Awesome Reviewers

Verifying Shell changes

Files: .sh, .bash, .zsh. Derived from 2 scanned source repositories and 70 review prompts on https://awesomereviewers.com. Page: https://awesomereviewers.com/verify/shell/

How to use this: run every check under Run on every change. Then, for each section under Add when the change touches that describes your diff, run its checks too. Checks catch what a tool can find; then apply the listed review prompts for what tools miss (fetch each prompt’s raw URL).

Usage is the share of scanned repositories in this language that run the tool. A missing tool means no scanned repository runs one the scanner recognises: fall back to the prompts.

Run on every change

• Formatting — no tool detected in the sample. Catches: Layout drift that buries the real change in the diff.
• Linting — no tool detected in the sample. Catches: Bug-prone patterns, unused code and conventions the formatter does not cover.
• Type checking — no tool detected in the sample. Catches: Wrong types, unhandled null or None, call signatures broken across modules.
• Unit and integration tests — no tool detected in the sample. Catches: Behaviour regressions on the paths the tests exercise.

Review prompts (6 in total, most discussed first):

• Avoid variable name abbreviations — Homebrew/brew, Naming Conventions
• Standardize shell flags — chef/chef, Code Style
• Ensure cross-platform compatibility — opengrep/opengrep, Code Style
• Quote shell variables — apache/airflow, Code Style
• Consistent variable naming — tensorflow/tensorflow, Naming Conventions
• improve code readability — Unstructured-IO/unstructured, Code Style

Add when the change touches

Authentication, input handling, secrets, permissions

• Security scanning: semgrep (50% of repos). Runs via pre-commit hook semgrep. Docs: https://github.com/semgrep/semgrep
• Secret scanning — no tool detected in the sample. Catches: Credentials and tokens committed to the repository.
• Dependency audit — no tool detected in the sample. Catches: Known-vulnerable or disallowed dependencies and licenses.

Review prompts (14 in total, most discussed first):

• Validate security context — maximhq/bifrost, Security
• avoid runtime credential resolution — electron/electron, Security
• Enforce Sensitive File Permissions — ogulcancelik/herdr, Security
• Least-privilege secret scoping — awslabs/agentcore-samples, Security
• Preserve signing entitlements — nousresearch/hermes-agent, Security
• Secure env lookup — mvanhorn/last30days-skill, Security
• Verify Download Integrity — apache/apisix, Security
• Check Privilege Early — apple/container, Security
• Sanitize untrusted tags — agent0ai/agent-zero, Security
• Least privilege networking — anthropics/claude-code, Security
• Warn against sudo — zed-industries/zed, Security
• Avoid automatic package execution — langfuse/langfuse, Security

Public APIs, signatures, error paths, nullability

• Type checking — no tool detected in the sample. Catches: Wrong types, unhandled null or None, call signatures broken across modules.
• Unit and integration tests — no tool detected in the sample. Catches: Behaviour regressions on the paths the tests exercise.
• Property-based tests — no tool detected in the sample. Catches: Edge-case inputs nobody wrote a test for; invariants over generated data.

Review prompts (9 in total, most discussed first):

• Config-Aware Startup Failures — maximhq/bifrost, Error Handling
• Fail Loudly, Degrade Safely — awslabs/aidlc-workflows, Error Handling
• contextual failure handling — opengrep/opengrep, Error Handling
• Fail with messages — Homebrew/brew, Error Handling
• Secure API URL parsing — Homebrew/brew, API
• Fail-fast artifact downloads — apache/apisix, Error Handling
• Standardize bash error-handling — chef/chef, Error Handling
• Fail fast principle — anthropics/claude-code, Error Handling
• Validate API parameter formats — Unstructured-IO/unstructured, API

Service and framework code

• Unit and integration tests — no tool detected in the sample. Catches: Behaviour regressions on the paths the tests exercise.
• Version and platform matrix — no tool detected in the sample. Catches: Breakage on a runtime version, OS or feature combination you did not run locally.

Algorithms, parsers, data transforms

• Property-based tests — no tool detected in the sample. Catches: Edge-case inputs nobody wrote a test for; invariants over generated data.
• Fuzzing — no tool detected in the sample. Catches: Crashes, panics and hangs on malformed input, especially in parsers and decoders.
• Mutation testing — no tool detected in the sample. Catches: Tests that keep passing whatever the code does.
• Proofs and specifications — no tool detected in the sample. Catches: Design-level bugs in protocols and algorithms, checked against a specification.

Review prompts (1 in total, most discussed first):

• leverage standard algorithms — prometheus/prometheus, Algorithms

Threads, async code, locks, shared state

• Concurrency model checking — no tool detected in the sample. Catches: Races and orderings that fail only under specific interleavings.
• Undefined-behaviour detection — no tool detected in the sample. Catches: Memory-safety and aliasing violations in unsafe code.
• Property-based tests — no tool detected in the sample. Catches: Edge-case inputs nobody wrote a test for; invariants over generated data.

Review prompts (1 in total, most discussed first):

• Safe lock reclamation — cline/cline, Concurrency

Network calls, retries, timeouts, protocols

• Unit and integration tests — no tool detected in the sample. Catches: Behaviour regressions on the paths the tests exercise.
• Fuzzing — no tool detected in the sample. Catches: Crashes, panics and hangs on malformed input, especially in parsers and decoders.

Review prompts (2 in total, most discussed first):

• Verify platform compatibility first — tensorflow/tensorflow, Networking
• Optimize git network operations — commaai/openpilot, Networking

UI components and pages

• End-to-end browser tests — no tool detected in the sample. Catches: User flows broken across components, routing and the network.
• Linting — no tool detected in the sample. Catches: Bug-prone patterns, unused code and conventions the formatter does not cover.

Databases, migrations, caching

• Unit and integration tests — no tool detected in the sample. Catches: Behaviour regressions on the paths the tests exercise.
• Version and platform matrix — no tool detected in the sample. Catches: Breakage on a runtime version, OS or feature combination you did not run locally.

Review prompts (1 in total, most discussed first):

• Descriptive migration functions — hashicorp/terraform, Migrations

Model, prompt and LLM code

• Unit and integration tests — no tool detected in the sample. Catches: Behaviour regressions on the paths the tests exercise.

Review prompts (3 in total, most discussed first):

• Remove redundant AI commands — LMCache/LMCache, AI
• Model precision matters — ollama/ollama, AI
• embedding provider configuration — Unstructured-IO/unstructured, AI

CI workflows and configuration files

• CI workflow linting — no tool detected in the sample. Catches: Broken GitHub Actions syntax, script injection, over-broad token permissions.
• File hygiene: pre-commit-hooks (50% of repos). Runs via pre-commit hook check-ast. Autofixes. Docs: https://github.com/pre-commit/pre-commit-hooks

Review prompts (31 in total, most discussed first):

• Externalize configuration values — chef/chef, Configurations
• Environment variable patterns — Unstructured-IO/unstructured, Configurations
• Avoid hard-coded configuration — openai/codex, Configurations
• Safe Configuration Handling — nousresearch/hermes-agent, Configurations
• Consistent env config — awslabs/agentcore-samples, Configurations
• Safe configuration defaults — karpathy/nanochat, Configurations
• optimize CI/CD pipelines — LMCache/LMCache, CI/CD
• Pin dependency versions — commaai/openpilot, Configurations
• Export environment variables once — nodejs/node, Configurations
• Environment-aware configuration testing — bazelbuild/bazel, Configurations
• Environment variable safety — Homebrew/brew, Configurations
• Use portable path configurations — ollama/ollama, Configurations

Dependencies and lockfiles

• Dependency audit — no tool detected in the sample. Catches: Known-vulnerable or disallowed dependencies and licenses.
• Lockfile consistency — no tool detected in the sample. Catches: A lockfile that no longer matches its manifest.
• Version and platform matrix — no tool detected in the sample. Catches: Breakage on a runtime version, OS or feature combination you did not run locally.

The tests themselves

• Mutation testing — no tool detected in the sample. Catches: Tests that keep passing whatever the code does.
• Version and platform matrix — no tool detected in the sample. Catches: Breakage on a runtime version, OS or feature combination you did not run locally.

Review prompts (2 in total, most discussed first):

• Write specific test assertions — bazelbuild/bazel, Testing
• Use proper testing frameworks — open-telemetry/opentelemetry-python, Testing

Documentation and comments

• Docs build — no tool detected in the sample. Catches: Broken cross-references, links and markup in documentation.
• Spelling — no tool detected in the sample. Catches: Typos in identifiers, comments and docs.

Source repositories

anthropics/claude-code, opengrep/opengrep

This site is open source. Improve this page.