メニュー
Use to review diffs without editing code. Focus on bugs, regressions, security risks, data loss, missing validation, missing tests, and performance risks.
デフォルトでは、最初にソースを確認する Prompt が選択されています。直接コマンドに切り替えるか、ローカルコピーをダウンロードすることもできます。
インストールを決める前に、SKILL.md と SkillsMP に表示されている付属ファイルをお読みください。
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
直接コマンドでは確認用 Prompt が省略されます。実行前にソースを確認してください。
npx skills add https://github.com/mtvrkan/senior-dev-kit --skill code-reviewコマンドは1行のまま表示されます。コピー前に横へスクロールして全体を確認してください。
ローカルで確認しますか？SkillsMP が現在取得できるファイルをダウンロードできます。
SOC 職業分類に基づく
SKILL.md を表示中
| name | code-review |
| description | Use to review diffs without editing code. Focus on bugs, regressions, security risks, data loss, missing validation, missing tests, and performance risks. |
| allowed-tools | Read, Grep, Glob, Bash |
| when_to_use | Use automatically after meaningful changes or when the user asks for review. |
| argument-hint | [files or diff scope (optional — defaults to recent changes)] |
| context | fork |
| effort | high |
Review for actionable risks only. Skip subjective style. Read changed files + directly imported deps only. Auto-fires after meaningful changes; also invocable directly via /code-review for a deliberate pre-merge pass. If the diff touches a guarded domain (auth/payment/DB/CI), raise effort and escalate per the last line.
Do not use for: a dedicated, exhaustive security audit (security-review) — items (5) and (7) below are an inline sanity check on the diff, not a substitute for one; dependency CVE checks (security-scan); pre-release gating (release-gate); or a deep performance investigation (performance-check) — item (10) below is a quick flag, not a profiling pass.
Review order: (1) correctness bugs — logic errors, off-by-one, wrong condition, unhandled null/undefined. (2) regressions — breaks behavior callers depend on? (3) breaking changes — endpoint removed/renamed, required field added → grep for callers. (4) missing validation — unvalidated input reaching DB or executing code. (5) auth gaps — unauthenticated access, missing ownership check, role bypass. (6) data loss — overwriting without backup, missing transaction, destructive op. (7) injection — SQL/NoSQL/XSS/command via unsanitized input. (8) race conditions — non-atomic check-then-act, missing lock. (9) missing tests — behavior changed with no test update. (10) performance — N+1, expensive loop, unnecessary full-table scan.
Severity: critical (ship blocker) | high (fix before merge) | medium | low — format: SEVERITY | file:line | issue | fix
Critical:[N] High:[N] Medium:[N] Low:[N]
BREAKING CHANGES: [N — list | none]
VERDICT: ship ✓ | fix critical first | needs work
ESCALATE: [security-guard | db-guard | none]