reflective-reviewer

What This Skill Does

The reflective-reviewer is an advanced OpenClaw agent skill designed to act as an automated, post-implementation auditor for software development projects. It systematically analyzes completed tasks to identify quality regressions, security vulnerabilities, and opportunities for architectural improvement. Unlike standard linters, this skill utilizes LLM reasoning to evaluate code within the context of the specific task performed, adhering to the OWASP Top 10 framework and industry-standard clean code principles. It functions as a virtual pair-programmer that performs a deep dive into your code, providing actionable feedback on everything from potential SQL injection flaws to minor naming convention improvements, ensuring your codebase remains robust and maintainable.

Installation

To integrate this skill into your OpenClaw environment, execute the following command in your terminal:

clawhub install openclaw/skills/skills/anton-abyzov/sw-reflective-reviewer

Ensure that you have sufficient permissions for file system access, as the skill needs to read your repository files to perform its analysis effectively.

Use Cases

• Post-Implementation Review: Run immediately after finishing a feature branch to catch bugs before merging to production.
• OWASP Compliance: Perform regular security audits of authentication and input-heavy modules to detect common vulnerabilities like XSS and injection.
• Technical Debt Management: Identify "TODO" markers, deprecated APIs, and code smells that have accumulated over several sprint cycles.
• Mentorship/Onboarding: Use the "Lessons Learned" feedback loop to help junior developers understand better architectural patterns and common anti-patterns to avoid.

Example Prompts

1. "Reflective-reviewer, please analyze the latest changes in src/auth/login.ts for potential security vulnerabilities and input validation gaps."
2. "Perform a technical debt assessment on the recently merged payment-gateway integration. Focus on naming conventions and potential code duplication."
3. "Review the testing coverage for the new UserProfile controller and identify any missing edge cases or error path scenarios."

Tips & Limitations

• Contextual Constraints: Keep your context under 500 tokens for best performance. If your project is large, focus the skill on a specific folder or file path.
• Token Budgeting: Adhere to the 2000-token response limit. If the code is complex, request analysis on one specific category (e.g., Security) at a time to ensure the depth of feedback is not truncated.
• Human-in-the-loop: Always verify critical security findings manually before running automated patch scripts. The skill provides recommendations, but professional developer judgment is required for final implementation.