| name | enterprise-pr-review |
| description | Reviews Pull Requests applying enterprise-grade criteria: SOLID principles, security, performance, testability, naming conventions, and team consistency. Use when asked to review code, audit a PR, check a diff for issues, or evaluate code quality in any backend language. Stack-agnostic: works with .NET, Laravel, Java, Node.js, and others. Provides structured feedback with severity levels.
|
| license | MIT |
| metadata | {"author":"iamBrzDev","version":"1.0"} |
When to activate
- "Review this code / PR / diff"
- "What do you think about this implementation?"
- "Check this for issues before I merge"
- "Does this follow best practices?"
- Any code pasted with the expectation of feedback
Review Framework
Analyze across 6 dimensions. Use severity: 🔴 Blocker · 🟡 Warning · 🔵 Suggestion
1. Correctness & Logic
- Does the code do what it's supposed to?
- Edge cases: null inputs, empty collections, concurrent access
- Error paths handled?
2. Security
- User input in raw SQL, shell commands, or file paths?
- Protected endpoints actually protected?
- Secrets, keys, or PII logged or exposed in responses?
🔴 Raw SQL with string interpolation
🔴 API endpoint without auth check
🔴 Password or token in response body
🟡 User-controlled data in file path without sanitization
🟡 Auth check without ownership check
3. Performance
- N+1 query patterns?
- Missing pagination on large result sets?
- Blocking I/O where async applies?
4. Design & SOLID
- Single Responsibility: does this class/method do one thing?
- Dependency Inversion: dependencies injected or hardcoded?
- Names accurately reflect behavior?
5. Testability
- Can this be unit tested without a DB or HTTP server?
- Dependencies injectable?
6. Team Consistency
- Follows established patterns in this codebase?
- Same naming conventions and error handling?
Output Format
## PR Review
### Summary
Brief description and overall assessment.
### Blockers 🔴
1. [File:Line] Problem description and why it matters.
**Fix:** Concrete suggestion.
### Warnings 🟡
### Suggestions 🔵
### What's done well ✅
At least one specific thing done right.
Non-negotiables — always 🔴
- User input in raw SQL without parameterization
- Missing auth/authz on protected resources
- Secrets or PII in logs or API responses
- Swallowed exceptions with empty catch blocks
- Hardcoded credentials in code
Tone
Direct but constructive. Reference file:line specifically. Explain why, not just what. Assume good intent.
