Menu
Comprehensive code review checking for security, performance, maintainability, and best practices
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Design RESTful APIs with proper resource modeling, error handling, pagination, and documentation
Design system architecture, data models, API contracts, and create Architecture Decision Records (ADRs)
Implement backend functionality including APIs, business logic, database operations, and integrations
Prepare deployment configuration, environment setup, health checks, and rollback procedures
Implement frontend user interfaces with modern frameworks, responsive design, and accessibility standards
Perform comprehensive security audits checking for OWASP Top 10 vulnerabilities and security best practices
| name | code-review |
| description | Comprehensive code review checking for security, performance, maintainability, and best practices |
| allowed-tools | Read, Glob, Grep |
Perform thorough code reviews to ensure high-quality, secure, maintainable code before delivery. This skill is invoked automatically when code needs review.
Before reviewing code:
# Code Review: [Feature/PR Name]
## Summary
[Brief overview of changes reviewed]
## Overall Assessment
✅ Approved | ⚠️ Approved with Comments | ❌ Changes Requested
## Critical Issues (Must Fix)
1. **[Issue Title]** - [file:line]
- **Problem**: [Description]
- **Impact**: [Why this is critical]
- **Recommendation**: [How to fix]
2. [More critical issues...]
## High Priority Issues (Should Fix)
1. **[Issue Title]** - [file:line]
- **Problem**: [Description]
- **Recommendation**: [How to fix]
## Medium Priority Issues (Consider Fixing)
1. **[Issue Title]** - [file:line]
- **Problem**: [Description]
- **Recommendation**: [How to fix]
## Positive Aspects
- [Something done well]
- [Good practice observed]
- [Effective solution]
## Recommendations
- [General suggestion for improvement]
- [Pattern to consider]
- [Resource to check out]
## Security Assessment
✅ No security issues found | ⚠️ Minor concerns | ❌ Security issues present
[Details of any security concerns]
## Performance Assessment
✅ Performance acceptable | ⚠️ Minor concerns | ❌ Performance issues present
[Details of any performance concerns]
## Test Coverage Assessment
✅ Well tested (>80%) | ⚠️ Adequate testing (60-80%) | ❌ Insufficient testing (<60%)
[Details of test coverage]
---
**Reviewer**: [Agent name]
**Review Date**: [Date]
**Files Reviewed**: [Number] files, [Number] lines changed
Bad:
// SQL injection vulnerability
const query = `SELECT * FROM users WHERE id = ${userId}`;
// XSS vulnerability
element.innerHTML = userInput;
// Hardcoded credentials
const apiKey = "sk_live_12345";
Good:
// Parameterized query
const query = 'SELECT * FROM users WHERE id = ?';
db.query(query, [userId]);
// Escaped output
element.textContent = userInput;
// Environment variable
const apiKey = process.env.API_KEY;
Bad:
// N+1 query problem
const users = await User.findAll();
for (const user of users) {
const posts = await Post.findByUserId(user.id); // Query in loop!
}
// Unnecessary computation in loop
for (let i = 0; i < items.length; i++) {
const total = calculateExpensiveTotal(); // Recalculated every iteration
}
Good:
// Single query with join
const users = await User.findAll({
include: [{ model: Post }]
});
// Compute once
const total = calculateExpensiveTotal();
for (let i = 0; i < items.length; i++) {
// Use total
}
Bad:
// Function doing too much
function processOrder(order) {
validateOrder(order);
calculateTax(order);
applyDiscount(order);
processPayment(order);
sendEmail(order);
updateInventory(order);
logTransaction(order);
// ... 200 more lines
}
// Magic numbers
if (status === 3) {
// What does 3 mean?
}
Good:
// Single responsibility
function processOrder(order) {
const validatedOrder = validateOrder(order);
const pricedOrder = calculatePricing(validatedOrder);
const paidOrder = processPayment(pricedOrder);
await fulfillOrder(paidOrder);
return paidOrder;
}
// Named constants
const STATUS_COMPLETED = 3;
if (status === STATUS_COMPLETED) {
// Clear meaning
}
Good code review catches bugs before they reach production, maintains code quality, and helps the team learn and improve.
Review as if you'll be maintaining this code - because you might be!