feat: add review skill + /altimate-code:review slash command

[sahrizvi]

Summary

Surfaces altimate-code's dbt/SQL PR reviewer via the plugin. The reviewer ships in the altimate-code CLI; this PR exposes it inside Claude Code so users can invoke it from their session.

Two invocation paths, both empirically verified:

• Natural language — "review my dbt changes" auto-fires the review SKILL via description matching. Verified: the model reads the SKILL body, invokes altimate-code review, and presents the signed verdict verbatim.
• Explicit slash command — /altimate-code:review dispatches the command body deterministically. Recommended for scripting / CI where natural-language phrasing shouldn't decide correctness.

Anti-fabrication guardrails in both bodies:

• Do not fall back to native git diff / Read as a "review" — those cannot check equivalence, lineage, or PII.
• Do not fabricate a verdict envelope; if the CLI fails, tell the user and stop.
• Never use --post interactively (writes to a real GitHub PR).
• Never use --mode gate interactively (exits non-zero).

The underlying reviewer agent in altimate-code denies edit/write tools; bash prompts for approval. Read-only by contract.

Test plan

• Step-zero: altimate-code review on a scratch dbt project with planted anti-patterns produces a real signed verdict envelope catching both planted bugs.
• Natural-language prompt ("review my dbt changes") auto-fires the SKILL and produces the same verdict verbatim, no fabrication.
• Slash command /altimate-code:review dispatches the command body and produces the same verdict.
• Renamed skills/altimate-code-review/ → skills/review/ and commands/altimate-review.md → commands/review.md for cleaner altimate-code:review namespace.
• Interactive TUI test — the SKILL description match should trigger the same behavior when the user types a review-shaped prompt in claude interactive mode.

Notes

• Naming: the skill and command both live under the altimate-code plugin, so the fully-qualified invocation is /altimate-code:review. The redundancy of "altimate-code" appearing twice is avoided.
• --bare mode disables plugin skill auto-discovery in Claude Code. This is documented and expected; the slash command remains available regardless of --bare.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Full review of the PR at 14738c3. The feature branch was rewritten since the prior review, so this is a fresh full pass over all three changed files rather than an incremental diff.

All three changes are descriptive content for a Claude Code plugin that delegates dbt/SQL PR review to the altimate-code review CLI:

• commands/review.md (new) and skills/review/SKILL.md (new) — slash command and skill bodies. Both carry robust anti-fabrication / anti-prompt-injection guardrails (no native git diff/Read fallback as a "review", no fabricated signed verdict envelopes, no interactive --post/--mode gate, untrusted-output handling) and consistent scope-selection, flag, and failure-mode tables.
• hooks-handlers/session-start.sh — single-line additionalContext update. The new string is a valid JSON string value (backticks, em-dashes, and parentheses are all legal JSON characters; no unescaped inner double-quotes; no stray % that the printf format string would misinterpret), and the single-quoted printf argument correctly prevents shell expansion of the backticks. Emitted output is well-formed JSON.

Per the custom redundancy/simplification check: the substantive overlap between the command and skill bodies (workflow, "never do these", useful flags, failure modes) is intentional — each is a self-contained invocation path per the PR design — and is not flagged as actionable.

Files Reviewed (3 files)

• plugins/altimate-code/commands/review.md
• plugins/altimate-code/hooks-handlers/session-start.sh
• plugins/altimate-code/skills/review/SKILL.md

Previous Review Summaries (2 snapshots, latest commit 77e4213)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit 77e4213)

Status: No Issues Found | Recommendation: Merge

Incremental review (2 new commits)

Reviewed the incremental diff from a0d94a3..77e4213, which updates the SessionStart hook context to advertise both plugin skills and tightens the review SKILL frontmatter with explicit dbt-file-type routing rules (prefer for models/**/*.sql, schema.yml, dbt_project.yml, sources.yml, snapshots/seeds .yml, Jinja macros; skip for TypeScript/Python/Go).

Both changes are descriptive prose: valid JSON inside the quoted heredoc (em-dashes, backticks, and apostrophes are all legal JSON string characters) and a valid YAML folded scalar with consistent indentation. No security, correctness, or logic issues were found in the changed lines.

Per the custom redundancy/simplification check: the file-type list appearing twice in the SKILL frontmatter (scope description vs. the "PREFER over generic code-review" routing rule) is intentional, and the prose overlap between the hook context and SKILL description is by design (self-contained routing paths). Not flagged as actionable.

Files Reviewed (2 files, incremental)

• plugins/altimate-code/hooks-handlers/session-start.sh
• plugins/altimate-code/skills/review/SKILL.md

Previous review (commit a0d94a3)

Status: No Issues Found | Recommendation: Merge

Files Reviewed (2 files)

• plugins/altimate-code/commands/review.md
• plugins/altimate-code/skills/review/SKILL.md

Both files are documentation defining a Claude Code plugin skill and slash command that delegate to the altimate-code review CLI. The bodies include robust anti-fabrication and anti-prompt-injection guardrails (no native git diff/Read fallback as a "review", no fabricated verdict envelopes, no interactive --post/--mode gate, untrusted-output handling) and consistent scope-selection, flag, and failure-mode tables. No security, correctness, or logic issues were found in the changed lines.

Per the custom redundancy/simplification check: the substantive content overlap between the command and skill bodies (workflow, "never do these", useful flags, failure modes) appears intentional — each is a self-contained invocation path per the PR design — and is not flagged as actionable.

---

_{Reviewed by glm-5.2 · Input: 57.6K · Output: 36.5K · Cached: 593.7K}