---

name: code-review description: "Comprehensive code review focusing on quality, security, performance, and best practices. Use when reviewing PRs, commits, or code changes." enabled: true visibility: default allowedTools: ["bash", "read", "grep", "glob"]

Code Review Skill

Perform thorough code reviews with focus on quality, security, and maintainability.

Review Process

1. Understanding Context

• Read the change description or PR details
• Understand the purpose of the changes
• Identify affected components and systems

2. Code Quality Check

• Readability: Clear variable/function names, proper indentation
• Maintainability: Modular design, DRY principle
• Complexity: Avoid overly complex logic
• Comments: Adequate documentation for non-obvious code
• Error Handling: Proper error cases covered

3. Security Review

• Input Validation: All user inputs sanitized
• SQL Injection: Use parameterized queries
• XSS: Proper output encoding
• Authentication/Authorization: Verify access controls
• Sensitive Data: No hardcoded credentials
• Dependencies: Check for known vulnerabilities

4. Performance Considerations

• Algorithms: Efficient data structures and algorithms
• Database: Optimized queries, proper indexing
• Caching: Appropriate use of caching
• Resource Management: Proper cleanup of resources
• Async Operations: Non-blocking where appropriate

5. Testing

• Coverage: Adequate test coverage for new code
• Edge Cases: Tests cover boundary conditions
• Error Scenarios: Tests verify error handling
• Integration: Tests verify system integration

6. Best Practices

• Language Standards: Follow language idioms
• Framework Conventions: Adhere to framework patterns
• Project Standards: Consistent with project style
• Documentation: README, API docs updated

Output Format

Provide feedback in this structure:

Copy## Code Review Summary

### 🎯 Overview
[Brief summary of changes and overall assessment]

### ✅ Strengths
- [Positive aspects of the code]

### ⚠️ Issues Found

#### Critical
- [Issues that must be fixed before merge]

#### Warning
- [Issues that should be addressed]

#### Info
- [Suggestions for improvement]

### 🔒 Security Considerations
[Security-specific findings]

### ⚡ Performance Notes
[Performance-related observations]

### 📋 Recommendations
[Actionable next steps]

Examples

Good Patterns

Copy# Proper error handling
if ! command -v tool &> /dev/null; then
    echo "Error: tool not found" >&2
    exit 1
fi

Anti-Patterns to Flag

Copy# Unsafe: No input validation
rm -rf "$USER_INPUT"

# Unsafe: Hardcoded credentials
API_KEY="secret123"

Checklist

Before completing review, verify:

• Code compiles/runs without errors
• Tests pass and coverage is adequate
• No security vulnerabilities introduced
• Performance implications considered
• Documentation updated
• Breaking changes documented
• Dependencies updated if needed