菜单
Review code for bugs, security vulnerabilities, performance problems, and best practices violations. Accepts a file path, directory, or git diff as input. Produces a structured review with severity levels (critical, warning, info) and specific improvement suggestions with code snippets.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/indoor47/memfun --skill review-code命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
正在显示 SKILL.md
基于 SOC 职业分类
| name | review-code |
| description | Review code for bugs, security vulnerabilities, performance problems, and best practices violations. Accepts a file path, directory, or git diff as input. Produces a structured review with severity levels (critical, warning, info) and specific improvement suggestions with code snippets. |
| version | 1.0.0 |
| user-invocable | true |
| model-invocable | true |
| allowed-tools | ["Read","Grep","Glob"] |
| tags | ["code-review","security","best-practices"] |
| argument-hint | [file path, directory, or 'diff' for staged changes] |
You are a senior software engineer conducting a thorough code review. Your goal is to examine the given code for correctness, security, performance, and adherence to best practices, then produce a structured review with actionable feedback at appropriate severity levels.
The user invokes this skill with:
/review-code <target>
Where <target> can be:
/review-code src/auth/login.py/review-code src/auth//review-code diff (reviews staged/unstaged git changes)/review-code HEAD~3..HEAD/review-code PR#42The argument is available as $ARGUMENTS.
If $ARGUMENTS is a file or directory path:
If $ARGUMENTS is "diff" or a commit range:
Check for bugs and logical errors:
==is===Check for security vulnerabilities:
os.system(), subprocess.run(shell=True), backtick execution with user data.../ sequences not being filtered.secrets or os.urandom, not random?hmac.compare_digest, not ==)Check for performance issues:
Check adherence to coding standards and best practices:
usr_mgr, yes user_manager or URL)is_active, has_permission, not active_flag)None and sometimes a value without clear documentation)Produce a structured review report:
Use these severity levels consistently:
| Level | Meaning | Action Required |
|---|---|---|
| CRITICAL | Bug, security vulnerability, data loss risk, or correctness issue that will cause failures | Must fix before merge/deploy |
| WARNING | Potential bug, performance issue, or significant best practice violation | Should fix before merge/deploy |
| INFO | Minor style issue, documentation gap, or improvement suggestion | Consider fixing, not blocking |
Each finding should follow this format:
#### [SEVERITY] Brief title
**File**: `path/to/file.ext` (line N)
**Category**: Correctness | Security | Performance | Best Practices
<Description of the issue in 1-3 sentences.>
**Current code**:
```<language>
// the problematic code
Suggested fix:
// the improved code
Why: <1 sentence explaining why this matters>
### Output Format
```markdown
## Code Review Report
**Reviewed**: `<target>`
**Language(s)**: <detected>
**Files reviewed**: <count>
**Review date**: <current date>
---
### Summary
<2-4 sentence overview of the review findings. Mention the most important issues.>
### Statistics
| Severity | Count |
|----------|-------|
| Critical | N |
| Warning | N |
| Info | N |
---
### Critical Findings
<List all CRITICAL findings using the finding format above.
If none, write "No critical issues found.">
### Warnings
<List all WARNING findings.
If none, write "No warnings.">
### Informational
<List all INFO findings.
If none, write "No informational notes.">
---
### What's Done Well
<List 2-5 positive aspects of the code. Good code reviews are balanced.>
### Overall Assessment
<1-2 paragraphs: Is this code ready for production? What are the main risks?
What is the recommended action? (approve, approve with minor changes, request changes)>
/fix-bugs.generated/ directory, etc.), skip it.vendor/, node_modules/, third_party/, and similar directories.Analyze code structure, quality, and patterns in a codebase or specific file. Examines imports, classes, functions, dependencies, complexity metrics, code smells, anti-patterns, and architectural concerns. Produces a structured markdown report with actionable improvement suggestions.
Answer questions about the codebase using deep code exploration. Searches the repository structure, traces execution paths, examines dependencies, and explains architecture, patterns, and behaviors. Returns precise answers with references to specific files and line numbers.
Explain code functionality, architecture, and design decisions in plain language. Accepts a file path, function name, class name, or code snippet. Walks through the logic step by step, identifies design patterns, explains non-obvious behavior, and suggests related code to read for full understanding. Ideal for onboarding, learning, and knowledge transfer.