Skip to main content سوق المهارات اكتشف واستكشف مهارات الذكاء الاصطناعي التي بناها المجتمع.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
عرض تفاصيل Prompt يتجاوز الأمر المباشر Prompt المخصّص للمراجعة. افحص المصدر قبل تشغيله.
npx skills add https://github.com/diegosouzapw/awesome-omni-skill --skill code-review-agentيبقى الأمر في سطر واحد. مرّر أفقيًا لمراجعته كاملًا قبل النسخ.
تفضّل نسخة محلية؟ نزّل الملفات المتاحة حاليًا لدى SkillsMP.
تحميل Zip جاري التحميل... المهن ذات الصلة SOC
استنادا إلى تصنيف SOC المهني
name code-review-agent description Comprehensive security and quality code review agent that checks for OWASP vulnerabilities, GDPR compliance, accessibility standards, and code quality issues.
Code Review Agent
Purpose
The Code Review Agent performs comprehensive automated code review analyzing implementations for:
Security Vulnerabilities - OWASP Top 10 complianceCode Quality - Anti-patterns, optimization opportunitiesGDPR Compliance - Data privacy, consent management, user rightsAccessibility - WCAG 2.1 AA standards compliance
When to Use This Skill
Invoke the code review agent:
After Development Stage - Review Developer A and Developer B implementationsBefore Arbitration - Ensure both solutions meet quality/security standardsBefore Production Deployment - Final security and compliance checkOn-Demand Reviews - Security audit of existing codebase
Responsibilities
1. Security Analysis (OWASP Top 10)
Detects all OWASP Top 10 (2021) vulnerabilities:
A01 - Broken Access Control - Authorization bypasses, IDOR vulnerabilitiesA02 - Cryptographic Failures - Weak encryption, hardcoded secretsA03 - Injection - SQL, command, XSS, template injectionA04 - Insecure Design - Missing security controls, threat modeling gapsA05 - Security Misconfiguration - Default credentials, unnecessary featuresA06 - Vulnerable Components - Outdated dependencies, known CVEs
A07 - Authentication Failures
A08 - Integrity Failures - Unsigned updates, insecure deserialization
A09 - Logging Failures - Missing audit logs, insufficient monitoring
A10 - SSRF - Unvalidated URL requests
cursor.execute(f"SELECT * FROM users WHERE id={user_id} " )
cursor.execute("SELECT * FROM users WHERE id=?" , (user_id,))
2. Code Quality Review Identifies anti-patterns and optimization issues:
God Objects (too many responsibilities)
Spaghetti Code (tangled control flow)
Magic Numbers/Strings
Duplicate Code (DRY violations)
Long Methods (>50 lines)
Deep Nesting (>3 levels)
Tight Coupling
Inefficient algorithms (O(n²) vs O(n))
N+1 database query problems
Missing caching
Memory leaks (unclosed resources)
Blocking I/O in async contexts
3. GDPR Compliance Ensures data privacy and regulatory compliance:
Required Implementations:
✅ Data minimization (Article 5)
✅ Consent management (Article 6, 7)
✅ Right to access (Article 15)
✅ Right to erasure (Article 17)
✅ Data portability (Article 20)
✅ Privacy by design (Article 25)
✅ Breach notification (Article 33, 34)
✅ Data Processing Agreements (Article 28)
def delete_user (user_id ):
4. Accessibility (WCAG 2.1 AA) Validates compliance with WCAG 2.1 Level AA:
Text alternatives (alt attributes)
Captions for media
Semantic HTML structure
Color contrast ≥4.5:1
Resizable text (200%)
Keyboard accessible
No keyboard traps
Adjustable timing
No flashing content
Skip navigation links
Language specified (lang attribute)
Predictable navigation
Input error identification
Form labels
Valid HTML
ARIA roles/properties
Status messages
<img src ="chart.png" >
<img src ="chart.png" alt ="Monthly revenue chart showing 15% growth" >
Review Process
1. Input
Developer implementation directory (/tmp/developer-a/ or /tmp/developer-b/)
Task context (title, description)
ADR for architectural decisions
2. Analysis Uses LLM APIs (OpenAI/Anthropic) to:
Parse all implementation files (.py, .js, .html, .css, etc.)
Analyze against OWASP, GDPR, WCAG standards
Detect code quality issues and anti-patterns
Generate categorized findings with severity levels
3. Output {
"review_summary" : {
"overall_status" : "PASS|NEEDS_IMPROVEMENT|FAIL" ,
"total_issues" : 15 ,
"critical_issues" : 0 ,
"high_issues" : 3 ,
"medium_issues" : 8 ,
"low_issues" : 4 ,
"score" : {
"code_quality" : 85 ,
"security" : 75 ,
"gdpr_compliance" : 90 ,
"accessibility" : 80 ,
"overall" : 82
}
} ,
"issues" : [
{
"category" : "SECURITY" ,
"subcategory" : "A03:2021 - SQL Injection" ,
"severity" : "HIGH" ,
"file" : "database.py" ,
"line" : 45 ,
"description" : "..." ,
"recommendation" : "..." ,
"owasp_reference" : "..."
}
]
}
Overall assessment
Category scores
Critical/High issues detailed
Positive findings
Actionable recommendations
Severity Levels Severity Criteria Examples CRITICAL Security breach risk, GDPR fine risk (€20M), accessibility blocker SQL injection, exposed secrets, missing data deletion HIGH Significant vulnerability, major compliance gap Weak encryption, missing consent, inaccessible forms MEDIUM Code quality issue, minor security concern God objects, missing CSRF tokens, low contrast LOW Style/convention, optimization opportunity Magic numbers, inefficient algorithm
Decision Criteria PASS (Implementation acceptable):
0 critical issues
≤2 high issues
Overall score ≥80
NEEDS_IMPROVEMENT (Can proceed with warnings):
0 critical issues
≤5 high issues
Overall score ≥60
FAIL (Must fix before proceeding):
Any critical issues
5 high issues
Overall score <60
Integration with Pipeline
Placement in Pipeline Development Stage (Developer A + B)
↓
📋 Code Review Agent ← NEW STAGE
↓
Validation (TDD checks)
↓
Arbitration (Select winner)
↓
Integration
Communication
Implementation files from developers
Task context from orchestrator
ADR from architecture agent
Review report to orchestrator
Issues list to validation agent
Pass/Fail status to arbitration agent
Usage Examples
Standalone Usage python3 code_review_agent.py \
--developer developer-a \
--implementation-dir /tmp/developer-a/ \
--output-dir /tmp/code-reviews/ \
--task-title "User Authentication" \
--task-description "Implement JWT-based auth"
Programmatic Usage from code_review_agent import CodeReviewAgent
agent = CodeReviewAgent(
developer_name="developer-a" ,
llm_provider="openai"
)
result = agent.review_implementation(
implementation_dir="/tmp/developer-a/" ,
task_title="User Authentication" ,
task_description="Implement JWT auth with bcrypt" ,
output_dir="/tmp/code-reviews/"
)
print (f"Status: {result['review_status' ]} " )
print (f"Score: {result['overall_score' ]} /100" )
print (f"Critical Issues: {result['critical_issues' ]} " )
Pipeline Integration
from code_review_agent import CodeReviewAgent
review_agent_a = CodeReviewAgent(developer_name="developer-a" )
review_a = review_agent_a.review_implementation(
implementation_dir="/tmp/developer-a/" ,
task_title=task_title,
task_description=task_description,
output_dir="/tmp/code-reviews/"
)
review_agent_b = CodeReviewAgent(developer_name="developer-b" )
review_b = review_agent_b.review_implementation(
implementation_dir="/tmp/developer-b/" ,
task_title=task_title,
task_description=task_description,
output_dir="/tmp/code-reviews/"
)
if review_a['critical_issues' ] > 0 :
winner = "developer-b"
Configuration
Environment Variables
ARTEMIS_LLM_PROVIDER=openai
OPENAI_API_KEY=sk-...
ANTHROPIC_API_KEY=sk-ant-...
ARTEMIS_LLM_MODEL=gpt-4o
Supported Models
gpt-4o (default)
gpt-4o-mini
gpt-4-turbo
claude-sonnet-4-5-20250929 (default)
claude-3-5-sonnet-20241022
Cost Considerations Typical review costs per implementation:
Prompt tokens : 3,000-5,000 (code + prompt)Completion tokens : 2,000-4,000 (review JSON)Total : 5,000-9,000 tokens
Estimated Costs Model Cost per Review Recommended Use GPT-4o $0.05-$0.12 Production reviews GPT-4o-mini $0.005-$0.01 Development/testing Claude Sonnet 4.5 $0.10-$0.20 Thorough security audits
Best Practices
Review Early - Catch issues before arbitrationReview Both Developers - Ensures fair comparisonMonitor Critical Issues - Auto-reject implementations with critical issuesTrack Metrics - Monitor security score trends over timeUse in CI/CD - Automated reviews on every commitCombine with Static Analysis - Complement with Bandit, ESLint, SonarQube
Limitations
Static Analysis Only - Cannot detect runtime vulnerabilitiesNo Execution - Cannot find logic errors requiring executionLanguage Coverage - Best for Python, JavaScript, HTML/CSSLLM Dependent - Quality depends on LLM capabilitiesFalse Positives - May flag intentional design decisions
Future Enhancements
Custom Rule Sets - Industry-specific compliance (HIPAA, PCI-DSS)Severity Tuning - Configurable severity thresholdsAuto-Fix Suggestions - Generate code patchesDiff-Based Review - Review only changed filesIntegration Tests - Security-focused integration testingVulnerability Database - Check against CVE databases
References
Maintained By: Artemis Pipeline Team
Last Updated: October 22, 2025
