菜单
Review code with fresh eyes for correctness, security, and maintainability. Generate standalone prompts for Claude, Gemini, and Codex. Use when reviewing PRs, commits, staged changes, or auditing code.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Declare what the system should be before writing code. Use when building new features, redesigning feature areas, or making significant changes that need a declaration of intent. Guides the declaration chain from findings through plans.
Wear the QA hat — think about quality the way a 15-year senior QA thinks. Use when building features, reviewing work, validating output, or when anything feels "done" but hasn't been proven to work. Prevents the gap between "it runs" and "it works."
Evidence-first research with mandatory citations and source evaluation. Use when gathering information for decisions, comparing approaches, investigating unknowns, or any task requiring verified evidence from multiple sources. Invoke at the START of research, not when writing up results.
Check and invoke available skills before starting work. Invoke at the start of any task to ensure relevant skills are loaded.
Effective Mermaid diagrams. Use when creating markdown documents with human audiences.
Guides effective documentation creation. Activates relevant guidance for north-star, gestalt, reference, research, design, plan, flow, findings, concepts, or process documents. Prevents cascading harm from wrong information.
| name | code-review |
| description | Review code with fresh eyes for correctness, security, and maintainability. Generate standalone prompts for Claude, Gemini, and Codex. Use when reviewing PRs, commits, staged changes, or auditing code. |
| context | fork |
| allowed-tools | ["Read","Glob","Grep","Skill","Bash(git diff:*)","Bash(git show:*)","Bash(git log:*)","Bash(gh pr diff:*)","Bash(gh pr view:*)","Bash(mkdir:*)","Bash(ls:*)","Write"] |
Runs as Sub-Agent
This skill uses
context: forkto run in an isolated sub-agent. This saves tokens in the main conversation—you perform the review and return only the summary.
First: Invoke the writing-documents skill. Your review output is a findings document.
Start here: Read references/disconnection.md. The fresh-eyes mindset is the core skill.
Invariant A disconnected review ignores what you know and examines only what the code shows.
Example You helped write a feature over 10 messages. For the review, you are a new hire seeing the code for the first time. You question what seems obvious. You find what the author missed because they were too close. //BOUNDARY: Disconnection is not ignorance. You gather fresh context; you don't ignore context entirely.
Invariant A prompt is standalone when it produces useful output without any prior conversation context.
Example Bad: "Review the authentication changes we discussed." Good: "Review the following authentication code for OWASP Top 10 vulnerabilities. Code: [inline code or file paths]." //BOUNDARY: Self-contained is not exhaustive. Scope and focus, not every detail.
Determine the diff to review:
$ARGUMENTS provided: Review that file, commit, or PRgit diff --cachedgit diffFor each file changed:
| Category | What to Examine |
|---|---|
| Functionality | Does code do what it claims? Edge cases? |
| Security | OWASP Top 10, auth, input validation |
| Design | Patterns, coupling, separation of concerns |
| Maintainability | Naming, complexity, modularity |
| Performance | Bottlenecks, resource usage, scaling |
| Testing | Coverage, edge cases, assertions |
New code often duplicates existing utilities. Search the codebase:
utils/, helpers/, lib/, common/, shared/If existing utilities could replace new code, flag it.
Write a findings document using writing-documents guidance.
Use visual prefixes for scannability:
| Prefix | Meaning | Author Action |
|---|---|---|
🔴 Blocking: | Must fix before merge | Required |
🟡 Consider: | Strong suggestion | Author decides |
🟢 Nit: | Minor polish | Optional |
❓ Question: | Need clarification | Please respond |
Weak: "Use a map here"
Strong: "🟡 Consider: src/users.ts:34 — This list scan is O(n) per loop iteration, making the overall operation O(n²). With 10k users, that's 100M comparisons. A Map gives O(1) lookup."
🔴 Blocking: `src/api/query.ts:12` — SQL injection vulnerability.
User input is concatenated directly into the query.
Instead of:
`db.query("SELECT * FROM users WHERE id = " + userId)`
Use parameterized queries:
`db.query("SELECT * FROM users WHERE id = ?", [userId])`
Before generating prompts, ensure output directory exists:
.codereview/ in repo root.codereview/ to .gitignoreFile naming convention:
.codereview/YYYY-MM-DD_HH-MM-SS_{repo-name}_{agent}_Review.md
## Summary
[1-2 sentences: what this change does and overall assessment]
**Verdict: APPROVE / REQUEST CHANGES / NEEDS DISCUSSION**
---
## Blocking Issues
[Must fix — omit section if none]
### 🔴 [Brief issue title]
`file:line`
[Explanation of problem and why it matters]
**Fix:**
[Concrete suggestion or code example]
---
## Suggestions
[Strong recommendations — omit section if none]
### 🟡 [Brief issue title]
`file:line`
[Explanation and reasoning]
---
## Minor Notes
[Nits and questions — omit section if none]
- 🟢 `file:line` — [Brief note]
- ❓ `file:line` — [Question]
Three separate prompts optimized for:
references/prompts/claude.md — XML structure, extended thinkingreferences/prompts/gemini.md — Direct style, role-anchoredreferences/prompts/codex.md — JSON output, priority levelsWhen returning your review to the main conversation, recommend invoking review-responder to process findings:
To address these findings, invoke the
review-responderskill with this review.
references/disconnection.md — How to achieve fresh perspectivereferences/criteria.md — Detailed review criteria by categoryreferences/prompts/ — AI-specific prompt templatesReview what IS, not what was meant. Continuous improvement, not perfection.