code-review

name	code-review
description	Review code for security vulnerabilities, logic errors, and quality issues. Returns findings ranked by severity with remediation steps.
origin	FlowDeck

Code Review Skill

Finds real problems before they reach production. Reviews only changed code, reports only confirmed issues, and provides actionable fixes.

When to Activate

Activate when:

• You just wrote or modified code
• A PR is ready for review
• You want a final check before pushing

Core Principles

• Report only confirmed issues — 80%+ confidence before flagging
• Severity-ranked output: Critical → High → Medium → Pass
• Actionable fixes: every finding includes a specific remediation
• No style nitpicks unless they mask bugs

Workflow

1. Run git diff or read specified files
2. Read full file context (not just the diff)
3. Trace call sites — who calls these functions?
4. Apply security checklist first
5. Apply quality checklist
6. Report by severity

Security Checklist — CRITICAL

SQL Injection:

// ❌ CRITICAL
const q = `SELECT * FROM users WHERE id = '${userId}'`;
// ✅ Parameterized
const q = db.query('SELECT * FROM users WHERE id = ?', [userId]);

XSS:

<!-- ❌ CRITICAL -->
element.innerHTML = userInput;
<!-- ✅ -->
element.textContent = userInput;

Hardcoded credentials:

// ❌ CRITICAL
const SECRET = "abc123hardcoded";
// ✅
const SECRET = process.env.API_SECRET;

Path traversal:

// ❌ CRITICAL
fs.readFile(`./uploads/${filename}`);
// ✅
fs.readFile(path.join('./uploads', path.basename(filename)));

Quality Checklist — HIGH

• Functions over 50 lines → extract
• Nesting deeper than 3 levels → extract guard clauses
• Empty or silent catch blocks → log and rethrow
• Dead code (defined but never called) → remove

Performance — MEDIUM

• N+1 queries: database call inside a loop
• Missing pagination on list endpoints
• Synchronous I/O in hot paths

Best Practices — LOW

• Inconsistent naming within a file
• Missing JSDoc on public functions
• console.log left in production code

Output Format

## Code Review Report

### 🔴 CRITICAL (must fix before merge)
| # | File | Line | Issue | Fix |
|---|------|------|-------|-----|
| 1 | auth.ts | 42 | SQL injection | Use parameterized query |

### 🟠 HIGH (fix before merge)
| # | File | Line | Issue | Fix |
|---|------|------|-------|-----|

### 🟡 MEDIUM (fix in follow-up)
| # | File | Line | Issue | Fix |
|---|------|------|-------|-----|

### ✅ PASS
- Auth middleware: present on all protected routes
- Input validation: correct at all boundaries