with one click
contextual-review
// Review pull requests for code quality, security vulnerabilities, best practices, and potential issues. Use when reviewing PRs, examining diffs, or providing code review feedback.
// Review pull requests for code quality, security vulnerabilities, best practices, and potential issues. Use when reviewing PRs, examining diffs, or providing code review feedback.
[HINT] Download the complete skill directory including SKILL.md and all related files
| name | contextual-review |
| description | Review pull requests for code quality, security vulnerabilities, best practices, and potential issues. Use when reviewing PRs, examining diffs, or providing code review feedback. |
Perform comprehensive reviews of code changes, implementation plans, and architecture decisions. Analyzes for quality, correctness, security, and adherence to project standards.
Before reviewing any code, read base-review.md. It establishes:
The base guidelines apply to ALL reviews. Area-specific guides add targeted checklists.
Based on what files changed, consult the appropriate reference:
| Changed Files | Reference |
|---|---|
platform/docs/ | docs-review.md - Documentation review guidelines |
platform/flowglad-next/src/db/schema/, openapi.json, api-contract/ | api-review.md - Data model and API review |
packages/ | packages-review.md - SDK package review |
playground/ | playground-review.md - Example project review |
platform/flowglad-next/ | platform-review.md - Main platform review |
For reviewing implementation plans before code is written:
| Review Type | Reference |
|---|---|
| Gameplans / Implementation Plans | gameplan-review.md - Pre-implementation plan review |
Read the relevant reference file(s) based on the diff to get area-specific checklists and guidelines.
Run gh pr checkout <PR> to get the PR code locally. If it fails, continue with the review.
First, understand the scope of changes:
# Get the diff statistics to understand what files changed
GetWorkspaceDiff with stat: true
# Then examine individual file changes
GetWorkspaceDiff with file: 'path/to/file'
Analyze changes across these dimensions:
| Category | Focus Areas |
|---|---|
| Correctness | Logic errors, edge cases, null handling, off-by-one errors |
| Security | Input validation, injection risks, auth/authz, secrets exposure |
| Performance | N+1 queries, unnecessary loops, missing indexes, memory leaks |
| Maintainability | Code clarity, naming, DRY violations, complexity |
| Testing | Test coverage, edge cases tested, test quality |
| Types | Type safety, proper typing, avoiding any |
For this codebase, also verify:
bun instead of npm or yarnmigrations:generate, never manual migrations.spyOn or dynamic importsany types in testsit block should have specific assertions, not toBeDefinedit with exhaustive assertionsUse the DiffComment tool to leave targeted feedback:
DiffComment({
comments: [
{
file: "path/to/file.ts",
lineNumber: 42,
body: "Potential SQL injection vulnerability. Consider using parameterized queries."
}
]
})
any without justification)Provide a structured review with:
## Summary
This PR adds user authentication using JWT tokens with refresh token support.
## Findings
### Critical
- **src/auth/token.ts:45**: JWT secret is hardcoded. Move to environment variable.
### High
- **src/auth/login.ts:23**: Missing rate limiting on login endpoint.
### Medium
- **src/auth/validate.ts:12**: Token expiration check should use `<=` not `<` to handle exact expiration time.
### Suggestions
- Consider adding request ID to auth logs for debugging.
## Positive Notes
- Good separation of concerns between token generation and validation
- Comprehensive error types for different auth failures
## Recommendation
**Request Changes** - Address the critical security issue before merging.
gh pr checkout <PR> (continue if it fails)GetWorkspaceDiff(stat: true)DiffComment for inline feedback