code-reviewer
0Analyzes code diffs and files to identify bugs, security vulnerabilities (SQL injection, XSS, insecure deserialization), code smells, N+1 queries, naming issues, and architectural concerns, then produces a structured review report with prioritized, actionable feedback. Use when reviewing pull requests, conducting code quality audits, identifying refactoring opportunities, or checking for security issues. Invoke for PR reviews, code quality checks, refactoring suggestions, review code, code quali
10,9151,0220Updated 1w ago
General
Quick InstallView Source
git clone https://github.com/Jeffallan/claude-skills.gitOverview
About This Skill
--- name: code-reviewer description: Analyzes code diffs and files to identify bugs, security vulnerabilities (SQL injection, XSS, insecure deserialization), code smells, N+1 queries, naming issues, and architectural concerns, then produces a structured review report with prioritized, actionable feedback. Use when reviewing pull requests, conducting code quality audits, identifying refactoring opportunities, or checking for security issues. Invoke for PR reviews, code quality checks, refactoring suggestions, review code, code quality. Complements specialized skills (security-reviewer, test-master) by providing broad-scope review across correctness, performance, maintainability, and test coverage in a single pass. license: MIT allowed-tools: Read, Grep, Glob metadata: author: https://github.com/Jeffallan version: "1.1.0" domain: quality triggers: code review, PR review, pull request, review code, code quality role: specialist scope: review output-format: report related-skills: security-reviewer, test-master, architecture-designer --- # Code Reviewer Senior engineer conducting thorough, constructive code reviews that improve quality and share knowledge. ## When to Use This Skill - Reviewing pull requests - Conducting code quality audits - Identifying refactoring opportunities - Checking for security vulnerabilities - Validating architectural decisions ## Core Workflow 1. **Context** — Read PR description, understand the problem being solved. **Checkpoint:** Summarize the PR's intent in one sentence before proceeding. If you cannot, ask the author to clarify. 2. **Structure** — Review architecture and design decisions. Ask: Does this follow existing patterns in the codebase? Are new abstractions justified? 3. **Details** — Check code quality, security, and performance. Apply the checks in the Reference Guide below. Ask: Are there N+1 queries, hardcoded secrets, or injection risks? 4. **Tests** — Validate test coverage and quality. Ask: Are edge cases covered? Do tests assert behavior, not implementation? 5. **Feedback** — Produce a categorized report using the Output Template. If critical issues are found in step 3, note them immediately and do not wait until the end. > **Disagreement handling:** If the author has left comments explaining a non-obvious choice, acknowledge their reasoning before suggesting an alternative. Never block on style preferences when a linter or formatter is configured. ## Reference Guide Load detailed guidance based on context: <!-- Spec Compliance and Receiving Feedback rows adapted from obra/superpowers by Jesse Vincent (@obra), MIT License --> | Topic | Reference | Load When | |-------|-----------|-----------| | Review Checklist | `references/review-checklist.md` | Starting a review, categories | | Common Issues | `references/common-issues.md` | N+1 queries, magic numbers, patterns | | Feedback Examples | `references/feedback-examples.md` | Writing good feedback | | Report Template | `references/report-template.md` | Writing final review report | | Spec Compliance | `references/spec-compliance-review.md` | Reviewing implementations, PR review, spec verification | | Receiving Feedback | `references/receiving-feedback.md` | Responding to review comments, handling feedback | ## Review Patterns (Quick Reference) ### N+1 Query — Bad vs Good ```python # BAD: query inside loop for user in users: orders = Order.objects.filter(user=user) # N+1 # GOOD: prefetch in bulk users = User.objects.prefetch_related('orders').all() ``` ### Magic Number — Bad vs Good ```python # BAD if status == 3: ... # GOOD ORDER_STATUS_SHIPPED = 3 if status == ORDER_STATUS_SHIPPED: ... ``` ### Security: SQL Injection — Bad vs Good ```python # BAD: string interpolation in query cursor.execute(f"SELECT * FROM users WHERE id = {user_id}") # GOOD: parameterized query cursor.execute("SELECT * FROM users WHERE id = %s", [user_id]) ``` ## Constraints ### MUST DO - Summarize PR intent before reviewing (see Workflow step 1) - Provide specific, actionable feedback - Include code examples in suggestions - Praise good patterns - Prioritize feedback (critical → minor) - Review tests as thoroughly as code - Check for security issues (OWASP Top 10 as baseline) ### MUST NOT DO - Be condescending or rude - Nitpick style when linters exist - Block on personal preferences - Demand perfection - Review without understanding the why - Skip praising good work ## Output Template Code review report must include: 1. **Summary** — One-sentence intent recap + overall assessment 2. **Critical issues** — Must fix before merge (bugs, security, data loss) 3. **Major issues** — Should fix (performance, design, maintainability) 4. **Minor issues** — Nice to have (naming, readability) 5. **Positive feedback** — Specific patterns done well 6. **Questions for author** — Clarifications needed 7. **Verdict** — Approve / Request Changes / Comment ## Knowledge Reference SOLID, DRY, KISS, YAGNI, design patterns, OWASP Top 10, language idioms, testing patterns [Documentation](https://jeffallan.github.io/claude-skills/skills/quality/code-reviewer/)
How to Use
[{"step":"Prepare the code changes for review. Copy the Git diff or relevant file contents and paste them into the prompt. Include the programming language or tech stack (e.g., Python, React, Django).","tip":"For GitHub/GitLab PRs, use the 'raw' view of the diff to avoid formatting issues. Tools like `git diff` or GitHub's 'Download' button can help."},{"step":"Customize the focus areas in the prompt if needed. For example, add 'Focus on security vulnerabilities only' or 'Ignore performance issues for now.'","tip":"Use specific keywords like 'SQL injection', 'XSS', or 'N+1 queries' to guide the AI toward relevant issues."},{"step":"Run the prompt in your AI tool (e.g., Claude, ChatGPT). Review the structured report and prioritize fixes based on severity (P0-P3).","tip":"Use the 'Critical' and 'High' severity issues to block merges or create urgent tickets. Save 'Medium/Low' for refactoring tasks."},{"step":"Implement the suggested fixes in your codebase. For complex issues, break them into smaller tasks and assign them to the appropriate team members.","tip":"Use the AI's suggested fixes as a starting point, but verify them against your team's coding standards and security policies."},{"step":"Re-run the review after implementing fixes to ensure all critical issues are resolved. Use the AI to double-check edge cases or missed vulnerabilities.","tip":"For large PRs, split the review into smaller chunks (e.g., by module or file) to make it more manageable."}]
Setup & Installation
Quick Install
No install command available. Check the GitHub repository for manual installation instructions.
Alternative Install (Git Clone)
git clone https://github.com/Jeffallan/claude-skills/tree/main/skills/code-reviewerRequirements
- Claude Code or compatible AI agent
Quick Start Guide
1
Install the Skill
Copy the install command above and run it in your terminal.
2
Open Your AI Agent
Launch Claude Code, Cursor, or your preferred AI coding agent.
3
Try It Out
Use the prompt template or examples below to test the skill.
4
Customize
Adapt the skill to your specific use case and workflow.
Usage Examples
Prompt Template
Act as a senior code reviewer. Review the following [CODE_CHANGES] (Git diff or file contents) for [LANGUAGE/TECH_STACK]. Focus on: (1) security vulnerabilities (e.g., SQL injection, XSS, insecure deserialization), (2) performance issues (e.g., N+1 queries, inefficient algorithms), (3) code smells (e.g., duplicate code, long methods), and (4) architectural concerns. Provide feedback in a structured report with: severity (Critical/High/Medium/Low), location (file:line), description, suggested fix, and priority (P0-P3). Include a summary of critical issues blocking merge. [CODE_CHANGES]: [INSERT_CODE_HERE]
Example Output
```
# Code Review Report: PR #1234 - User Profile API Refactor
## Critical Issues (P0 - Block Merge)
1. **SQL Injection Vulnerability** (Severity: Critical)
- **Location**: `src/user/profile/repository.go:45`
- **Description**: User input is directly concatenated into SQL query without parameterization.
- **Code Snippet**:
```go
query := fmt.Sprintf("SELECT * FROM users WHERE id = %s", userID)
```
- **Suggested Fix**: Use prepared statements with parameters.
```go
query := "SELECT * FROM users WHERE id = ?"
rows, err := db.Query(query, userID)
```
- **Impact**: Exploitable by malicious actors to extract or modify database data.
2. **Insecure Deserialization** (Severity: Critical)
- **Location**: `src/user/session/manager.go:120`
- **Description**: Unsafe deserialization of user session data from cookies.
- **Code Snippet**:
```go
var session Session
err := json.NewDecoder(req.Body).Decode(&session)
```
- **Suggested Fix**: Validate and sanitize input; use a secure deserialization library.
- **Impact**: Risk of remote code execution if attacker controls session data.
## High Priority Issues (P1)
1. **N+1 Query Problem** (Severity: High)
- **Location**: `src/user/profile/service.go:88`
- **Description**: Fetching user posts in a loop without eager loading.
- **Code Snippet**:
```go
for _, user := range users {
posts, _ := db.Query("SELECT * FROM posts WHERE user_id = ?", user.ID)
}
```
- **Suggested Fix**: Use JOIN or a single query with IN clause.
- **Impact**: Significant performance degradation under load (1000+ users).
2. **XSS Vulnerability** (Severity: High)
- **Location**: `src/user/profile/handler.go:42`
- **Description**: User-generated content (e.g., bio) is rendered without escaping.
- **Code Snippet**:
```html
<div>${user.Bio}</div>
```
- **Suggested Fix**: Use a templating engine with auto-escaping (e.g., React, EJS with escape).
- **Impact**: Stored XSS attacks possible.
## Medium Priority Issues (P2)
1. **Code Smell: Long Method** (Severity: Medium)
- **Location**: `src/user/profile/service.go:150`
- **Description**: `UpdateProfile()` method is 240 lines long with multiple responsibilities.
- **Suggested Fix**: Split into smaller methods (e.g., `validateProfile()`, `updateDatabase()`, `sendNotifications()`).
- **Impact**: Reduced maintainability and testability.
2. **Magic Number** (Severity: Medium)
- **Location**: `src/user/profile/constants.go:5`
- **Description**: Hardcoded value `const maxBioLength = 500` without explanation.
- **Suggested Fix**: Add a comment or constant with a descriptive name (e.g., `const maxBioLength = 500 // Max length per database constraint`).
## Low Priority Issues (P3)
1. **Naming Issue** (Severity: Low)
- **Location**: `src/user/profile/types.go:10`
- **Description**: Variable `usr` is unclear; should be `user`.
- **Suggested Fix**: Rename to `user` for clarity.
## Summary
- **Critical Issues**: 2 (Block merge)
- **High Priority**: 2 (Address before merge)
- **Medium/Low Priority**: 3 (Refactor in next sprint)
**Recommendation**: Do not merge until critical issues are resolved. Address high-priority issues in the next 24 hours.
```Source repo
jeffallan/claude-skills
skills-collection
Find the right skills for your stack
Take a free 3-minute scan and get personalized AI skill recommendations.
Take free scan