菜单
Code review for quality, security, performance, and architecture. Use when reviewing code, auditing OWASP, checking SOLID, or finding perf bottlenecks and test gaps.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/laurigates/claude-plugins --skill code-review命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
正在显示 SKILL.md
Install, configure and troubleshoot MCP servers. Use when adding/enabling servers, editing .mcp.json, fixing OAuth, or when a server runs stale code after an upstream fix.
FinOps snapshot — org billing, workflow stats, cache usage. Use when you want a high-level view of CI spending or workflow health before diving deeper.
GitHub Actions billing, workflow efficiency, and waste analysis at org or repo level. Use when investigating CI/CD costs, wasted runs, or optimizing triggers.
基于 SOC 职业分类
| created | "2025-12-16T00:00:00.000Z" |
| modified | "2026-07-04T00:00:00.000Z" |
| reviewed | "2026-07-04T00:00:00.000Z" |
| allowed-tools | Task, TodoWrite, Glob, Read |
| model | opus |
| description | Code review for quality, security, performance, and architecture. Use when reviewing code, auditing OWASP, checking SOLID, or finding perf bottlenecks and test gaps. |
| args | [PATH] |
| argument-hint | [PATH] |
| name | code-review |
| agent | general-purpose |
| context | fork |
| Use this skill when... | Use something else instead when... |
|---|---|
| Running an end-to-end review across quality, security, perf, and tests | Walking a manual security/correctness checklist → code-review-checklist |
| Auditing a directory or PR delta with delegated agent analysis | Specifically scanning for code smells → code-antipatterns |
| Spotting missing test cases or weak assertions | Auditing test code quality on its own → code-test-quality |
| Producing a consolidated review report | Refactoring after the review surfaces issues → code-refactor |
$1 (defaults to current directory if not specified)$1: Path to review (defaults to current directory)Delegate this task to the agents-plugin:review agent.
Use the Agent tool with subagent_type: agents-plugin:review to perform a comprehensive code review.
First, use the Glob tool to discover source files to review:
**/*.py, **/*.js, **/*.ts, **/*.go, **/*.rs for source files**/*test* patterns for test files
Then pass the discovered files to the agent.The code-review agent should:
Analyze code quality:
Security assessment:
Performance evaluation:
Architecture review:
Test coverage gaps:
Apply fixes where appropriate and safe
Re-verify each candidate finding (false-positive gate — run BEFORE reporting):
For every candidate finding from steps 1–5, re-read the cited code at the
reported file:line and confirm the claim actually holds against the current
source — not against a remembered or assumed shape. A finding survives only if
the re-read confirms it; drop the rest. See "Re-verification Pass" below.
Score every surviving finding against the anchors below:
Generate report with:
severity, confidence, and verified file:lineProvide the agent with:
The agent has expertise in:
Score every surviving finding against these anchors. Rank the report most-severe first.
| Severity | Criteria |
|---|---|
| Critical | Exploitable security hole, data loss/corruption, or a crash on a common path. Ship-blocker — must fix before merge. |
| High | A real correctness bug that misbehaves on realistic input, a serious perf regression (N+1, unbounded growth), or an auth/validation gap without a known exploit. Fix before merge. |
| Medium | Bug on an edge case, missing error handling, a test gap over important behavior, or a maintainability problem that will bite soon. Fix or file a follow-up. |
| Low | Style, naming, minor readability, or a nit with no behavioral impact. Optional. |
Assign each finding a confidence and let it gate what reaches the report. A finding whose defect you cannot demonstrate from the code in front of you is a guess, and guesses erode trust in the review.
| Confidence | Meaning | Reporting rule |
|---|---|---|
| High | The defect is provable from the cited code — you can name the input and the wrong result. | Report. |
| Medium | The defect is likely but depends on context you could not fully see. | Report, labeled as needing confirmation. |
| Low | Speculative — a hunch not grounded in the code as read. | Drop, or downgrade to a one-line "consider checking X" note; never present as a defect. |
The reporting threshold is Medium: report High and Medium findings; do not present Low-confidence hunches as findings.
Before the report step, re-check every candidate finding against the actual code. This kills false positives mechanically rather than trusting the initial read:
file:line with Read and confirm the cited code
still says what the finding claims (line numbers drift; assumptions decay).file:line, a severity, and a confidence.For comprehensive review of large codebases, spawn specialized review teammates in parallel:
| Teammate | Focus | Value |
|---|---|---|
| Security reviewer | OWASP, secrets, auth flaws | Deep security analysis without blocking quality review |
| Performance reviewer | N+1 queries, algorithmic complexity, resource leaks | Performance-focused review in parallel |
| Correctness reviewer | Logic errors, edge cases, type safety | Functional correctness in parallel |
This is optional — the skill works without agent teams for standard reviews.
/configure:security/configure:linting/configure:coverage