メニュー
Use this skill whenever you are asked to review code changes, a diff, or a pull request. Produces structured, actionable review comments focused on correctness, security, readability, and test coverage — not stylistic nits.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
| name | code-review-guide |
| description | Use this skill whenever you are asked to review code changes, a diff, or a pull request. Produces structured, actionable review comments focused on correctness, security, readability, and test coverage — not stylistic nits. |
| applicable_roles | ["coder","code-reviewer"] |
| scenarios | ["PR 审查","diff review","代码质量把关"] |
| metadata | {"source":"maintainer","tags":"code-review, quality, pull-request","languages":"python, javascript, typescript, go, rust","versions":"1.0.0","updated-on":"2026-04-11"} |
This skill gives the agent a consistent rubric to follow when reviewing code. It is a guidance-only skill (runtime: markdown) — no executable side effects.
Trigger keywords: "review this PR", "check my diff", "审核代码", "帮我看看这段代码".
Go through the code in this order. For each category, only call out real problems — do not pad the review with generic advice.
Correctness — Does the code do what the PR description says it does? Walk through the critical path with concrete inputs. Point out edge cases (null, empty, boundary) the author forgot.
Security — Untrusted input validation, SQL/shell injection, secret handling, authZ checks around new endpoints, CSRF/XSS for web code.
Concurrency & resource safety — Race conditions, unreleased locks, connections, or file handles. Long-running work on request threads.
Readability — Names that lie, dead code, magic numbers, functions doing three things at once. Skip purely cosmetic preferences.
Test coverage — Are the new branches tested? Does the test actually assert behavior, or does it just call the code without checking output?
Produce comments grouped by severity:
Each comment: file + line, the issue in one sentence, the fix in one sentence. Do not say "LGTM" unless you actually walked through all five categories above.
Use for any multi-step task (3+ steps, or "do A then B then C"). Solves the biggest weakness of small/open-source models vs Claude — finishing ONE sub-task then stopping instead of driving the whole task to completion. Pairs with action-first (which kills narrate-and-stop) by adding the cross-step drive — finish a step then immediately start the next, repeat until ALL done. Uses TudouClaw's own plan_update / task_update / agent_todo tools.
Engineering workflow pack — combined planning, implementation, review, and shipping skills (vendored from obra/superpowers, merged 2026-05-04). Use this when working on any non-trivial dev task: brainstorm → plan → implement (TDD) → debug/verify/review → finish branch.
You MUST use this before any creative work - creating features, building components, adding functionality, or modifying behavior. Explores user intent, requirements and design before implementation.
Use when facing 2+ independent tasks that can be worked on without shared state or sequential dependencies
Use when you have a written implementation plan to execute in a separate session with review checkpoints
Use when implementation is complete, all tests pass, and you need to decide how to integrate the work - guides completion of development work by presenting structured options for merge, PR, or cleanup
