# simplify-and-harden-ci

A skill that reviews pull requests inside CI: it scans changed files, posts findings, and can stop a merge.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 389 installs · ★ 323
- Author: pskoett
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/pskoett/pskoett-ai-skills/tree/HEAD/skills/simplify-and-harden-ci/SKILL.md
- Updated: 2026-10-19
- HTML: https://affpapa.org/en/nevibecode/skills/simplify-and-harden-ci

## What it does

This skill runs a CI-only flavor of Simplify & Harden with no interactive approvals. It looks at the files a pull request touches and leaves the code alone — the output is a report, not a patch. Three passes run: simplify, harden, document. The first flags dead code, unclear names and needless abstraction; the second looks for missing input validation, injection paths, auth problems, exposed secrets and concurrency hazards; the third suggests comments for logic that is hard to follow.

Findings land in a PR comment, a check run summary and a YAML artifact keyed `simplify_and_harden`. Gate policy is yours to set: critical harden findings fail the check, and advisory classes can be made blocking too. A CI agent lacks the context of whoever wrote the change, so ambiguous findings belong in human review rather than an automatic rewrite.

You need GitHub Actions turned on, an authenticated GitHub CLI (`gh auth status`) and the `gh-aw` extension, added with `gh extension install github/gh-aw`. Inside jobs the CLI comes from the `github/gh-aw/actions/setup-cli@main` step at version `v0.2.0-beta`. The template sits in `references/workflow-example.md` and stays out of `.github/workflows` until you want automation live: a gh-aw workflow is markdown that `gh aw compile` turns into the `.lock.yml` GitHub Actions runs. Skip `gh aw compile --validate --strict` and there is nothing for Actions to execute.

## Requirements
- Works with: GitHub

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add pskoett/pskoett-ai-skills --skill simplify-and-harden-ci -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/simplify-and-harden-ci/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/simplify-and-harden-ci/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add pskoett/pskoett-ai-skills --skill simplify-and-harden-ci -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/simplify-and-harden-ci/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add pskoett/pskoett-ai-skills --skill simplify-and-harden-ci -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/simplify-and-harden-ci/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install pskoett/pskoett-ai-skills simplify-and-harden-ci
```

2. **Manually: put the files in place**
- File: `.github/skills/simplify-and-harden-ci/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add pskoett/pskoett-ai-skills --skill simplify-and-harden-ci -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/pskoett/pskoett-ai-skills --path skills/simplify-and-harden-ci
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/simplify-and-harden-ci/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add pskoett/pskoett-ai-skills --skill simplify-and-harden-ci -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/pskoett/pskoett-ai-skills/tree/HEAD/skills/simplify-and-harden-ci/SKILL.md

## When to use it
- review only the files a PR changed, with no code edits
- fail the check when critical security findings appear
- catch dead code and over-abstraction before a human reviewer
- produce a machine-readable findings artifact for automation
- route ambiguous findings to interactive review

## Example prompts
- Run simplify-and-harden-ci on this pull request in headless mode
- Review only the files changed in this PR and emit the `simplify_and_harden` report
- Compile the workflow with `gh aw compile --validate --strict`

## Similar
- [improve-codebase-architecture](https://affpapa.org/en/nevibecode/skills/improve-codebase-architecture.md) — skill · 1163035 installs
- [tdd](https://affpapa.org/en/nevibecode/skills/tdd.md) — skill · 1141062 installs
- [triage](https://affpapa.org/en/nevibecode/skills/triage.md) — skill · 990453 installs
- [codebase-design](https://affpapa.org/en/nevibecode/skills/codebase-design.md) — skill · 850344 installs
- [code-review](https://affpapa.org/en/nevibecode/skills/code-review.md) — skill · 789521 installs
- [implement](https://affpapa.org/en/nevibecode/skills/implement.md) — skill · 774700 installs

From the same set: [pskoett/pskoett-ai-skills](https://affpapa.org/en/nevibecode/by/pskoett/pskoett-ai-skills.md) — 7 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md