code-review

name	code-review
description	Structured code review with security, performance, and quality checks

Code Review

Review code changes against a structured checklist covering security, performance, architecture, and correctness.

When to use

• "Review this PR"
• "Check my code"
• "Code review for #123"
• Before merging any PR

How to execute

Step 1: Load the changes

# For a PR
gh pr diff <PR_NUMBER>

# For local changes
git diff main...HEAD

Step 2: Review checklist

Go through each category:

Security

• No hardcoded secrets, API keys, or credentials
• User input is validated and sanitized
• No SQL injection, XSS, or command injection vectors
• Authentication/authorization checks in place
• Sensitive data not logged or exposed in errors

Correctness

• Logic handles edge cases (null, empty, negative, overflow)
• Error handling is appropriate (not swallowed, not over-caught)
• Race conditions considered for concurrent code
• Resource cleanup (files, connections, locks)

Performance

• No N+1 queries or unnecessary loops
• Large datasets paginated or streamed
• Caching used where appropriate
• No blocking operations in async code

Architecture

• Changes follow existing patterns in the codebase
• No unnecessary dependencies added
• Public API surface is intentional
• No dead code or commented-out blocks

Tests

• New code has tests
• Edge cases are covered
• Tests are deterministic (no flaky tests)

Step 3: Report findings

Format: severity + file + line + description

[CRITICAL] src/auth.py:42 — SQL query built with string concatenation
[WARNING] src/api.py:108 — Missing error handling for network timeout
[SUGGESTION] src/utils.py:15 — Could use list comprehension for clarity

Step 4: Summary

Provide:

1. Overall assessment (approve / request changes / needs discussion)
2. Critical issues (must fix before merge)
3. Suggestions (nice to have)

Parameters

Parameter	Description	Default
PR number	GitHub PR to review	current branch diff
--focus security	Focus on security checks only	all checks

Related skills

• git-workflow — merge after review passes