code-review

name	code-review
description	Professional code review skill following OWASP, SOLID, and Clean Code principles. Use when reviewing code changes, performing pull request reviews, or auditing existing code for quality issues.
license	MIT

Code Review Skill — Professional Quality Audit

This skill provides a systematic, evidence-based code review methodology that catches real issues, not style nits.

Review Dimensions

1. Correctness (Priority: CRITICAL)

• Does the code do what it claims?
• Are edge cases handled?
• Are off-by-one errors possible?
• Are null/undefined checks present where needed?
• Are error conditions properly handled?

2. Security (Priority: CRITICAL)

• Injection: SQL, XSS, command injection, path traversal
• Auth: Proper authentication and authorization checks
• Data Exposure: No secrets in logs, error messages, or responses
• Input Validation: All external inputs validated and sanitized
• Dependencies: Known vulnerabilities in third-party packages

3. Performance (Priority: HIGH)

• Unnecessary allocations in hot paths
• O(n²) or worse algorithms where O(n) or O(log n) is possible
• Missing pagination for large datasets
• Synchronous operations that should be async
• Memory leaks (event listeners, subscriptions not cleaned up)

4. Maintainability (Priority: HIGH)

• Functions under 40 lines
• Cyclomatic complexity ≤ 10
• Meaningful names that reveal intent
• No magic numbers or strings
• Proper error types with context

5. Testing (Priority: HIGH)

• Tests exist for new behavior
• Tests cover happy path AND failure modes
• Tests are isolated and repeatable
• Test names describe expected behavior
• No test interdependencies

6. Architecture (Priority: MEDIUM)

• Proper separation of concerns
• No circular dependencies
• Dependency direction is correct (inward in hexagonal)
• No layer violations
• Single Responsibility Principle followed

Severity Classification

Severity	Criteria	Action
BLOCKER	Security vulnerability, data loss risk	Must fix before merge
CRITICAL	Bug, incorrect behavior	Must fix before merge
MAJOR	Performance issue, poor error handling	Should fix before merge
MINOR	Style, naming, minor improvement	Can fix later
INFO	Suggestion, alternative approach	Optional

Review Workflow

1. Read the PR description — understand intent
2. Read the changed files — understand implementation
3. Trace data flow — from input to output
4. Check tests — do they verify the behavior?
5. Check dependencies — any side effects?
6. Classify findings — by severity with evidence
7. Write review — constructive, specific, actionable

Output Format

## Code Review Report

### Summary

- Files reviewed: [N]
- Findings: [BLOCKER: N] [CRITICAL: N] [MAJOR: N] [MINOR: N] [INFO: N]
- Verdict: APPROVE | REQUEST CHANGES | BLOCK

### Findings

#### [SEVERITY] [File:Line] — [Title]

**Issue**: [Description of the problem]
**Evidence**: [Code snippet showing the issue]
**Recommendation**: [Specific fix suggestion]
**Confidence**: HIGH | MEDIUM | LOW

## When NOT to Use

**Do NOT use this skill when:**

- Designing database schemas (use database-design skill for normalization and indexing)
- Writing API endpoint implementations (use api-design skill for REST/GraphQL endpoint patterns)
- Performing security audits (use security-auditor skill for comprehensive vulnerability analysis)
- **Analyzing deployment configurations** (use deployment skill for CI/CD pipelines and infrastructure)
- **Writing SQL queries** (use sql-best-practices skill for query optimization and N+1 prevention)
- **Reviewing git workflows** (use git-workflow skill for branching strategies and commit conventions)
- **Designing multi-page website layouts** (use design-system skill for professional UI/UX and spacing)
- **Implementing new features** (use domain-driven skill for complete business modules)
- **Refactoring existing code** (use refactoring skill for safe behavior-preserving transformations)