| name | code-review |
| description | Review a pull request or diff with a structured checklist — security, error handling, edge cases, test coverage, and code quality. Trigger on /code-review, or when asked to review a PR, diff, or merge request. |
| user-invocable | true |
| allowed-tools | Read, Grep, Glob, Bash |
Code Review
Review a PR/diff with outsider skepticism. Focus on what matters — not style nits.
Workflow
1. Understand the change
- Read the diff end-to-end.
- State the goal in one sentence. If you can't, flag it.
- Check if tests actually fail without the change (test validity).
2. Review checklist
Correctness
- Does the code actually solve the stated problem?
- Any edge cases not handled? (empty, null, zero, overflow, network error)
- Are error paths tested, not just happy paths?
Security
- Any user input that isn't validated/sanitized?
- Any command injection via shell commands?
- Any hardcoded secrets, tokens, URLs, or IPs?
- Any path traversal vulnerabilities?
Code quality
- Dead code, commented blocks, debug leftovers (
console.log, print, TODO, FIXME, HACK)?
- Error handling that swallows real errors (
catch { /* silent */ })?
- Hardcoded sleeps/delays/waits?
- Magic numbers without named constants?
Testing
- Do tests verify behavior or just execute code?
- Are there assertions on the right thing?
- Do tests pass for the right reason? (not over-mocked, not snapshot-bloated)
Side effects
- Silent behavior changes? (logging, perf, error semantics, API contract)
- Breaking changes for other callers?
- Concurrency issues? (race conditions, deadlocks, shared state)
3. Report
Order by severity: blocker → major → nit.
## Findings
### Blocker
- ...
### Major
- ...
### Nits
- ...
## Verdict: ship / fix-then-ship / rework / reject
Experience Log
This skill learns from experience. Mechanism:
- Read
.claude/experience/code-review.md at skill start to benefit from past lessons.
- Write to
.claude/experience/code-review.md after use if you learned something new.
- Format:
YYYY-MM-DD: <lesson> — one line per entry.
- Evolve: If the same issue repeats 3+ times, update this SKILL.md itself.
Rules
- No rubber-stamps. If you find nothing, say what you checked.
- Cite specific file:line for every finding.
- Distinguish "the PR says X" from "I verified X."
- No flattery, no hedging.
