ffsshhttiikk
ffsshhttiikk/opencode-agents-skills
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/ffsshhttiikk/opencode-agents-skills --skill code-review命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
基于 SOC 职业分类
正在显示 SKILL.md
| name | code-review |
| description | Code review best practices and guidelines |
| license | MIT |
| compatibility | opencode |
| metadata | {"audience":"developers","category":"code-quality"} |
When performing code reviews or addressing feedback.
**High: SQL Injection Vulnerability**
The user input is directly concatenated into the SQL query:
```python
query = f"SELECT * FROM users WHERE email = '{email}'"
Risk: An attacker could inject malicious SQL to extract or modify database data.
Fix: Use parameterized queries:
cursor.execute("SELECT * FROM users WHERE email = ?", (email,))
Required change - this is a security issue that must be fixed before merge.
### Improvement Suggestion
```markdown
**Medium: Consider using a context manager**
The current code manually manages the database connection:
```python
connection = get_db_connection()
try:
process_data(connection)
finally:
connection.close()
Suggestion: Using a context manager ensures proper cleanup even on exceptions:
with get_db_connection() as connection:
process_data(connection)
This is more Pythonic and handles edge cases automatically. Not blocking, but recommended.
### Style/Convention
```markdown
**Low: Line length**
This line exceeds our 100 character limit:
```python
some_function(argument_one, argument_two, argument_three=some_value, argument_four=other_value)
Fix: Break onto multiple lines:
some_function(
argument_one,
argument_two,
argument_three=some_value,
argument_four=other_value,
)
We use Black formatter - running black . will auto-fix this.
### Positive Reinforcement
```markdown
**Great work!** The error handling here is excellent. Using a custom exception hierarchy makes the code very clear about what can go wrong and where. Thanks for the thorough docstrings too!
[] Code compiles/runs without errors
[] Tests pass (unit, integration, e2e)
[] No security vulnerabilities
[] Performance is acceptable
[] Follows naming conventions
[] Adequate error handling
[] Input validation present
[] No hardcoded secrets
[] No debug code left in
[] Documentation updated
[] Comments are helpful
[] No dead code
[] No code duplication
[] Logging is appropriate
[] Metrics/monitoring if needed