caveman-review (JuliusBrussee/caveman)
caveman-review: shifts code reviews toward short per-finding lines (control 3.3, skill 4.2, one-liner 4.8) at the same tokens, but the skill's own L<line> line format was followed in only some runs; a one-sentence prompt of the format scores higher
25.1 / 30
Lift over no skill: +0.90
Situational: the lift +0.90 is under +1.0. Recommended needs a total of 22/30, output quality of 3.5, and a lift of +1.0.
SOTA
PassTested with Codex.
Covers Codex, Claude Code
Codex CLI 0.166 (SOTA tier): 18 graded runs. A pass here also covers Claude Code under our tier rule; it says nothing about the second tier.
Scores
Each dimension is 0 to 5 and the six add up to the total out of 30. 5 is better on every dimension. Cost 5 means cheap and fast. Install 5 means easy.
- Trigger reliability
- 5.0
- Lift over no skill
- 2.9
- Output quality
- 4.2
- Token and time cost
- 5.0
- Install and portability
- 4.0
- Safety
- 4.0
Security review
SafeStatic scan: 0 CRITICAL / 0 HIGH / 0 MEDIUM. Manual review: Safe to run in a no-network sandbox (no findings). A clean scan does not prove a skill safe.
Install
npx skills@latest add JuliusBrussee/caveman --skill caveman-review
Pinned commit: 9b68f7ed12b05e7efaff18e65c5a3fc2849fd0a4
Tested: 2026-11-02
What we tested
- Review a small service module — Review orders_service.py before I merge it. List the problems you find, most serious first. Do not change any files.
- Review an auth helper — Review auth_handlers.py: I just wrote it for our login flow. List the problems, most serious first. Do not change any files.
- Review the latest commit against written standards and spec — Review my latest commit (the changes since HEAD~1) against CODING_STANDARDS.md and SPEC.md. List every deviation, most serious first. Do not change any files.
Pros
- Lifts the mean score from 3.26 to 4.16 over no skill (+0.90).
- The skill was picked up without being named: Skill file read in 6/6 treatment runs.
- No token overhead: 1.02x the tokens of no skill.
Cons
- A one-sentence prompt scored 4.83, against 4.16 with the skill (-0.67).
- n=2 per task per arm; differences under about 1 point are noise.
Review
Codex CLI 0.166 (gpt-6-astra, low reasoning) on a dedicated Windows test PC, a fresh temporary project and temporary HOME/TMPDIR/caches per run, skill installed (treatment) or absent (control) or absent with the skill's core requirement squeezed into one sentence appended to the prompt (one-liner group), 2 runs per group per task, network off, /tmp writes blocked. The prompts never mention the skill (except the wording noted below). Three review tasks on small Python files with 8 planted issues each: an orders service (SQL injection, missing authorization, hard-coded key logged, float money and others), an auth handler file, and a review of the latest commit against CODING_STANDARDS.md and SPEC.md. Prompts ask for a review, most serious first, no changes. The one-liner states the line format and the no-hedging rule.
Three-arm comparison
| Arm | Mean score (0-5) | Tokens per run |
|---|---|---|
| Without the skill | 3.26 | 69k |
| One-sentence prompt | 4.83 | 60k |
| With the skill | 4.16 | 70k |
Measured with Codex CLI over 18 runs, scored by rule-based checks with no LLM judge. Total 25.1 / 30, verdict Situational.
Verdict: Situational (25.1 / 30). Source: JuliusBrussee/caveman, skills/caveman-review, pinned at commit 9b68f7e. Install: npx skills@latest add JuliusBrussee/caveman --skill caveman-review. Licence: MIT (repo LICENSE).
What it is
The caveman-review skill (JuliusBrussee/caveman): a terse code-review style: one finding per line as L<line>: <problem>. <fix>. with an optional severity prefix (bug, risk, nit, q), exact symbol names in backticks, a concrete fix, and no hedging, praise or restating what the code does.
How we tested
Codex CLI 0.166 (gpt-6-astra, low reasoning) on a dedicated Windows test PC, a fresh temporary project and temporary HOME/TMPDIR/caches per run, skill installed (treatment) or absent (control) or absent with the skill's core requirement squeezed into one sentence appended to the prompt (one-liner group), 2 runs per group per task, network off, /tmp writes blocked. The prompts never mention the skill (except the wording noted below).
Three review tasks on small Python files with 8 planted issues each: an orders service (SQL injection, missing authorization, hard-coded key logged, float money and others), an auth handler file, and a review of the latest commit against CODING_STANDARDS.md and SPEC.md. Prompts ask for a review, most serious first, no changes. The one-liner states the line format and the no-hedging rule.
- Review a small service module — Review orders_service.py before I merge it. List the problems you find, most serious first. Do not change any files.
- Review an auth helper — Review auth_handlers.py: I just wrote it for our login flow. List the problems, most serious first. Do not change any files.
- Review the latest commit against written standards and spec — Review my latest commit (the changes since HEAD~1) against CODING_STANDARDS.md and SPEC.md. List every deviation, most serious first. Do not change any files.
Scoring is programmatic (hidden tests / planted-issue recall / constraint checks / render+OCR where relevant), 0–5 per run. No LLM judge decided any score.
Results
The one-liner given to the third group: "Write each finding as one line L<line>: <problem>. <fix>. with an optional severity prefix (bug, risk, nit, q), exact symbol names in backticks and a concrete fix; no hedging, praise or throat-clearing, and do not restate what the code does."
| Task | Control score | One-liner | With skill | Control tokens | One-liner tokens | With-skill tokens | Skill read |
|---|---|---|---|---|---|---|---|
| t1-orders | 3.06 | 4.66 | 4.15 | 74k | 64k | 61k | 2/2 |
| t2-auth | 3.19 | 4.92 | 3.31 | 73k | 64k | 88k | 2/2 |
| t3-diff | 3.53 | 4.92 | 5.0 | 59k | 50k | 60k | 2/2 |
Mean score: 3.26 without vs 4.16 with the skill (delta +0.9). Tokens per run: 69k vs 70k (1.02x); time 56s vs 54s. One-liner group: 4.83 (the skill's gain over the one-liner: -0.67; one-liner's own gain over no skill: +1.57); one-liner tokens 60k per run, so the skill costs 1.17x the one-liner.
What happened
- Control 3.26, skill 4.16, one-liner 4.83 (n=6 each). Finding the planted issues is similar for all arms (5-7 of 8, with the missing-rate-limit issue missed by almost every run); the differences are mainly in format and length.
- Format: control did not use the
L<n>:line format in any of its 6 runs (its orders review is a numbered list with a bold severity). The skill met the format in the commit-review task (5.0 in both runs) and in one orders run, but in the auth task its lines begin with a number and a bold severity, so the format check failed in 2/2 and the score stayed at 3.3. The one-liner passed in nearly all. - Brevity: control reviews ran 233-332 words on the orders and auth tasks (full marks at 220 words); the skill's auth reviews were also about 300 words, while the one-liner stayed under the limit in nearly all runs.
- No arm used hedging phrases. Tokens: skill 70k, one-liner 60k, control 69k per run (1.01x control). The skill was read in 6/6 treatment runs.
Dimension scores
| Dimension | Score | Why |
|---|---|---|
| 1_output_quality | 4.16 | Mean score 4.16/5 with the skill (programmatic checks, see per-task table). |
| 2_lift_vs_no_skill | 2.9 | +0.90 points vs 3.26 without the skill (n=2 per task; under ~1 point is noise). |
| 3_trigger | 5.0 | Skill file read in 6/6 treatment runs. |
| 4_instructions_portability | 4 | SKILL.md only. |
| 5_efficiency | 5 | 1.02x tokens (70k vs 69k per run) and 0.96x time (54s vs 56s). |
| 6_safety_hygiene | 4 | Prose only; see security.md. |
Limits of this test
- Rule-based checks on the final message: recall of planted issues, a line-start regex for the L<n> format, a word count, and a hedging-phrase list. The quality of the fixes was not judged.
- The format regex is strict about the start of each line; a bullet such as '- L17 - High: ...' counts as matching but a numbered list with bold severity does not.
- One check ('did not modify files') passed everywhere and is not shown.
- n=2 per cell; small files.
- n = 2 per group per task: differences under about 1 point are noise.
- Rule-based scoring measures what the checks can see; it cannot judge taste or whether a result is the best possible.
Security
See security.md. Scan: 0 CRITICAL / 0 HIGH / 0 MEDIUM. Verdict: safe to run (no-network sandbox). A clean scan does not prove a skill safe.
Bottom line
The skill moves a review towards the terse one-finding-per-line style and keeps the same coverage at no extra cost, but it does not always keep to the format. A single sentence describing the format worked better here, so the benefit is over no guidance, not over a good prompt.
Transcript
Run log for caveman-review: Codex CLI, network off, per-run temp HOME/TMPDIR, one row per graded run. Columns: task, arm-run, score (0-5), tokens, seconds, checks passed, skill files the agent opened. t1-orders control-1: score 3.02, tokens 65430, secs 62.1, checks 4/5, opened nothing t1-orders control-2: score 3.1, tokens 82622, secs 61.8, checks 4/5, opened nothing t1-orders oneliner-1: score 4.66, tokens 64873, secs 59.1, checks 5/5, opened nothing t1-orders oneliner-2: score 4.66, tokens 64681, secs 49.6, checks 5/5, opened nothing t1-orders treatment-1: score 4.83, tokens 50257, secs 52.3, checks 5/5, opened caveman-review t1-orders treatment-2: score 3.47, tokens 72971, secs 62.1, checks 4/5, opened caveman-review t2-auth control-1: score 3.3, tokens 82305, secs 67.1, checks 4/5, opened nothing t2-auth control-2: score 3.08, tokens 64757, secs 55.3, checks 4/5, opened nothing t2-auth oneliner-1: score 5.0, tokens 64677, secs 57.0, checks 5/5, opened nothing
18 runs, 3 artifacts
Sample output
SOTA · With the skill: final message (t1-orders, run 1, Codex)
- L17 — **High: Missing authorization.** `cancel_order` ignores `current_user`, allowing cancellation of another user’s order by ID (CWE-862). Require ownership or explicit administrative permission before updating. - L9 — **High: SQL injection.** `order_id` is interpolated directly into SQL; input such as `0 OR 1=1` changes the query and can retrieve an unrelated order (CWE-89). Use `WHERE id = ?` with bound parameters. - L4, L48 — **High: Credential exposure.** `API_KEY` is hardcoded and included in the successful-charge log, exposing it through source access and logs (CWE-798/CWE-532). Load it from a secret store, remove it from logs, and rotate it if genuine. - L47–55 — **High:** Every `charge` call reaches `NotImplementedError`, which is swallowed into `None`; no payment can succeed. Implement `send_to_gateway` and surface explicit payment failures. - L24, L26 — **Medium:** Discount thresholds contradict the docstring: exactly 100 receives no discount, and exactly 500 receives only 10%. Change both comparisons to `>=`. - L39–41 — **Medium:** Opening the export with `"w"` truncates an existing file before querying or serializing succeeds. Prepare the export first, then write through a temporary file and replace the destination. - L39–42 — **Medium:** The export file is never explicitly flushed or closed; completion depends on object cleanup. Use `with open(...)` so writes and closure complete before returning.