code-review-checklist

name	code-review-checklist
description	Provides additional review criteria to augment the standard code review workflow. Use when performing code review to check design compliance, security, quality, performance, testing, and best practices.
user-invocable	true
disable-model-invocation	false

Code Review Checklist

Overview

This Skill provides a checklist of review criteria to augment the standard code review workflow. When reviewing code, apply the criteria below in addition to the standard review process.

Severity classification and output formatting follow the standard review workflow; this Skill only supplies the criteria to check.

Design Compliance

Focus on alignment between the code changes and the provided design information.

Skip this category if no design information is provided.

• Interface contract violations: Method signatures, return types, or parameters that deviate from the design.
• Missing implementations: Design-specified components or behaviors not present in the code.
• Architectural deviations: Code structure that contradicts design decisions (e.g., wrong module boundaries, wrong dependency directions).
• Behavioral mismatches: Logic that produces different outcomes than the design specifies.
• Constraint violations: Design-specified constraints (performance budgets, size limits, invariants) not enforced in code.
• Naming inconsistencies: Identifiers that deviate from design-specified terminology.

Security

Focus on security vulnerabilities and risks that could lead to data breaches, unauthorized access, or system compromise.

• Hardcoded credentials: API keys, passwords, tokens, secrets in source code.
• SQL injection risks: String concatenation in SQL queries.
• XSS vulnerabilities: Unescaped user input in HTML/templates.
• Missing input validation: User input accepted without validation.
• Insecure dependencies: Outdated or vulnerable libraries.
• Path traversal risks: User-controlled file paths without sanitization.
• CSRF vulnerabilities: Missing CSRF protection in state-changing operations.
• Authentication bypasses: Logic errors allowing unauthorized access.

Quality

Focus on code maintainability, readability, and error-handling robustness.

• Large functions: Functions exceeding 50 lines.
• Large files: Files exceeding 800 lines.
• Deep nesting: Nesting depth exceeding 4 levels.
• Missing error handling: Operations without try/catch, error checks, or Result handling.
• Debug statements: console.log, print(), or similar debug code left in production paths.

Performance

Focus on efficiency, resource usage, and optimization opportunities.

• Inefficient algorithms: O(n^2) when O(n log n) or O(n) is possible.
• Unnecessary re-renders: React components re-rendering without memoization.
• Missing memoization: Expensive computations without caching.
• Large bundle sizes: Unnecessary dependencies or missing code splitting.
• Unoptimized assets: Large images without compression or lazy loading.
• Missing caching: Repeated identical API calls or computations.
• N+1 queries: Database queries in loops instead of batch operations.

Testing

Focus on test coverage for code changes.

• Missing tests: New code without corresponding test coverage.

Best Practices

Focus on coding standards, conventions, and long-term maintainability.

• Immutability violations: Direct object/array mutations instead of immutable patterns.
• Emoji usage: Emojis in code, comments, or documentation.
• TODO/FIXME without tickets: Action items without tracking references.
• Missing documentation: Public APIs without doc comments.
• Accessibility issues: Missing ARIA labels, poor contrast, keyboard navigation problems.
• Poor naming: Non-descriptive variable names (x, tmp, data, etc.).
• Magic numbers: Numeric literals without explanation or named constants.
• Inconsistent formatting: Style inconsistencies within the codebase.