---
id: review-like-a-red-team
track: coding
version: 0.0.1
label: advisory
keyword: advise
where: text
sha256: 279a8c76cc582630f3a76670844faaf06da17b0f1896ba6ad21b086dcc177bf7
source: https://github.com/open-coder-ai/chock-catalog/tree/1e60d211c1bb767152c6ab0167932da06ab3a10f/base/review-like-a-red-team
catalog_ref: 1e60d211c1bb767152c6ab0167932da06ab3a10f
---

# Review Like a Red Team

review-like-a-red-team · version 0.0.1

Advisory — Advisory only. It is skill text, and nothing stops a violation. Chock adds friction. It is not a security boundary. 

In a git repo: advisory (The agent reads the text, and nothing stops a violation.)



## What it does

Trigger: finishing or committing a diff that touches code, build or CI config, dependencies or agent config; a plan adding a handler, parser, auth path, crypto or sink; an ask-tier gate finding. Self-review of the diff in twelve red-team techniques, triaged by references/triage.json, reported as findings with exploit scenarios. Advisory: refuses nothing, writes no waiver, lowers no gate.

## Its label on each agent

- Claude Code (tested): Advisory — Advisory only. It is skill text, and nothing stops a violation. Builder: /coding/builder/#client=claude-code&p=review-like-a-red-team
- Cursor (tested): Advisory — Advisory only. It is skill text, and nothing stops a violation. Builder: /coding/builder/#client=cursor&p=review-like-a-red-team
- Codex (tested): Advisory — Advisory only. It is skill text, and nothing stops a violation. Builder: /coding/builder/#client=codex&p=review-like-a-red-team
- GitHub Copilot (tested): Advisory — Advisory only. It is skill text, and nothing stops a violation. Builder: /coding/builder/#client=copilot&p=review-like-a-red-team
- Devin (tested): Advisory — Advisory only. It is skill text, and nothing stops a violation. Builder: /coding/builder/#client=devin&p=review-like-a-red-team
- Grok (tested): Not graded yet for Grok. Builder: /coding/builder/#client=grok&p=review-like-a-red-team
- goose (tested): Not graded yet for goose. Builder: /coding/builder/#client=goose&p=review-like-a-red-team
- Antigravity (tested): Not graded yet for Antigravity. Builder: /coding/builder/#client=antigravity&p=review-like-a-red-team
- OpenHands (untested): Not graded yet for OpenHands. Builder: /coding/builder/#client=openhands&p=review-like-a-red-team
- Kimi Code (untested): Not graded yet for Kimi Code. Builder: /coding/builder/#client=kimi-code&p=review-like-a-red-team
- Factory Droid (untested): Not graded yet for Factory Droid. Builder: /coding/builder/#client=factory-droid&p=review-like-a-red-team

## What it misses

This policy does not state what it misses.

## Latest change

0.0.1 · 2026-10-02 — Initial advisory companion skill (record 12 SK, plan D14): the twelve review techniques as a self-review over the diff, consuming ask-tier gate findings and the EP-17 triage table shipped as references/triage.json. No gate: it refuses nothing.

## Provenance

- Tested by 0 of 16 cases run automatically
- SHA-256: `279a8c76cc582630f3a76670844faaf06da17b0f1896ba6ad21b086dcc177bf7`
- Catalog commit: https://github.com/open-coder-ai/chock-catalog/commit/1e60d211c1bb767152c6ab0167932da06ab3a10f
- Source: https://github.com/open-coder-ai/chock-catalog/tree/1e60d211c1bb767152c6ab0167932da06ab3a10f/base/review-like-a-red-team (catalog path `base/review-like-a-red-team`)
- Presets: Safety guidance
- JSON: `/api/coding/policies/review-like-a-red-team.json`
- Report a problem: https://chock.sh/report/?policy=review-like-a-red-team&version=0.0.1&page=%2Fcoding%2Fpolicies%2Freview-like-a-red-team%2F