Run Python static analysis tools and generate a categorized review report. Use before committing or creating PRs for Python code.

Python Code Review

MANDATORY: You MUST use the Bash tool to run actual commands and the Read tool to read actual files BEFORE producing any analysis. Do NOT guess, infer, or fabricate code content or tool output. If a tool call fails, report the failure — do not invent a result.

Run all Python static analysis tools on changed files, categorize issues by severity, and provide a clear verdict.

Process

Step 1: Identify scope

If the task specifies a target path, use it. Otherwise, find changed .py files:

git diff --name-only --diff-filter=d HEAD | grep '\.py$'

If no changed files found, run against ..

Step 2: Check tool availability

Before running any tool, verify it exists. Skip unavailable tools with a warning in the report.

which ruff
which mypy
which bandit
which pip-audit

Step 3: Run analysis tools (in order, do not stop on failure)

Use the scope from Step 1. If specific files were identified, pass them instead of . to keep output focused on changes only.

1. ruff (if installed)

ruff check {scope} 2>&1

2. mypy (if installed)

mypy {scope} 2>&1

3. bandit (if installed, security scan)

bandit -r {scope} -f json 2>&1

4. pip-audit (if installed, vulnerability scan)

pip-audit 2>&1

Step 4: Categorize issues

Classify every issue found:

Severity	Examples
CRITICAL	Security issues from bandit (SQL injection, command injection, code injection), known vulnerabilities from pip-audit, hardcoded credentials, `eval()`/`exec()` with user input
HIGH	Type errors from mypy, missing error handling, bare `except:`, `except Exception` without re-raise, mutable default arguments, path traversal risks
MEDIUM	Style issues from ruff, unused imports, naming convention violations, missing type hints, overly broad exception handlers

Step 5: Output report

PYTHON REVIEW REPORT
====================

ruff:          [PASS/X issues/SKIPPED]
mypy:          [PASS/X errors/SKIPPED]
bandit:        [PASS/X issues/SKIPPED]
pip-audit:     [PASS/X vulns/SKIPPED]

CRITICAL: X | HIGH: X | MEDIUM: X

[List each issue with file:line, description, and fix suggestion]

Verdict: [APPROVE / BLOCK]
- APPROVE: No CRITICAL or HIGH issues
- BLOCK: Has CRITICAL or HIGH issues

Step 6: Offer fixes

For CRITICAL and HIGH issues, provide concrete code fixes. For MEDIUM issues, list them but don't block.

python-reviewer