| name | code-review |
| description | Multi-pass code review covering logic correctness, security, performance, style, and maintainability |
| layer | hub |
| category | workflow |
| triggers | ["/code-review","review this code","check this code","review my changes","is this code good"] |
| inputs | [{"target":"File(s), diff, PR, or code snippet to review"},{"focus":"Specific concern area (optional -- security, performance, etc.)"},{"context":"What the code is supposed to do (optional but helpful)"}] |
| outputs | [{"reviewReport":"Structured report with findings across all passes"},{"findings":"Categorized issues (critical, major, minor, nit)"},{"suggestions":"Concrete improvement recommendations with code examples"}] |
| linksTo | ["fix","refactor","test","scout","optimize"] |
| linkedFrom | ["cook","team","ship","fix","refactor"] |
| preferredNextSkills | ["fix","refactor","test"] |
| fallbackSkills | ["scout","debug"] |
| riskLevel | low |
| memoryReadPolicy | selective |
| memoryWritePolicy | selective |
| sideEffects | ["Reads source files","Produces review report in working memory","Does NOT modify any files"] |
Code-Review Skill
Purpose
Perform thorough, multi-pass code review that catches bugs, security vulnerabilities, performance issues, and maintainability problems before they reach production. Each pass focuses on a different dimension of code quality.
A code review is not a checklist exercise. It is an act of empathy -- reading code as a future maintainer who needs to understand it, modify it, and trust it.
Workflow
Pre-Review: Context Gathering
- Understand what the code is supposed to do -- Read the PR description, commit messages, or user explanation. If none is available, infer the intent from the code itself and state your assumption.
- Identify the scope -- What files are being reviewed? What is the blast radius of these changes?
- Read related code -- Understand the interfaces and contracts the code interacts with. Read the caller and callee code, not just the changed code.
Pass 1: Logic and Correctness
Focus: Does the code do what it is supposed to do?
- Trace the happy path -- Walk through the main execution path. Does it produce the correct result?
- Trace error paths -- What happens when things go wrong? Are errors handled? Do they propagate correctly?
- Check edge cases:
- Empty inputs (null, undefined, empty string, empty array, zero)
- Boundary values (max int, empty collections, single-element collections)
- Concurrent access (if applicable)
- Unicode/special characters in strings
- Check state management -- Are there race conditions? Can state become inconsistent? Are there memory leaks?
- Check types -- Are types correct and specific enough? Any unsafe casts or
any types?
- Check return values -- Are all code paths covered? Can a function return undefined unexpectedly?
Pass 2: Security
Focus: Can this code be exploited?
- Input validation -- Is all user/external input validated and sanitized?
- Injection risks -- SQL injection, XSS, command injection, template injection
- Authentication/Authorization -- Are access controls properly checked? Any privilege escalation paths?
- Data exposure -- Are sensitive fields (passwords, tokens, PII) properly protected? Not logged? Not returned in API responses?
- Cryptography -- Are secure algorithms used? Are secrets stored properly? No hardcoded credentials?
