| name | review |
| description | Code review for PRs or staged changes. >80% confidence threshold. Verdict: APPROVE, REQUEST CHANGES, or COMMENT. Triggers: review, pr, code review. |
| user-invocable | true |
| allowed-tools | Read, Bash, Grep, Glob |
| kernel | {"kind":"validator","version":1,"side_effects":"none","confirmation":"none"} |
Review code changes for quality, correctness, security.
Only report issues with >80% confidence.
Load: skills/testing/SKILL.md, skills/security/SKILL.md
Reference: _meta/research/ai-code-anti-patterns.md
ai_code_stats:
buggier: 1.7x more issues than human code
security: 40-62% contain vulnerabilities
findings: 10.83 per AI PR vs 6.45 human
priority: check Big 5 first (what AI actually breaks)
<on_start>
agentdb read-start
<identify_scope>
gh pr diff {number}
git diff --staged
git diff HEAD~1
</identify_scope>
</on_start>
<confidence_threshold>
| Confidence | Category | Report? |
|---|
| 95%+ | Definite bug | YES |
| 85-95% | Likely issue | YES |
| 70-85% | Possible issue | MAYBE |
| <70% | Style preference | NO |
| </confidence_threshold> | | |
Check these FIRST - what AI actually breaks:
- Zod/Pydantic schema for every API endpoint?
- Parameterized queries (no string concat)?
- File uploads validated (size, type, extension)?
detection: grep -r "req\.body" | grep -v "parse\|validate\|z\."
- Null/undefined handling present?
- Empty arrays handled (length check)?
- Zero-length strings rejected?
- Timeout handling for external calls?
- No empty catch blocks?
- Errors logged with context?
- User-facing messages generic?
detection: grep -r "catch.*{}" (empty catch)
- Same logic repeated in multiple places?
- Should be extracted to shared utility?
- Functions > 30 lines?
- Nested ternaries > 2 levels?
- [ ] Edge cases handled
- [ ] Error paths covered
- [ ] Null checks present
- [ ] Type safety
- [ ] Input validation (Zod schema)
- [ ] No hardcoded secrets
- [ ] SQL injection prevented (parameterized queries)
- [ ] XSS prevented (DOMPurify)
- [ ] Auth tokens in httpOnly cookies
- [ ] No N+1 queries
- [ ] Appropriate caching
<output_format>
CODE REVIEW
Files: X changed
Findings: Y (Z critical)
CRITICAL
[file:line] Issue (confidence: XX%)
→ Fix: suggestion
HIGH
[file:line] Issue (confidence: XX%)
→ Fix: suggestion
Summary: APPROVE | REQUEST CHANGES | COMMENT
</output_format>
<ask_user>
Use AskUserQuestion when: a finding is between 70-85% confidence (ambiguous)
Ask: "Found {issue} at {file:line} (confidence {X}%). Intentional, or should I flag it?"
Options: intentional — skip, flag it, investigate deeper
</ask_user>
<verdict_rules>
- APPROVE: No critical or high issues
- REQUEST CHANGES: Any critical or high issue
- COMMENT: Only medium/low issues
</verdict_rules>
<on_complete>
agentdb write-end '{"command":"review","verdict":"X","critical":N,"high":N,"big5_violations":N}'
</on_complete>
