菜单
Conduct systematic code reviews and audits including automated checks, security audits, compliance verification, and review checklists. Use when reviewing pull requests, performing security audits, verifying coding standards compliance, or setting up automated code review workflows.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Rewrite working code into its minimal, elegant form -- lower cyclomatic complexity, fewer lines, no dead code, no needless abstractions -- using a Draft -> Optimize -> Verify loop. Use when asked to compress, minimize, simplify, or make code more elegant WITHOUT sacrificing correctness, boundary validation, or readability.
Scan recent changes for AI-generated slop -- redundant comments, over-abstraction, generic UI defaults, and design tells -- and optionally apply safe automated fixes. Use after a code-generation or refactor pass to remove the visible signs of machine authorship before review.
Produce production-grade Product Requirements Documents (PRDs) that bridge business vision and technical execution. Use when writing, reading, reviewing, or extending a PRD -- by Product Manager agents authoring one, or by Architect/UX/Engineer/Agent-X agents that need to consume or fact-check PRD conventions without loading the full PM agent contract.
Fan out independent work to multiple subagents with context isolation. Covers when to parallelize (independent reads, multi-file searches, parallel analysis), when not to (writes, dependent steps, shared mutable state), bounded concurrency limits, and the anti-patterns that turn parallel dispatch into corruption. Use whenever the active agent is tempted to run more than one subagent at the same time.
Build production-ready AI agents with Microsoft Foundry and Agent Framework. Use when creating AI agents, selecting LLM models, implementing agent orchestration, adding tracing/observability, or evaluating agent quality. Covers agent architecture, model selection, multi-agent workflows, and production deployment.
Implement production applications with Anthropic Claude models -- Messages API, tool use, prompt caching, extended thinking, vision, computer use, and the Claude Agent SDK. Use when coding directly against Anthropic APIs, Claude via AWS Bedrock, or Claude via GCP Vertex AI rather than a higher-level framework.
| name | code-review |
| description | Conduct systematic code reviews and audits including automated checks, security audits, compliance verification, and review checklists. Use when reviewing pull requests, performing security audits, verifying coding standards compliance, or setting up automated code review workflows. |
Purpose: Systematic validation of implementations against production guardrails. Focus: Self-review automation, manual review checklists, security audits, compliance verification.
Common excuses reviewers use to ship work that should have been returned. Push back against each.
| Rationalization | Reality |
|---|---|
| "The author is senior, the code is probably fine." | Seniority is not evidence. Read the diff, run the tests, check the spec. |
| "It passed CI, I'll skim and approve." | CI proves nothing failed, not that the right thing was built. Pass A (spec compliance) is on the reviewer, not CI. |
| "The diff is huge, I'll trust the high-signal parts." | Large diffs hide the dangerous changes in the noise. Ask for a smaller PR or block out time to read it all. |
| "It's only test code / docs / config." | Test code that does not actually exercise the change is worse than no tests. Config and infra diffs cause most production incidents. |
| "The author already addressed it once, requesting changes again is rude." | Reviewer politeness is not a quality gate. If the rework still does not meet the bar, say so. |
| "We can fix it in a follow-up." | Almost never happens. Either it blocks merge or it becomes durable tech debt; pick consciously and record the debt item. |
| "Pass A and Pass B both look fine, I'll write 'LGTM'." | A review with no findings and no evidence of having run the code reads as a rubber stamp. Cite at least the verification steps you performed. |
Review request received?
+-- PR size?
| +-- > 400 lines -> Ask author to split into smaller PRs
| +-- 100-400 lines -> Full review with checklist
| +-- < 100 lines -> Quick review (focus: correctness + tests)
+-- Review type?
| +-- Security audit -> Use OWASP checklist, run SAST tools
| +-- Architecture review -> Check SOLID, patterns, ADR compliance
| +-- Bug fix review -> Verify regression test exists first
| +-- Feature review -> Full checklist (quality + security + tests)
+-- Automated checks passing?
| +-- No -> Send back before manual review
| +-- Yes -> Proceed with manual review
+-- Approval decision?
+-- No issues -> Approve
+-- Minor issues -> Approve with comments
+-- Major issues -> Request changes with clear guidance
Exception)Pre-Review Command:
dotnet format --verify-no-changes && \
dotnet build && \
dotnet test --collect:"XPlat Code Coverage" && \
dotnet list package --vulnerable --include-transitive
Security Scan:
grep -rn "password.*=.*\"" . --include=*.cs
dotnet list package --vulnerable
Coverage Check:
dotnet test --collect:"XPlat Code Coverage"
reportgenerator -reports:"**/coverage.cobertura.xml" -targetdir:"coverage"
See Also: AGENTS.md - Testing - Security - Remote Git Ops
Last Updated: January 13, 2026
| Script | Purpose | Usage |
|---|---|---|
run-checklist.ps1 | Automated code review checklist (large files, TODOs, secrets, tests) | ./scripts/run-checklist.ps1 [-Path ./src] |
| Issue | Solution |
|---|---|
| False positives from linters | Configure rule exclusions in .eslintrc or .editorconfig |
| Review backlog growing | Set SLA for review turnaround, use auto-assignment for reviewers |
| Security scan too slow | Run SAST incrementally on changed files only in CI pipeline |