Multi-pass deep code review — security, quality, and test gaps.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# deep-review
Multi-pass code review that runs security, quality, and
test gap analysis on a target. Uses subagents to keep
context clean.
## Context (pre-computed)
```bash
git diff --name-only main...HEAD 2>/dev/null || git diff --name-only HEAD~3 2>/dev/null
```
## Instructions
Use `AskUserQuestion` to scope:
- Which path or files to review?
- Focus: security, quality, test gaps, or all three?
Then run three passes using the Task tool with subagents:
### Pass 1: Security
```bash
uv run attune workflow run security-audit --path <target>
```
### Pass 2: Quality
```bash
uv run attune workflow run code-review --path <target>
```
### Pass 3: Test Gaps
Analyze which functions in the target lack test coverage
by cross-referencing source files with test files.
### Output
Consolidate findings into a single summary table:
| File | Issue | Severity | Category |
|------|-------|----------|----------|
Group by severity (high → medium → low). End with
actionable recommendations.
The line at the top of this page pins the label git:20260718.206f45d, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
GET https://markdownregistry.com/api/v1/artifacts/art_yxlkwtixkqm2l5hr
GET https://markdownregistry.com/api/v1/resolve?ref=smart-ai-memory/attune-ai/deep-review
GET https://markdownregistry.com/api/v1/blob/fec09cb33c82c8dcc6413922527e1130f897f1f305f15dc01038427ec51b705b
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
smart-ai-memory/attune-ai · .agents/skills/attune-hub/SKILL.md · Developer workflow hub — routes to the right skill based on what you need. Triggers on: attune, what can attune do…
smart-ai-memory/attune-ai · .agents/skills/author-feature/SKILL.md · Author a single-source feature page — a code-verified master that projects to .help kinds + docs pages, no API credits…
smart-ai-memory/attune-ai · .agents/skills/catalog/SKILL.md · Enumerate everything attune offers — every workflow, wizard, and tool, read live from the registries. Triggers on…
smart-ai-memory/attune-ai · .agents/skills/coach/SKILL.md · Progressive help for any topic. Repeat to go deeper: concept -> procedural -> reference. Triggers on: coach, learn…
drafthq/draft · skills/deep-review/SKILL.md · Single-module production readiness audit (ACID, resilience, observability). Use to audit one service/module end-to-end…
