Code Review Skill

When to use this skill

Use this skill when you need to review code quality, identify potential issues, suggest improvements, or perform comprehensive code analysis. Works with various programming languages and frameworks.

How to perform code review

Basic Code Review

1. Input: Provide code file or code snippet
2. Analyze: Check for syntax, style, and logic issues
3. Score: Provide quality metrics and recommendations
4. Report: Generate detailed review report

Parameters

• code (required): The code to review
• language (optional): Programming language (auto-detected if not specified)
• focus_areas (optional): Array of areas to focus on - ["security", "performance", "style", "maintainability"]
• severity_level (optional): Minimum issue severity to report - ["low", "medium", "high", "critical"] (default: "medium")

Example

Request: "Review this Python function for security and performance issues"
Parameters: {
  "code": "def process_user_data(data):\n    return eval(data)",
  "language": "python",
  "focus_areas": ["security", "performance"],
  "severity_level": "medium"
}

Security Review Focus

For security-focused reviews, this skill checks:

• Injection vulnerabilities: SQL injection, command injection, XSS
• Authentication flaws: Weak authentication mechanisms
• Data exposure: Sensitive data leaks or logging
• Cryptographic issues: Weak encryption or hashing
• Input validation: Missing input sanitization

Performance Review Focus

For performance-focused reviews:

• Algorithm efficiency: Big O complexity analysis
• Memory usage: Memory leaks and optimization opportunities
• Database queries: Query optimization suggestions
• Caching strategies: Missing or inefficient caching
• Concurrency issues: Race conditions and deadlock potential

Style and Best Practices

Code style and maintainability checks:

• Naming conventions: Consistent variable/function naming
• Code structure: Proper organization and modularity
• Documentation: Missing or inadequate comments/docs
• Error handling: Proper exception management
• Testing coverage: Missing test cases or test quality

Output Format

The skill returns a structured review containing:

{
  "overall_score": 8.5,
  "summary": "Code is well-structured but has security concerns",
  "issues": [
    {
      "severity": "high",
      "category": "security", 
      "line": 3,
      "description": "Use of eval() poses security risk",
      "suggestion": "Replace with safer parsing logic"
    }
  ],
  "metrics": {
    "complexity": "low",
    "maintainability": "good",
    "test_coverage": "missing"
  },
  "recommendations": [
    "Add input validation for data parameter",
    "Implement unit tests for edge cases",
    "Replace eval() with json.loads() for JSON data"
  ]
}

Multi-language Support

This skill can review code in:

• Python: PEP 8 compliance, security best practices
• JavaScript: ES6+ standards, async/await patterns
• Java: Clean code principles, Spring Boot patterns
• TypeScript: Type safety and interface design
• Go: Idiomatic Go patterns and error handling
• C++: Modern C++ standards and memory management
• C#: .NET conventions and async patterns

Integration with Development Tools

The skill can integrate with:

scripts/lint-runner.py

Runs language-specific linters and formatters:

• pylint for Python
• ESLint for JavaScript
• SonarLint for Java
• golint for Go

scripts/test-generator.py

Generates test cases based on code analysis:

• Unit test templates
• Integration test scenarios
• Edge case identification

scripts/security-scanner.py

Static analysis security tools:

• Bandit for Python security
• Semgrep for pattern matching
• Custom security rules

Review Templates

Pre-defined review templates for common scenarios:

Web Application Review

Focus on web security, authentication, and API patterns.

Data Processing Review

Focus on data validation, performance, and error handling.

Library/SDK Review

Focus on API design, backward compatibility, documentation.

Configuration Options

Customize review criteria:

review_config:
  min_score_threshold: 7.0
  ignore_patterns:
    - "TODO:"
    - "FIXME:"
  custom_rules:
    - name: "no_hardcoded_secrets"
      pattern: "(password|secret|key)"
      action: "flag"

Best Practices Checklist

The skill checks for:

✅ Security: No hardcoded secrets, proper input validation
✅ Performance: Efficient algorithms, proper resource usage
✅ Style: Consistent formatting, clear naming
✅ Testing: Adequate test coverage, edge cases
✅ Documentation: Clear comments, API docs
✅ Error Handling: Proper exceptions, logging
✅ Dependencies: Up-to-date, secure versions

Use this skill to ensure code quality and catch issues early in the development process.