菜单
Reviews current git changes with a senior engineer lens. Detects SOLID violations, YAGNI/DRY/KISS breaches, security risks, performance issues, and proposes actionable improvements. Use when reviewing pull requests, checking code quality before merging, or auditing changes for security vulnerabilities.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/costa-marcello/skillkit --skill review-code命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
基于 SOC 职业分类
Guides users through creating effective Claude Code skills with specialized knowledge, workflows, and tool integrations. Use when users want to create a new skill, update an existing skill, extract business logic into reusable packages, or ask about skill structure, frontmatter, or bundled resources.
Extracts text and tables from PDFs, creates new documents, merges/splits files, fills forms, and converts markdown to PDF. Use when working with PDF files, when the user mentions PDFs, document extraction, form filling, OCR, or markdown-to-PDF conversion.
Creates, edits, and analyses PowerPoint presentations with layouts, speaker notes, and design elements. Use when working with .pptx files, creating presentations from topics, modifying slides, or extracting content. Triggers: 'create presentation from topic', 'slide deck from document', 'powerpoint from scratch'.
正在显示 SKILL.md
| name | review-code |
| description | Reviews current git changes with a senior engineer lens. Detects SOLID violations, YAGNI/DRY/KISS breaches, security risks, performance issues, and proposes actionable improvements. Use when reviewing pull requests, checking code quality before merging, or auditing changes for security vulnerabilities. |
| license | MIT |
Review current git changes with focus on SOLID, engineering best practices (YAGNI, DRY, KISS), architecture, removal candidates, and security risks. Default to review-only output unless the user asks to implement changes.
| Level | Name | Description | Action |
|---|---|---|---|
| P0 | Critical | Security vulnerability, data loss risk, correctness bug | Must block merge |
| P1 | High | Logic error, significant SOLID violation, performance regression | Should fix before merge |
| P2 | Medium | Code smell, maintainability concern, minor SOLID violation | Fix in this PR or create follow-up |
| P3 | Low | Style, naming, minor suggestion | Optional improvement |
Verdict mapping: Any P0 or P1 finding = REQUEST_CHANGES. P2 findings only = COMMENT. No findings = APPROVE.
git status -sb, git diff --stat, and to scope changes.git diffGrep to find related modules, usages, and contracts when the diff touches shared interfaces or exports.Review approach — review the code, not the diff. Follow control flow via goto definition rather than reading in textual diff order. Understand the change in context of the surrounding system, not as an isolated patch.
Edge cases:
git diff is empty, ask the user whether to review staged changes (git diff --cached) or a specific commit range.references/solid-checklist.md for specific prompts.references/best-practices-checklist.md for specific prompts.a.b.c.d()).references/removal-plan.md for template.Grep for functions, classes, and exports added or touched in the diff. Check each has at least one caller outside its own file.references/security-checklist.md for coverage.references/code-quality-checklist.md for coverage.Structure the review as follows:
## Code Review Summary
**Files reviewed**: X files, Y lines changed
**Overall assessment**: [APPROVE / REQUEST_CHANGES / COMMENT]
---
## Findings
### P0 - Critical
(none or list)
### P1 - High
- **[file:line]** Brief title
- Description of issue
- Suggested fix
### P2 - Medium
...
### P3 - Low
...
---
## Removal/Iteration Plan
(if applicable)
## Additional Suggestions
(optional improvements, not blocking)
Inline comments: When providing file-specific findings outside the summary table, use this format:
[P1] path/to/file.ts:42 -- Description of the issue and suggested fix.
Clean review: If no issues found, state:
After presenting findings, ask user how to proceed:
---
## Next Steps
I found X issues (P0: _, P1: _, P2: _, P3: _).
**How would you like to proceed?**
1. **Fix all** - I'll implement all suggested fixes
2. **Fix P0/P1 only** - Address critical and high priority issues
3. **Fix specific items** - Tell me which issues to fix
4. **No changes** - Review complete, no implementation needed
Do NOT implement changes until the user confirms. This is a review-first workflow.
Files reviewed: 2 files, 18 lines changed Overall assessment: APPROVE
(none)
(none)
(none)
(none)
Files reviewed: 5 files, 142 lines changed Overall assessment: REQUEST_CHANGES
(none)
getSession(id) retrieves any session regardless of tenantWHERE tenant_id = ? to the query or validate tenant after fetchmaxAge parameter, default to 300 seconds50 used for pagination limit
const DEFAULT_PAGE_SIZE = 50
Files reviewed: 12 files, 847 lines changed Overall assessment: REQUEST_CHANGES
Batch summary (reviewed by module):
| Module | Files | Lines | Findings |
|---|---|---|---|
| auth | 3 | 280 | 1x P1, 2x P2 |
| payments | 4 | 340 | 1x P0, 1x P3 |
| shared/utils | 5 | 227 | 2x P2 |
SELECT FOR UPDATE or use atomic UPDATE ... WHERE balance >= amountaud claim not validated
audience check to jwt.verify() options
The diff adds a withdrawFunds handler in src/api/accounts.ts. Rather than reading the diff top-to-bottom, follow the control flow:
POST /accounts/:id/withdraw calls withdrawFunds(req, res).const account = await Account.findById(id) fetches balance.account.balance -= amount; await account.save().This is a check-then-act (TOCTOU) race condition. Graded P0 because it affects financial data integrity. The fix is to wrap the read and write in a database transaction with SELECT ... FOR UPDATE, or use an atomic update: UPDATE accounts SET balance = balance - ? WHERE id = ? AND balance >= ?.
This example shows the review approach: trace data flow from entry point through state mutation, check for atomicity gaps, then grade by impact.
| File | Purpose |
|---|---|
solid-checklist.md | SOLID smell prompts and refactor heuristics |
security-checklist.md | Web/app security and runtime risk checklist |
code-quality-checklist.md | Error handling, performance, boundary conditions |
best-practices-checklist.md | YAGNI, DRY, KISS, Law of Demeter, composition, fail fast |
removal-plan.md | Template for deletion candidates and follow-up plan |