Comprehensive code quality and security audit for financial systems. Use when asked to "review code", "code review", "security audit", "check for issues", "審核程式碼", "檢查安全性", or before merging changes. Focuses on DDD compliance, financial precision (no floats for money), security vulnerabilities, and test coverage.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
Comprehensive code quality and security audit for financial systems. Use when asked to "review code", "code review", "security audit", "check for issues", "審核程式碼", "檢查安全性", or before merging changes. Focuses on DDD compliance, financial precision (no floats for money), security vulnerabilities, and test coverage.
VS Code: Use @workspace #code-reviewer-agent in Chat
⚠️ CLI Note: Use natural language like "review 我的 code". VS Code users can use /code-review shortcut.
When to Use This Skill
Use this skill when:
Implementation is complete and ready for review
Before creating pull request
After TDD implementation phase
Suspicious code or security concerns
實作完成,準備提交 PR 前
需要檢查程式碼品質與安全性
Prerequisites
Required:
Code changes committed or staged (git status shows modifications)
Implementation phase complete
Recommended:
04-plan.md to verify all tasks completed
Tests passing and coverage ≥80%
Review Role Contract
New Change Packages record independent Review in canonical 07-review.md. Historical 05-review.md remains readable; it is not the canonical filename for a new package. Canonical and legacy files may coexist only when the legacy file is the documented pointer-only alias—two independent Review bodies are competing evidence and blocking.
Every Review body contains observable Summary, Findings, Verification Evidence, and Decision. Decision is exactly PASS, PASS_WITH_NOTES, or BLOCKED. Any unresolved Critical/High finding or required deterministic test/build/lint/static/gate failure requires BLOCKED.
agentic-eval is self-evaluation, not independent Review. It cannot replace this Review when the selected mode requires independence, and neither self-evaluation nor prose can override deterministic failure.
Style inconsistencies (formatting, minor refactoring)
Step-by-Step Review Process
Step 1: Get Code Changes
# Check git status
git status
# View staged/unstaged changes
git diff
# Or compare branch
git diff main...feature-branch
Step 2: Run Security Audit
Check for Critical Security Issues:
Issue
How to Detect
Fix
Secrets in code
Search for API keys, passwords, tokens
Move to environment variables
SQL injection
Raw SQL with string concatenation
Use parameterized queries
XSS vulnerabilities
Unescaped user input in HTML
Sanitize inputs, escape outputs
Auth bypass
Missing authorization checks
Add RBAC/ABAC checks
Insecure dependencies
npm audit / pip-audit
Update vulnerable packages
Financial Systems Specific:
✅ Money fields use decimal (NOT float/double)
✅ Idempotency keys validated for transactions
✅ Audit logging present for sensitive operations
✅ Timezone handling (store UTC, display local)
Step 3: Code Quality Audit
DDD Compliance:
Entities have identity and behavior (not anemic)
Value objects are immutable
Domain logic in domain layer (not controllers/API)
Aggregates enforce invariants
Domain events for cross-aggregate communication
SOLID Principles:
Single Responsibility: Each class/function one purpose
Open/Closed: Extendable without modification
Liskov Substitution: Subtypes are substitutable
Interface Segregation: Small, focused interfaces
Dependency Inversion: Depend on abstractions
Naming Conventions (C#):
PascalCase for classes, methods, properties
camelCase for local variables, parameters
Interfaces prefixed with I
Test methods: MethodName_Condition_ExpectedResult
Step 4: Test Coverage Check
# Run tests with coverage
npm test -- --coverage
# Or
dotnet test /p:CollectCoverage=true
Coverage Requirements:
80% minimum for all code
100% required for:
Financial calculations
Authentication/authorization logic
Security-critical code
Core business logic
Test Quality:
Tests verify behavior (not implementation)
Edge cases covered
Error scenarios tested
Integration tests for critical paths
Step 5: Generate Review Document
For a new package, create changes/<YYYY-MM-DD>-<slug>/07-review.md:
Use the canonical structured role below. Every field appears exactly once, every option list is replaced by one selected value, and every evidence field is substantive:
None is the explicit zero-finding value. WARNING is recorded and supports PASS_WITH_NOTES without blocking. Unresolved Critical/High findings or BLOCKED deterministic evidence require Decision BLOCKED. agentic-eval cannot replace this independent Review or override deterministic evidence.
The extended example below is optional detail guidance, not the canonical semantic-role shape; it cannot replace or rename the structured fields above.
Optional detailed-review appendix example:
# Code Review: {Feature Name}**Date**: {YYYY-MM-DD}
**Reviewer**: {Name or "AI Agent"}
**Status**: 🔴 Needs Work / 🟡 Minor Issues / 🟢 Approved
---
## Summary
{Brief overview of changes and overall assessment}
**Files Changed**: {X files}
**Lines Added**: {+Y}
**Lines Removed**: {-Z}
---
## Findings### Critical Issues 🔴 (Must Fix Before Merge)### Issue 1: {Title}**Severity**: Critical
**File**: `{path/to/file.ts}:{line}`**Problem**: {Description of the issue}
**Risk**: {What could go wrong}
**Fix**: {How to resolve}
**Code**:
```typescript
// ❌ BAD
double price = 19.99; // Floating point for money
Recommended:
// ✅ GOOD
decimal price = 19.99M; // Decimal for money
Issue 2: {Title}
{Repeat structure}
High Priority Issues 🟡 (Should Fix)
Issue 3: {Title}
Severity: High
File: {path/to/file.ts}:{line}Problem: {Description}
Fix: {Solution}
Medium Priority Issues 🟢 (Nice to Fix)
Issue 4: {Title}
Severity: Medium
File: {path/to/file.ts}:{line}Problem: {Description}
Fix: {Solution}
Endpoint: POST /api/v1/usersChange: Response schema adds notificationPreferences field
Impact: External clients with strict schema validation may break
Recommendation:
Version bump to /api/v2/users
Maintain v1 for 2 weeks (deprecation period)
Announce to API consumers
Recommendations
Must Do (Before Merge)
{Critical issue 1}
{Critical issue 2}
Should Do (Current PR)
{High priority issue 1}
{High priority issue 2}
Nice to Do (Future PR)
{Medium priority issue}
{Refactoring opportunity}
Decision
Reviewer Decision: {Choose one}
BLOCKED: Deterministic failure or unresolved Critical/High findings
PASS_WITH_NOTES: No blockers; warnings or non-blocking follow-up remain
PASS: No blocking findings; required verification evidence is complete
Next Steps:
{Action item 1}
{Action item 2}
After fixes, run Review again; after PASS/PASS_WITH_NOTES, complete applicable pre-merge Closeout
Input: "archive 這個 change package"
[System loads work-archiving skill]
→ Generate the requested pre-merge 99-archive.md; update other local logs only when explicitly requested
VS Code:
Input: /archive
Or: "finalize and archive"
Or use workflow orchestrator:
Input: "what's next?"
[System validates Review content/status, then recommends Closeout when the selected package contract requires it]
Troubleshooting
"Too many issues found, overwhelming"
Solution: Fix critical (🔴) first, then high (🟡). Medium (🟢) can be separate PR.
