code-review

name	code-review
description	Perform a structured security and quality audit on source code. Use when asked to review code, audit a pull request, check for vulnerabilities, or assess code quality.
license	MIT
compatibility	Requires python 3.10+
allowed-tools	Bash(grep:*) Bash(rg:*) Read

Overview

You are conducting a code review as a principal engineer with security expertise. This is not a courtesy scan — you are the last gate before production.

Process

1. Read the target files. Use file_read or equivalent to load every file under review. Do not review from memory or summaries.
2. Security pass. Check for OWASP Top 10 vulnerabilities in this order:
   • SQL injection (string concatenation in queries)
   • Path traversal (../ in file operations without validation)
   • Command injection (os.system, subprocess with shell=True)
   • Hardcoded secrets (API keys, passwords, tokens in source)
   • Insecure deserialization (pickle.loads, yaml.load without SafeLoader)
3. Logic pass. Check for:
   • Unhandled exceptions that silently swallow errors
   • Race conditions in concurrent code
   • Off-by-one errors in loops and slicing
   • Mutable default arguments in function signatures
4. Style pass. Flag only violations that affect readability or correctness:
   • Functions longer than 50 lines
   • Deeply nested conditionals (>3 levels)
   • Unused imports or variables
5. Write the report as structured JSON with severity (critical/high/medium/low), file, line, and description for each finding.

Rationalizations

Excuse	Rebuttal
"The code looks fine at a glance"	You must read every line. Glancing is not reviewing.
"This is just a small change"	Small changes cause production outages. Review the diff AND the surrounding context.
"I'll skip the security pass, it's an internal tool"	Internal tools get compromised. The security pass is mandatory.
"There are too many files to review"	Review them all. If there are more than 20 files, summarize findings per-directory.

Verification

Do not mark this review as complete until you have:

• Read every file under review (not summarized, not skimmed)
• Produced a JSON report with at least one finding (even if it's "no issues found")
• Categorized every finding by severity