메뉴
Comprehensive code review guidance across frontend, backend, systems, architecture, quality, performance, and security.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
| name | code-review-skill |
| category | audit |
| description | Comprehensive code review guidance across frontend, backend, systems, architecture, quality, performance, and security. |
Transform code reviews from gatekeeping to knowledge sharing through constructive feedback, systematic analysis, and collaborative improvement.
Goals of Code Review:
Not the Goals:
Good Feedback is:
❌ Bad: "This is wrong."
✅ Good: "This could cause a race condition when multiple users
access simultaneously. Consider using a mutex here."
❌ Bad: "Why didn't you use X pattern?"
✅ Good: "Have you considered the Repository pattern? It would
make this easier to test. Here's an example: [link]"
❌ Bad: "Rename this variable."
✅ Good: "[nit] Consider `userCount` instead of `uc` for
clarity. Not blocking if you prefer to keep it."
What to Review:
What Not to Review Manually:
Before diving into code, understand:
For large diffs, pipe the diff through
scripts/pr-analyzer.py(git diff main...HEAD | python scripts/pr-analyzer.py) to triage complexity and get a suggested review approach before reading.
For each file, check:
Use checklists for consistent reviews. See Security Review Guide for comprehensive security checklist.
Instead of stating problems, ask questions:
❌ "This will fail if the list is empty."
✅ "What happens if `items` is an empty array?"
❌ "You need error handling here."
✅ "How should this behave if the API call fails?"
Use collaborative language:
❌ "You must change this to use async/await"
✅ "Suggestion: async/await might make this more readable. What do you think?"
❌ "Extract this into a function"
✅ "This logic appears in 3 places. Would it make sense to extract it?"
Use labels to indicate priority:
[blocking] - Must fix before merge[important] - Should fix, discuss if disagree[nit] - Nice to have, not blocking[suggestion] - Alternative approach to consider[learning] - Educational comment, no action needed[praise] - Good work, keep it up!Severity levels: 🔴 / 🟡 / 🟢 are the three severity tiers used as the standard across all guides in this skill — 🔴 blocks the merge, 🟡 should be addressed, 🟢 is optional. The remaining markers (💡 / 📚 / 🎉) are non-blocking annotations.
根据审查的代码语言，查阅对应的详细指南：
| Language/Framework | Reference File | Key Topics |
|---|---|---|
| React | React Guide | Hooks, useEffect, React 19 Actions, RSC, Suspense, TanStack Query v5 |
| Vue 3 | Vue Guide | Composition API, 响应性系统, Props/Emits, Watchers, Composables |
| Angular 17+ | Angular Guide | Signals, Standalone, RxJS, Zoneless, 模板优化, 测试, 路由守卫, HttpInterceptor |
| Rust | Rust Guide | 所有权/借用, Unsafe 审查, 异步代码, 取消安全性, 错误处理 |
| TypeScript | TypeScript Guide | 类型安全, async/await, 不可变性, 测试, 模块解析, TS 5.x |
| Python | Python Guide | 可变默认参数, 异常处理, 类属性 |
| Django / DRF | Django Guide | 安全审查, N+1 查询, Serializer 反模式, ViewSet, 异步视图 |
| FastAPI | FastAPI Guide | Depends, Pydantic v2 validation, async correctness, sessions/N+1, auth vs authorization, test-driven verification |
| Java | Java Guide | Java 17/21 新特性, Spring Boot 3, 虚拟线程, Stream/Optional |
| Java 8 / Legacy | Java 8 Guide | Java 8, Spring Boot 2, javax.*, Stream/Optional, java.time, CompletableFuture |
| PHP | PHP Guide | PHP 8.x type system, PDO, security review, Composer, PHPUnit/PHPStan |
| Ruby / Rails | Ruby Guide | Ruby semantics, Rails 8, Active Record, Active Job, security, testing |
| C# / .NET | C# Guide | C# 12 特性, 异步编程, EF Core 性能, ASP.NET Core, LINQ |
| Go | Go Guide | 错误处理, goroutine/channel, context, 接口设计 |
| Kotlin / Android | Kotlin Guide | 协程, Flow, Jetpack Compose, 空安全, 内存泄漏, 架构模式 |
| Swift / SwiftUI | Swift Guide | Optionals, Swift Concurrency, Sendable/actors, SwiftUI property wrappers, value vs reference types, API design |
| NestJS | NestJS Guide | 依赖注入, 分层架构, DTO 验证, Guard/Interceptor, 循环依赖 |
| Svelte / SvelteKit | Svelte Guide | Runes, Load 函数, Form Actions, Store 迁移, SSR/CSR 边界 |
| C | C Guide | 指针/缓冲区, 内存安全, UB, 安全编码, 可移植性, 测试 |
| C++ | C++ Guide | RAII, 智能指针, C++20/23, constexpr, 测试 |
| Zig | Zig Guide | Allocators, error unions, defer/errdefer, comptime, C interop |
| CSS/Less/Sass | CSS Guide | 变量规范, !important, 性能优化, 响应式, 兼容性 |
| Qt | Qt Guide | 对象模型, 信号/槽, Model/View, QML, Qt6 迁移, 测试 |
Language-agnostic patterns applicable to all code reviews:
| Topic | Reference File | Key Topics |
|---|---|---|
| Architecture Review | Architecture Review Guide | SOLID, anti-patterns, coupling/cohesion, dependency direction |
| Performance Review | Performance Review Guide | Web Vitals, N+1, algorithm complexity, memory leaks, caching |
| Security Review | Security Review Guide | SQLi, XSS, CSRF, SSRF, IDOR, 命令注入, 跨语言示例 |
| Universal Quality | Universal Quality Guide | Reuse audit, parameter sprawl, leaky abstractions, nested conditionals, stringly-typed code, TOCTOU, no-op updates, redundant state |
| Common Bugs | Common Bugs Checklist | Language-specific bug patterns, common pitfalls |
| SQL Injection Prevention | SQL Injection Guide | Parameterized queries, ORM safety, 6 languages, dynamic identifiers, detection |
| XSS Prevention | XSS Prevention Guide | Output encoding, CSP, 5 frameworks, input validation vs encoding, detection |
| N+1 Queries | N+1 Queries Guide | Eager loading, batch fetching, DataLoader, 5 languages, detection |
| Error Handling | Error Handling Guide | Fail fast, error hierarchy, 7 languages, anti-patterns, logging |
| Async & Concurrency | Concurrency Guide | Goroutines, async/await, actors, structured concurrency, 7 languages |
| Review Best Practices | Code Review Best Practices | Communication, reviewer mindset, giving feedback, severity labels |
Security audit workflow for authorized Java, .NET, PHP source and deployment artifact review.
Professional code security audit skill covering 55+ vulnerability types. Enhanced with WooYun 88,636 real-world vulnerability cases (2010-2016). This skill should be used when performing security audits, vulnerability scanning, penetration testing preparation, or code review for security issues. Supports 9 languages: Java, Python, Go, PHP, JavaScript/Node.js, C/C++, .NET/C#, Ruby, Rust. Includes 143 mandatory detection items across all languages with language-specific checklists. Covers SQL injection, XSS, RCE, deserialization, SSRF, JNDI injection, JDBC protocol injection, authentication bypass, business logic flaws, race conditions, and modern security domains (LLM, Serverless, Android). WooYun integration adds: statistical-driven parameter priority, bypass techniques library, logic vulnerability patterns, and real-case references. v1.0: Initial public release with Docker deployment verification framework.
Provides AI and machine learning techniques for CTF challenges. Use when attacking ML models, crafting adversarial examples, performing model extraction, prompt injection, membership inference, training data poisoning, fine-tuning manipulation, neural network analysis, LoRA adapter exploitation, LLM jailbreaking, or solving AI-related puzzles.
Provides cryptography attack techniques for CTF challenges. Use when attacking encryption, hashing, signatures, ZKP, PRNG, or mathematical crypto problems involving RSA, AES, ECC, lattices, LWE, CVP, number theory, Coppersmith, Pollard, Wiener, padding oracle, GCM, key derivation, or stream/block cipher weaknesses.
Provides digital forensics and signal analysis techniques for CTF challenges. Use when analyzing disk images, memory dumps, event logs, network captures, cryptocurrency transactions, steganography, PDF analysis, Windows registry, Volatility, PCAP, Docker images, coredumps, side-channel power traces, DTMF audio spectrograms, packet timing analysis, CD audio disc images, or recovering deleted files and credentials.
Provides malware analysis and network traffic techniques for CTF challenges. Use when analyzing obfuscated scripts, malicious packages, custom crypto protocols, C2 traffic, PE/.NET binaries, RC4/AES encrypted communications, YARA rules, shellcode analysis, memory forensics for malware (Volatility malfind, process injection detection), anti-analysis techniques (VM/sandbox detection, timing evasion, API hashing, process injection, environment checks), or extracting malware configurations and indicators of compromise.
SOC 직업 분류 기준
