 findings on
+      # pull request 27). Verdict: FACT peritia-decided-codacy-trial-verdict-27-path-traversal.
+      - "tools/markdownlint/normalize.mjs"
+      - "tools/markdownlint/test_normalize.mjs"
+      # python dangerous subprocess use: the adoption tests start node and git with a fixed
+      # argument list, by full path from shutil.which, on test input (2 findings).
+      # Verdict: FACT peritia-decided-codacy-trial-verdict-27-test-subprocess.
+      - "tools/test_adopt_skills.py"
+  bandit:
+    exclude_paths:
+      # B603 subprocess without shell: same calls as the opengrep entry above (2 findings).
+      # Verdict: FACT peritia-decided-codacy-trial-verdict-27-test-subprocess.
+      - "tools/test_adopt_skills.py"
+  prospector:
+    exclude_paths:
+      # Prospector's bandit plugin repeats the B603 finding above (2 findings); Ruff still lints
+      # this file. Verdict: FACT peritia-decided-codacy-trial-verdict-27-test-subprocess.
+      - "tools/test_adopt_skills.py"
diff --git a/CREDITS.md b/CREDITS.md
@@ -26,3 +26,4 @@ names the exact path and commit.
 | <https://github.com/microsoft/skills> | MIT | `applicationinsights-web-ts`, `azure-advisor-actionability`, `azure-eventhub-java`, `azure-local`, `azure-local-multi-rack`, `azure-storage-blob-java`, `wiki-changelog`, `wiki-qa` |
 | <https://github.com/sickn33/agentic-awesome-skills> | Apache-2.0, CC0-1.0, MIT, MIT-0 | `aas-compose-stack`, `aas-discover`, `aas-review-stack`, `agenttrace-session-audit`, `ai-logo-maker`, `ai-multilingual-dubbing`, `ai-photo-restyler`, `ai-podcast-voiceover`, `api-contract-testing`, `artifact-yylo`, `atlas-cloud-media`, `audit-logging`, `aws-cloudtrail`, `azure-monitor-audit`, `beatra`, `beatra-ai-video-studio`, `before-you-build`, `brain-to-docs`, `browser-extension-launch`, `business-continuity`, `buywhere-product-catalog`, `codex-subagent`, `compile-knowledge`, `deep-research-framework`, `define-my-content-pillars`, `delegating-to-agents`, `diagnose-android-overheating`, `ditto`, `draft-my-comments`, `dsh-deepread`, `ecommerce-listing-image-set`, `equibles`, `famulor-skill`, `feature-tracking`, `fedramp-compliance`, `five-axis-code-review`, `git-commit-message`, `glasser`, `graceful-shutdown`, `hipaa-compliance-sickn33`, `idea-autopsy`, `incident-management`, `invokely-statistics`, `iso27001-compliance`, `jet-browser`, `laravel-development-workflow`, `markstream-angular`, `markstream-migration`, `markstream-nuxt`, `markstream-react`, `markstream-svelte`, `markstream-vue`, `markstream-vue2`, `markstream-vue2-cli`, `markstream-vue2-vite`, `md2video-audio`, `mdpr-skill`, `meeting-notes`, `muapi-media`, `music-generation-studio`, `nexrad-mosaic-access`, `nexrad-product-access`, `noaa-radar-satellite-fetching`, `openclaw-deployment-hardening`, `optim-agent`, `orchestrate`, `outreachagent`, `parallel-search-mcp`, `pci-dss-compliance`, `pi-web-search`, `plan-ledger-tasks-yylo`, `poster-design-studio`, `pre-release-review`, `pre-ship-gate`, `product-photo-studio`, `production-runtime-certification`, `radar-satellite-analysis`, `repo-maintainer`, `repurpose-into-a-post`, `research-prompt`, `resumable-implementation-contracts`, `same-idea-both-platforms`, `security-automation`, `seo-drift`, `serply-search-mcp`, `setup-help`, `shopify-review-triage`, `skeleton-first`, `skill-porter`, `skill-security-audit`, `soc2-compliance`, `spec-driven-loop`, `sshepherd`, `suno-lyrics-to-song`, `taisly-social-media-posting`, `talking-avatar-video`, `tech-writing-proofread`, `tokenleak`, `trading-ledger`, `tree-ring-memory`, `turn-this-into-a-thread`, `understand-project-yylo`, `unslop`, `unsloth-finetuning`, `upstash-redis`, `video-router`, `viral-video-teardown-remake`, `voice-cloning-studio`, `voiceover-narration-studio`, `warehouse`, `weather-data-lifecycle-management`, `weather-data-reproducibility`, `weather-model-data-fetching`, `weather-model-run-discovery`, `weather-observation-fetching`, `weather-pipeline-performance-diagnosis`, `what-could-break`, `why-did-this-post-flop`, `wiki-builder`, `wiki-yylo`, `workflow-yylo`, `write-in-my-voice`, `youtube-transcript-skills` |
 | <https://github.com/vercel-labs/skills> | MIT | `pr-labeling`, `triage` |
+| <https://github.com/awesome-skills/code-review-skill> | MIT | `code-review-skill` |
diff --git a/Makefile b/Makefile
@@ -35,6 +35,7 @@ tools:
 # carries a licence (REUSE). The selftest plants one defect per rule and must see each refused.
 test: tools build
 	@$(BIN)/python -B tools/check_skills.py selftest
+	@node --test tools/markdownlint/test_normalize.mjs
 	@python3 -B tools/install_user_skills.py selftest
 	@$(BIN)/python -B tools/test_census.py
 	@$(BIN)/python -B tools/test_classify.py

diff --git a/REUSE.toml b/REUSE.toml
@@ -1668,3 +1668,9 @@ path = ["skills/sshepherd/**"]
 precedence = "override"
 SPDX-FileCopyrightText = "2026 sickn33 and contributors"
 SPDX-License-Identifier = "MIT"
+
+[[annotations]]
+path = ["skills/code-review-skill/**"]
+precedence = "override"
+SPDX-FileCopyrightText = "2026 awesome-skills and contributors"
+SPDX-License-Identifier = "MIT"
diff --git a/requirements/tools.in b/requirements/tools.in
@@ -1,3 +1,4 @@
 # SPDX-FileCopyrightText: 2026 Lusoris <lusoris@pm.me>
 # SPDX-License-Identifier: EUPL-1.2
 pyyaml
+markdown-it-py
diff --git a/requirements/tools.txt b/requirements/tools.txt
@@ -1,5 +1,13 @@
 # This file was autogenerated by uv via the following command:
 #    uv pip compile --universal --python-version=3.12 --generate-hashes --exclude-newer=P3D requirements/tools.in --output-file=requirements/tools.txt
+markdown-it-py==4.2.0 \
+    --hash=sha256:04a21681d6fbb623de53f6f364d352309d4094dd4194040a10fd51833e418d49 \
+    --hash=sha256:9f7ebbcd14fe59494226453aed97c1070d83f8d24b6fc3a3bcf9a38092641c4a
+    # via -r requirements/tools.in
+mdurl==0.1.2 \
+    --hash=sha256:84008a41e51615a49fc9966191ff91509e3c40b939176e643fd50a5c2196b8f8 \
+    --hash=sha256:bb413d29f5eea38f31dd4754dd7377d4465116fb207585f97bf925588687c1ba
+    # via markdown-it-py
 pyyaml==6.0.3 \
     --hash=sha256:00c4bdeba853cc34e7dd471f16b4114f4162dc03e6b7afcc2128711f0eca823c \
     --hash=sha256:0150219816b6a1fa26fb4699fb7daa9caf09eb1999f3b70fb6e786805e80375a \

diff --git a/skills/INDEX.tsv b/skills/INDEX.tsv
@@ -40,14 +40,15 @@ bgpt-paper-search	K-Dense-AI/scientific-agent-skills
 brain-to-docs	sickn33/agentic-awesome-skills	docs-writing;planning-fleet-mgmt	other	126
 brand-voice	affaan-m/ecc			
 brendangregg-use-tsa	thecsdoctor/brendangregg-use-tsa-skill			
-brooks-review	hyhmrright/brooks-lint			
+brooks-review	hyhmrright/brooks-lint			106
 browser-extension-launch	sickn33/agentic-awesome-skills			
 business-continuity	sickn33/agentic-awesome-skills			
 buywhere-product-catalog	sickn33/agentic-awesome-skills			
 carrier-relationship-management	affaan-m/ecc	research;planning-fleet-mgmt	other	20
 cellprofiler	K-Dense-AI/scientific-agent-skills			
 change-impact	affaan-m/ecc			
 cisco-ios-patterns	affaan-m/ecc	review-audit	kubernetes-hosts-networking	47
+code-review-skill	awesome-skills/code-review-skill	review-audit	other	106
 codebase-recon	yujiachen-y/codebase-recon-skill			
 codex-subagent	sickn33/agentic-awesome-skills	coding;review-audit;testing	other	110
 compile-knowledge	sickn33/agentic-awesome-skills	docs-writing;research	other	48

diff --git a/skills/code-review-skill/LICENSE b/skills/code-review-skill/LICENSE
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 awesome-skills
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/skills/code-review-skill/ORIGIN.md b/skills/code-review-skill/ORIGIN.md
@@ -0,0 +1,5 @@
+upstream: <https://github.com/awesome-skills/code-review-skill>
+path: .
+commit: 4850184dfd7765ea7b3c5c4e9b6cf8e0815ee7cb
+licence: MIT
+changes: code fences without a language marked text; omitted repository furniture (.gitignore, .nojekyll, CONTRIBUTING.md, README.md, index.en.html, index.html); omitted agent workbench files (.hive/PROTOCOL.md, .hive/memory.md, .hive/tasks.md); normalized Markdown whitespace (SKILL.md (MD032, MD060), assets/review-checklist.md (MD060), reference/angular.md (MD060), reference/c.md (MD022, MD032, MD060), reference/code-quality-universal.md (MD032), reference/code-review-best-practices.md (MD022, MD032, MD060), reference/common-bugs-checklist.md (MD022, MD032), reference/cpp.md (MD022, MD032, MD060), reference/cross-cutting/async-concurrency-patterns.md (MD022, MD032, MD060), reference/cross-cutting/n-plus-one-queries.md (MD022, MD032, MD060), reference/cross-cutting/sql-injection-prevention.md (MD047, MD060), reference/cross-cutting/xss-prevention.md (MD032, MD047, MD060), reference/css-less-sass.md (MD060), reference/dart.md (MD022, MD032), reference/fastapi.md (MD060), reference/go.md (MD022, MD032), reference/java.md (MD022, MD032), reference/java8.md (MD022, MD032, MD060), reference/performance-review-guide.md (MD032, MD060), reference/python.md (MD022, MD032), reference/qt.md (MD022, MD032, MD060), reference/react.md (MD060), reference/ruby.md (MD022, MD032), reference/swift.md (MD022, MD032), reference/typescript.md (MD022, MD032), reference/vue.md (MD022, MD032), reference/zig.md (MD022, MD032)); applied review patches (SKILL.md (PRRT_kwDOVLPOVM6yVpUJ), reference/c.md (PRRT_kwDOVLPOVM6yVs6w, PRRT_kwDOVLPOVM6yVs62, PRRT_kwDOVLPOVM6yVs6y, PRRT_kwDOVLPOVM6yVs65), reference/performance-review-guide.md (PRRT_kwDOVLPOVM6yVs6_), reference/react.md (PRRT_kwDOVLPOVM6yVs7C, PRRT_kwDOVLPOVM6yWCLe, PRRT_kwDOVLPOVM6yWQoT, PRRT_kwDOVLPOVM6yWQoi), reference/svelte.md (PRRT_kwDOVLPOVM6yVpT-, PRRT_kwDOVLPOVM6yVs7I, PRRT_kwDOVLPOVM6yWCLh, PRRT_kwDOVLPOVM6yWQob), reference/typescript.md (PRRT_kwDOVLPOVM6yVs7Q, PRRT_kwDOVLPOVM6yWCLj), reference/vue.md (PRRT_kwDOVLPOVM6yVs7T), reference/zig.md (PRRT_kwDOVLPOVM6yVs7X)); omitted files refused by markdown gate (assets/pr-review-template.md (MD036), reference/architecture-review-guide.md (MD036), reference/cross-cutting/error-handling-principles.md (MD003), reference/kotlin.md (MD026), reference/rust.md (MD036), reference/security-review-guide.md (MD036)); added provenance and licence attribution