AI Code Review Prompts (free set)

Adversarial review prompts for AI-written code. Your agent wrote the diff in four minutes — it compiles, tests are green, and the summary sounds confident. None of that tells you what it broke.

Each prompt turns any strong code model (Claude, GPT/codex, etc.) into a hostile reviewer with one job: assume the diff is broken, and prove it. Findings come back in a fixed format — SEVERITY / LOCATION / FAILURE SCENARIO / MINIMAL REPRO — and praise is forbidden. "No findings" is only accepted together with a list of what was actually checked.

These came out of running Claude Code and Codex workers in parallel every day. The incidents behind them — what the agent claimed, what actually happened, and the gate that catches it next time — are at status.lifestep.io/incidents. The full set is The Adversarial Review Prompt Pack ($7), or the Complete Agent Ops Kit ($29) if you also want the CLAUDE.md rules, the task briefs and the file-ownership map that keep the diff reviewable in the first place; what is here stays free and MIT either way.

The 5 free prompts

#	Prompt	Hunts for
01	Correctness (master gate)	the flagship adversarial review — run this before any merge
05	Security: injection	SQLi, XSS, command injection, path traversal
12	Test quality	tests that cannot fail, lying mocks, coverage theater
13	Shell & CI exit-code traps	pipefail/PIPESTATUS, silent-green CI, quoting, portability
22	Agent-output verification	a worker claims DONE — audit the diff against its brief

How to run (non-interactive)

git diff main...HEAD > /tmp/diff.txt
claude -p "$(sed -n '/```text/,/```/p' prompts/01_correctness-general.md | sed '1d;$d')

<DIFF>
$(cat /tmp/diff.txt)"

Works the same with codex exec or any CLI that accepts a prompt. Model-agnostic.

The full pack (25 prompts)

The complete set adds: concurrency/races, error handling & partial failure, authz/IDOR, secrets & logging, performance hot paths, DB migration safety, API compatibility, frontend regressions, dependency upgrades, refactoring equivalence, scope creep, LLM-app prompt injection & token cost, data pipelines, infra/config, git hygiene, rollback/deploy safety, docs drift, and a two-model second-opinion protocol — plus a 55-page PDF with a severity rubric, triage order, and a "reject the whole diff" checklist (EN + Korean guide).

→ $7 on Gumroad

Reviewing the diff is the last gate. Most of what these prompts catch was avoidable earlier — an underspecified brief, a worker with no change-scope limit, two workers editing the same file. The Complete Agent Ops Kit ($29) covers those too: this pack in full, plus 30 CLAUDE.md rules, task-brief and file-ownership templates, the deploy/rollback gate, and Solo, Like a Team in English and Korean. The same files bought as separate products: $49.

Related: agent-watch (stall detection for background agents) · Solo, Like a Team — Claude Code Multi-Agent Orchestration in Practice (the book these come from) · free orchestration templates

License

The 5 prompt files in this repository are MIT licensed — use them anywhere, including commercially. The paid pack has its own terms.

Related free tools

• CLAUDE.md Auditor - paste your rules file and see which rules an agent cannot reliably follow
• XLSX Inspector — check workbooks for macros, external links and hidden sheets
• DNS and SPF Check — records, SPF, DMARC and TLS expiry
• Email Validator — syntax, MX, disposable and role addresses
• QR Code Generator — free PNG and SVG API, no signup
• agent-watch
• claude-md-patterns
• claude-code-orchestration-ko
• xlsx-inspector-api
• domain-info-api
• email-validator-api
• qr-code-api
• Agent Ops for VS Code - review prompts and agent rules in the Command Palette (VSIX install)
• Go Exec Format Doctor Action - CI gate for binary architecture mismatches

The paid guide collection is available at lifestep1.gumroad.com.