Ponytail Review

Quality review of a diff: bugs, security, real load, missing tests, speed, and what to delete. Each finding says what goes wrong and how to fix it.

181,225 stars 9,958 forksSecurity Plugin marketplace

Install

Claude Code plugin

/plugin marketplace add DietrichGebert/ponytail

The repo is a Claude Code plugin marketplace. Run /plugin afterwards to pick the plugin that includes this skill.

skills CLI (Claude Code, Cursor, Codex and more)

npx skills add DietrichGebert/ponytail --skill ponytail-review

Manual install

git clone --depth 1 https://github.com/DietrichGebert/ponytail.git /tmp/ponytail
mkdir -p ~/.claude/skills
cp -r /tmp/ponytail/.openclaw/skills/ponytail-review ~/.claude/skills/ponytail-review

Personal skills live in ~/.claude/skills. Use .claude/skills in a project folder to share a skill with your team.

From the SKILL.md

Review a change like the senior developer who will be paged when it breaks.
Order of importance: correct, safe, holds under load, tested, fast, lean.
Lean still matters: every extra line must be read, tested and fixed later.
This is a report the user asked for, so give it in full.

## 1. Understand first

- Review what the user names: uncommitted or staged changes, a branch, a PR
  link, or files. Nothing named: the uncommitted changes, or the last commit
  if there are none.
- Read the diff, then the code it touches: callers of every changed function,
  the functions it calls, the tests, the README.
- Trace the real flow: where data comes in, what is stored, what goes out.
- A change can break code it does not touch. When a signature, return value
  or behavior changes, grep every caller.
- Find the expected load in the repo (README, deploy config): one person
  running a script, or many users and processes at once. Judge scale against
  that, and say which load you assumed.

## 2. Look for

1. **Bug:** wrong result, crash, missed edge case (empty, zero, last item,
   rounding, time zones), a caller broken by the change, a fix applied in one
   caller while the shared function stays broken.
2. **Risk:** security holes (injection, weak randomness, secrets, missing
   checks on input from users), data loss (errors swallowed, writes in the
   wrong order, no transaction).
3. **Scale:** fine for one user, wrong for many: check-then-write races, the

Read the full skill on GitHub

Details

Skill name: ponytail-review
Repository: DietrichGebert/ponytail
Path: .openclaw/skills/ponytail-review/SKILL.md
License: MIT
Repo updated: 29 October 2026

FAQ

What does the Ponytail Review skill do?

Quality review of a diff: bugs, security, real load, missing tests, speed, and what to delete. Each finding says what goes wrong and how to fix it.

How do I install the Ponytail Review skill?

Claude Code plugin: /plugin marketplace add DietrichGebert/ponytail. Skills go in ~/.claude/skills (personal) or .claude/skills (project), and Claude loads them automatically when a task matches the description.

Is Ponytail Review popular?

It lives in DietrichGebert/ponytail, which has 181,225 GitHub stars and 9,958 forks.

Related skills

Ponytail

181k

DietrichGebert/ponytail

Lazy senior dev mode for any coding task: the smallest change that fully solves it, and a reply a busy human understands in one read.

Productivity & Notes10k

Ponytail

181k

DietrichGebert/ponytail

Lazy senior dev mode: the smallest change that fully solves the task, and a reply a busy human understands in one read. Use on any coding task (writing, fixing, refactoring, reviewing, choosing dependencies) and when the user says "ponytail", "be lazy", "simplest solution", "yagni", or complains about over-engineering or bloat. Levels: lite, full (default), ultra.

Productivity & Notes10k

Ponytail Audit

181k

DietrichGebert/ponytail

Quality audit of the whole repo: bugs, security, real load, missing tests, speed, and what to delete. Most important first.

Security10k

Gke Basics

22k

google/skills

Manages core GKE cluster provisioning, credentials, Autopilot vs Standard selection, and workload deployment. Use when creating GKE clusters, fetching kubectl credentials, or deciding between Autopilot and Standard modes. Don't use for Workload Identity (use gke-workload-identity), GKE networking (use gke-networking), security hardening (use gke-platform-security or gke-workload-security), or cluster upgrades (use gke-upgrades).

SecurityIn 2 lists1.8k

Google Cloud Waf Security

22k

google/skills

Generates security-focused guidance for Google Cloud workloads based on the design principles and recommendations in the Google Cloud Well-Architected Framework (WAF). Use this skill to evaluate workloads, identify security requirements, and provide actionable recommendations for IAM, network security, data protection, and operational security.

SecurityIn 2 lists1.8k

Springboot Verification

294k

affaan-m/ECC

Verification loop for Spring Boot projects: build, static analysis, tests with coverage, security scans, and diff review before release or PR.

SecurityIn 1 list43k

Browse the most popular Claude skills, all security skills, or write your own with the skills generator.