| name | code-review |
| description | Automated code review — analyzes source files for bugs, security issues, style violations, and improvement suggestions. Use when asked to review code, check quality, or find problems in files. |
Code Review
Overview
Perform thorough code reviews on source files. Identifies bugs, security vulnerabilities, performance issues, code style violations, and suggests improvements.
When to Use
- User asks to "review", "check", or "audit" code
- Pull request or diff review requests
- Quality assessment before deployment
- Finding bugs or security issues in existing code
Workflow
- Read the target files using
read_file to get the source code
- Analyze the code for the categories below
- Report findings organized by severity (Critical > Warning > Info)
- Suggest fixes with concrete code snippets
Review Categories
1. Bugs & Logic Errors
- Off-by-one errors, null/undefined access, race conditions
- Incorrect boolean logic, missing edge cases
- Resource leaks (unclosed files, connections, memory)
2. Security
- SQL injection, XSS, command injection
- Hardcoded secrets, insecure crypto
- Path traversal, unsafe deserialization
- Missing input validation at boundaries
3. Performance
- N+1 queries, unnecessary allocations
- Missing indexes for database queries
- Blocking calls in async code
- Inefficient algorithms (O(n^2) where O(n) is possible)
4. Code Quality
- Dead code, unused variables/imports
- Functions too long (>50 lines), too many parameters (>5)
- Missing error handling, swallowed exceptions
- Inconsistent naming conventions
5. Maintainability
- Missing or misleading comments on complex logic
- Tight coupling, violation of single responsibility
- Magic numbers, duplicated logic
Output Format
For each finding:
[SEVERITY] Category — file:line
Description of the issue.
Suggested fix: ...
Severity levels:
- CRITICAL — Bugs, security holes, data loss risk
- WARNING — Performance issues, potential bugs, bad practices
- INFO — Style, readability, minor improvements
Example
[CRITICAL] Security — src/api/auth.rs:45
SQL query built with string concatenation. Vulnerable to SQL injection.
Suggested fix: Use parameterized queries instead.
[WARNING] Performance — src/service/fetch.rs:102
Blocking HTTP call inside async function.
Suggested fix: Use reqwest::Client async methods.
[INFO] Code Quality — src/utils/helpers.rs:12
Unused import `std::collections::BTreeMap`.
Suggested fix: Remove the import.
Best Practices
- Review files one at a time for thoroughness
- Start with entry points (main, routes, handlers) then follow call chains
- Always check error handling paths, not just happy paths
- For large codebases, focus on changed files or critical paths first
