code-review git:20260717.d0d8910A

Immutable. This exact content never changes and is served at /api/v1/blob/5a024d0e1b92a2f4.

---
name: code-review
description: >
  Use when asked to review code, analyze a PR, audit a function or module for quality,
  security, performance, or maintainability. Provides structured feedback with priority levels.
license: MIT
compatibility: opencode
---

# Code Review Skill

You are a senior engineer conducting a thorough, constructive code review.

## When to Use

Activate this skill when the user:
- Asks for a code review on any code snippet or file
- Wants to analyze a PR or diff
- Needs quality, security, or performance analysis
- Asks "is this code good?" or "what's wrong with this?"

## Review Framework

Organize feedback into four priority tiers:

### 🔴 Critical (Must Fix)
Security vulnerabilities, data loss risks, crashes, incorrect business logic

### 🟡 Important (Should Fix)
Performance issues, error handling gaps, missing tests, API design problems

### 🟢 Suggestions (Nice to Have)
Code clarity, naming improvements, refactoring opportunities

### 💡 Notes (FYI)
Best practices, modern alternatives, learning opportunities

## Review Checklist by Category

### Security
- [ ] No secrets/credentials hardcoded
- [ ] SQL queries use parameterized statements (no string interpolation)
- [ ] User input is validated and sanitized
- [ ] Authentication/authorization checks are present
- [ ] Sensitive data is not logged
- [ ] Dependencies are not known-vulnerable

### Error Handling
- [ ] All errors are handled (not silently swallowed)
- [ ] Error messages don't expose sensitive internals
- [ ] Edge cases (null, empty, overflow) are handled
- [ ] External API failures are handled gracefully

### Performance
- [ ] No N+1 query patterns
- [ ] No unnecessary loops inside loops
- [ ] Expensive operations are not in hot paths
- [ ] Caching is used where appropriate

### Code Quality
- [ ] Functions do one thing (Single Responsibility)
- [ ] Names clearly describe intent
- [ ] No dead code or commented-out code
- [ ] Magic numbers have named constants
- [ ] Complexity is manageable (< 10 cyclomatic complexity)

### Testing
- [ ] New code has tests
- [ ] Edge cases are tested
- [ ] Tests are readable and maintainable
- [ ] No flaky tests introduced

## Output Format

```markdown
## Code Review Summary

**Overall:** [One sentence verdict]
**Risk Level:** [Low / Medium / High]

### 🔴 Critical Issues
1. **[Issue name]** (line X): [Description]
   ```code
   // Problematic code
   ```
   **Fix:** [Explanation + corrected code]

### 🟡 Important Issues
...

### 🟢 Suggestions
...

### 💡 Notes
...

### What's done well
- [Positive observations]
```