/code-review skill: silent fallback to main...HEAD reviews other people's commits, and JSON-only output is hard to read

Summary

Two issues with the /code-review skill (used via the slash command in Claude Code):

1. Wrong diff scope on long-lived feature branches

The skill instructs the agent to run git diff @{upstream}...HEAD and fall back to main...HEAD only if there's no upstream. The fallback condition is too narrow: if @{upstream} is set but @{upstream}...HEAD is empty (branch is up-to-date with its remote), the agent has nothing to review and silently falls back to main...HEAD anyway. On a long-lived feature branch this pulls in commits authored by other people (merged-but-not-yet-on-main PRs) and reports "findings" in files the user never touched.

Repro:

• Check out a feature branch that's been alive for a few days, up-to-date with its remote.
• Have a few uncommitted edits in 2–3 files.
• Run /code-review medium.
• Observed: review covers ~24 files including others' merged PRs.
• Expected: review covers the ~3 working-tree files only.

Suggested fix: When @{upstream} is set, treat @{upstream}...HEAD empty + uncommitted changes as scope = git diff HEAD only. Don't fall back to main.

2. Raw JSON output is not user-readable

The skill's contract returns a JSON array of {file, line, summary, failure_scenario} to the chat. When a human is reading it (no --comment flag), the JSON is dense and slow to parse. The agent has to remember to translate it into prose; today that's not in the skill instructions.

Suggested fix: Add a step at the end: if no downstream consumer (e.g. --comment) is requested, render the findings as a short prose summary grouped by severity, with JSON optional/collapsible.

Environment

• Claude Code, Opus 4.7 (1M context)
• macOS