| name | code-review |
| description | Expert code reviewer with deep knowledge of software engineering best practices, design patterns, and code quality standards. Use this skill when reviewing code changes, pull requests, or conducting code quality assessments. |
| license | MIT |
| tags | ["code-review","quality","best-practices"] |
| allowed-tools | ["bash","git","markdown"] |
| metadata | {"author":"laurenceputra","version":"1.0.0"} |
Code Review
Provide structured, actionable review feedback focused on correctness, security, performance, and maintainability.
Workflow
- Read the change and understand intent.
- Review for correctness, edge cases, and regressions.
- Check repo-specific constraints and testing coverage.
- Summarize findings using the output template.
Easy-Fix Guardrail Review (Review Owner)
Use this gate to prevent symptom-only fixes and require evidence-backed closure.
Review Checks
- Confirm a causality statement exists from
debugging-assistant.
- Confirm a QA verification matrix exists from
qa-testing and maps failures to tests and outcomes.
- Verify fix locality:
- implementation changed when implementation was at fault
- test or config-only changes are justified and scoped
- Block anti-patterns unless explicitly justified:
eslint-disable added for convenience- skipped or softened tests to force green
- broad rule or config relaxations for isolated issues
Blocking Conditions
Mark as blocking if:
- correctness is still ambiguous
- evidence does not prove root-cause closure
- financial or privacy-sensitive behavior changed without explicit verification
When blocked for ambiguity, require a human decision record only when ambiguity remains after applying the Spec-Clarity Gate (canonical definition in .agents/agent-instructions.md).
Reference: debugging-assistant escalation policy and qa-testing verification matrix.
Repo-Specific Review Risks
- Single-file userscript constraint: no module imports, no build steps, no file splitting, keep all helpers inside the IIFE.
- Financial calculations: guard zero division, use
Number.isFinite(), preserve null vs 0, round only at display.
- API interception safety: clone responses before reading, match URLs precisely, avoid blocking the native response, prevent fetch/XHR loops.
- XSS prevention: never render user data via
innerHTML, avoid inline event handlers, use textContent or DOM nodes.
- Storage key compatibility: keep key formats stable, encode separators, add migrations if any key shape changes, and verify policy clarity that the 2-month window covers in-repo migration support while runtime legacy-key cleanup may occur immediately after successful migrated write during that window.
- Sync/security boundaries: no data egress by default, encryption/auth flows unchanged unless explicitly intended and verified.
Output Format
- Summary
- Critical Issues
- Suggestions
- Testing
References
