Bitwarden Code Review

Skill 6 of 66

Classifying Review Findings

Use this skill when categorizing code review findings into severity levels.

1 minute · 267 words · 4 sections

Install

$ npx skills add bitwarden/ai-plugins --skill classifying-review-findings

$ npx skills add bitwarden/ai-plugins

» /plugin marketplace add bitwarden/ai-plugins

The first command installs just this skill, by the name in its SKILL.md; the second installs the whole repository.

Severity Categories

Emoji	Category	Criteria
❌	CRITICAL	Will break, crash, expose data, or violate requirements
⚠️	IMPORTANT	Missing error handling, unhandled edge cases, could cause bugs
♻️	DEBT	Duplicates patterns, violates conventions, needs rework within 6 months
🎨	SUGGESTED	Measurably improves security, reduces complexity by 3+, eliminates bug classes
❓	QUESTION	Requires human knowledge - unclear requirements, intent, or system conflicts

ALWAYS use hybrid emoji + text format for each finding (if multiple severities apply, use the most severe: ❌ > ⚠️ > ♻️ > 🎨 > ❓):

Before Classifying

Verify ALL three:

Can you trace the execution path showing incorrect behavior?
Is this handled elsewhere (error boundaries, middleware, validators)?
Are you certain about framework behavior and language semantics?

If any answer is “no” or “unsure” → DO NOT classify as a finding.

Not Valid Findings (Reject)

Praise (“great implementation”)
Vague suggestions (“could be simpler”)
Style preferences without enforced standard
Naming nitpicks unless actively misleading
PR metadata issues (title, description, test plan) - handled by summary skill, not classified here
Renovate/Dependabot minor/patch updates to existing dependencies with passing CI — these are routine Stage 5 monitoring, not reviewable findings

Suggested Improvements (🎨) Criteria

Only suggest improvements that provide measurable value:

Security gain - Eliminates entire vulnerability class (SQL injection, XSS, etc.)
Complexity reduction - Reduces cyclomatic complexity by 3+, eliminates nesting level
Bug prevention - Makes entire category of bugs impossible (type safety, null safety)
Performance gain - Reduces O(n²) to O(n), eliminates N+1 queries (provide evidence)

Provide concrete metrics:

❌ “This could be simpler”
✅ “This has cyclomatic complexity of 12; extracting validation logic would reduce to 6”

If you can’t measure the improvement, don’t suggest it.

About this skill

Trigger

Use this skill when categorizing code review findings into severity levels. Apply when determining which emoji and label to use for PR comments, deciding if an issue should be flagged at all, or classifying findings as CRITICAL, IMPORTANT, DEBT, SUGGESTED, or QUESTION.

The verbatim description from this skill’s front matter — the string an agent matches on to decide whether to load it.

Colophon for this issue

Colophon

How this issue was made

Source

github.com/bitwarden/ai-plugins, branch main, last pushed 24 September 2026.

Licence

Other — the text of every skill is reproduced unmodified, frontmatter included, under the upstream licence.

Discovery

66 skills found by walking the repository tree for SKILL.md, not by matching a directory convention. 13 distinct layouts observed: plugins/bitwarden-atlassian-tools/skills/*/SKILL.md, plugins/bitwarden-code-review/skills/*/SKILL.md, plugins/bitwarden-delivery-tools/skills/*/SKILL.md, plugins/bitwarden-design-tools/skills/*/SKILL.md, plugins/bitwarden-designer/skills/*/SKILL.md, plugins/bitwarden-devops-engineer/skills/*/SKILL.md, plugins/bitwarden-product-analyst/skills/*/SKILL.md, plugins/bitwarden-security-engineer/skills/*/SKILL.md, plugins/bitwarden-shepherd/skills/*/SKILL.md, plugins/bitwarden-tech-lead/skills/*/SKILL.md, plugins/bitwarden-testing-tools/skills/*/SKILL.md, plugins/claude-config-validator/skills/*/SKILL.md, plugins/claude-retrospective/skills/*/SKILL.md.

Issue colours

Resolved from a deterministic hash of the owner name. Two accent tones are generated per issue and each is proven against its own ground before it ships: a single accent that passes AA on both light and dark paper is arithmetically impossible.

Heading repairs

1 repair applied to this skill so the document has one h1 and no skipped levels:

Removed “Classifying Review Findings”, a leading h1 that duplicated the skill title.

Spec compliance

10 editorial notes across 5 of 66 skills. They are printed in the margin of each skill rather than as errors here.

Images

Images inside a skill come from the upstream repository. Where the author gave no alternative text we mark the image decorative rather than inventing a description — a plausible caption we made up is worse than none for the reader who depends on it.

Marketplace

A plugin manifest is published at .claude-plugin/marketplace.json by Bitwarden, declaring 16 plugins. It is read for editorial metadata only — never as the skill index, which is always the repository tree.

Signal

Install counts come from skills.sh. They measure downloads, not quality, and an unranked repository is not an unread one.

Agent surfaces

The whole issue is available as one markdown document at /bitwarden/ai-plugins.md, and each skill at its own .md URL.

Publication

Set by Skills Docs from the source repository. Body text is Literata at the reader’s chosen size and measure; code is Geist Mono. Nothing on this page was written by us except this paragraph.

Severity Categories

Emoji	Category	Criteria
❌	CRITICAL	Will break, crash, expose data, or violate requirements
⚠️	IMPORTANT	Missing error handling, unhandled edge cases, could cause bugs
♻️	DEBT	Duplicates patterns, violates conventions, needs rework within 6 months
🎨	SUGGESTED	Measurably improves security, reduces complexity by 3+, eliminates bug classes
❓	QUESTION	Requires human knowledge - unclear requirements, intent, or system conflicts

ALWAYS use hybrid emoji + text format for each finding (if multiple severities apply, use the most severe: ❌ > ⚠️ > ♻️ > 🎨 > ❓):

Before Classifying

Verify ALL three:

Can you trace the execution path showing incorrect behavior?
Is this handled elsewhere (error boundaries, middleware, validators)?
Are you certain about framework behavior and language semantics?

If any answer is “no” or “unsure” → DO NOT classify as a finding.

Not Valid Findings (Reject)

Praise (“great implementation”)
Vague suggestions (“could be simpler”)
Style preferences without enforced standard
Naming nitpicks unless actively misleading
PR metadata issues (title, description, test plan) - handled by summary skill, not classified here
Renovate/Dependabot minor/patch updates to existing dependencies with passing CI — these are routine Stage 5 monitoring, not reviewable findings

Suggested Improvements (🎨) Criteria

Only suggest improvements that provide measurable value:

Security gain - Eliminates entire vulnerability class (SQL injection, XSS, etc.)
Complexity reduction - Reduces cyclomatic complexity by 3+, eliminates nesting level
Bug prevention - Makes entire category of bugs impossible (type safety, null safety)
Performance gain - Reduces O(n²) to O(n), eliminates N+1 queries (provide evidence)

Provide concrete metrics:

❌ “This could be simpler”
✅ “This has cyclomatic complexity of 12; extracting validation logic would reduce to 6”

If you can’t measure the improvement, don’t suggest it.