Skill Tracer
Skills › Knowledge Work Plugins › code-review

code-review

skill · 118 lines · Apache-2.0 · engineering/skills/code-review/SKILL.md

The facts

Its description

Review code changes for security, performance, and correctness. Trigger with a PR URL or diff, "review this before I merge", "is this code safe?", or when checking a change for N+1 queries, injection risks, missing edge cases, or error handling gaps.

The description the agent reads to decide when to use it.

From its settingsline 3

When it starts

Someone asks for a code change to be reviewed — a PR URL, a diff, or a file path — or asks whether a change is safe, performant, or correct before merging. The agent picks it up when the request is about inspecting code for security, performance, correctness, or maintainability problems.

Things a person might say (the model's guesses)

  • “Review this PR before I merge: https://github.com/acme/api/pull/482”
  • “Is this code safe? Here's the diff for the new login handler.”
  • “Can you check this change for N+1 queries and missing edge cases?”

A model's summary of when it is used.

A model's reading

What it takes when started

<PR URL, diff, or file path>

What to type after its name when you start it.

From its settingsline 4

Licence

Apache-2.0, from LICENSE

The terms its author shares it under, which let it be shown here.

From the repositorylicence text

The text

Open on GitHub

Most marks come from matching words in the file, so treat them as pointers.

1---
2name: code-review
3description: Review code changes for security, performance, and correctness. Trigger with a PR URL or diff, "review this before I merge", "is this code safe?", or when checking a change for N+1 queries, injection risks, missing edge cases, or error handling gaps.
4argument-hint: "<PR URL, diff, or file path>"
5---
6
7# /code-review
8
9> If you see unfamiliar placeholders or need to check which tools are connected, see [CONNECTORS.md](../../CONNECTORS.md).
11Review code changes with a structured lens on security, performance, correctness, and maintainability.

/code-review

If you see unfamiliar placeholders or need to check which tools are connected, see CONNECTORS.md.

Review code changes with a structured lens on security, performance, correctness, and maintainability.

Raw lines 1 to 12
13## Usage
15```
16/code-review <PR URL or file path>
17```
19Review the provided code changes: @$1
21If no specific file or URL is provided, ask what to review.

Usage

/code-review <PR URL or file path>

Review the provided code changes: @$1

If no specific file or URL is provided, ask what to review.

Raw lines 13 to 22
23## How It Works
25```
26┌─────────────────────────────────────────────────────────────────┐
27│ CODE REVIEW │
28├─────────────────────────────────────────────────────────────────┤
29│ STANDALONE (always works) │
30│ ✓ Paste a diff, PR URL, or point to files │
31│ ✓ Security audit (OWASP top 10, injection, auth) │
32│ ✓ Performance review (N+1, memory leaks, complexity) │
33│ ✓ Correctness (edge cases, error handling, race conditions) │
34│ ✓ Style (naming, structure, readability) │
35│ ✓ Actionable suggestions with code examples │
36├─────────────────────────────────────────────────────────────────┤
37│ SUPERCHARGED (when you connect your tools) │
38│ + Source control: Pull PR diff automatically │
39│ + Project tracker: Link findings to tickets │
40│ + Knowledge base: Check against team coding standards │
41└─────────────────────────────────────────────────────────────────┘
42```

How It Works

┌─────────────────────────────────────────────────────────────────┐
│                      CODE REVIEW                                   │
├─────────────────────────────────────────────────────────────────┤
│  STANDALONE (always works)                                       │
│  ✓ Paste a diff, PR URL, or point to files                      │
│  ✓ Security audit (OWASP top 10, injection, auth)               │
│  ✓ Performance review (N+1, memory leaks, complexity)           │
│  ✓ Correctness (edge cases, error handling, race conditions)    │
│  ✓ Style (naming, structure, readability)                        │
│  ✓ Actionable suggestions with code examples                    │
├─────────────────────────────────────────────────────────────────┤
│  SUPERCHARGED (when you connect your tools)                      │
│  + Source control: Pull PR diff automatically                    │
│  + Project tracker: Link findings to tickets                     │
│  + Knowledge base: Check against team coding standards           │
└─────────────────────────────────────────────────────────────────┘
Raw lines 23 to 43
44## Review Dimensions

Review Dimensions

Raw lines 44 to 45
46### Security
47- SQL injection, XSS, CSRF
48- Authentication and authorization flaws
49- Secrets or credentials in code
50- Insecure deserialization
51- Path traversal
52- SSRF

Security

  • SQL injection, XSS, CSRF
  • Authentication and authorization flaws
  • Secrets or credentials in code
  • Insecure deserialization
  • Path traversal
  • SSRF
Raw lines 46 to 53
54### Performance
55- N+1 queries
56- Unnecessary memory allocations
57- Algorithmic complexity (O(n²) in hot paths)
58- Missing database indexes
59- Unbounded queries or loops
60- Resource leaks

Performance

  • N+1 queries
  • Unnecessary memory allocations
  • Algorithmic complexity (O(n²) in hot paths)
  • Missing database indexes
  • Unbounded queries or loops
  • Resource leaks
Raw lines 54 to 61
62### Correctness
63- Edge cases (empty input, null, overflow)
64- Race conditions and concurrency issues
65- Error handling and propagation
66- Off-by-one errors
67- Type safety

Correctness

  • Edge cases (empty input, null, overflow)
  • Race conditions and concurrency issues
  • Error handling and propagation
  • Off-by-one errors
  • Type safety
Raw lines 62 to 68
69### Maintainability
70- Naming clarity
71- Single responsibility
72- Duplication
73- Test coverage
74- Documentation for non-obvious logic

Maintainability

  • Naming clarity
  • Single responsibility
  • Duplication
  • Test coverage
  • Documentation for non-obvious logic
Raw lines 69 to 75
76## Output
78```markdown
79## Code Review: [PR title or file]
81### Summary
82[1-2 sentence overview of the changes and overall quality]
84### Critical Issues
85| # | File | Line | Issue | Severity |
86|---|------|------|-------|----------|
87| 1 | [file] | [line] | [description] | 🔴 Critical |
89### Suggestions
90| # | File | Line | Suggestion | Category |
91|---|------|------|------------|----------|
92| 1 | [file] | [line] | [description] | Performance |
94### What Looks Good
95- [Positive observations]
97### Verdict
98[Approve / Request Changes / Needs Discussion]
99```

Output

## Code Review: [PR title or file]

### Summary
[1-2 sentence overview of the changes and overall quality]

### Critical Issues
| # | File | Line | Issue | Severity |
|---|------|------|-------|----------|
| 1 | [file] | [line] | [description] | 🔴 Critical |

### Suggestions
| # | File | Line | Suggestion | Category |
|---|------|------|------------|----------|
| 1 | [file] | [line] | [description] | Performance |

### What Looks Good
- [Positive observations]

### Verdict
[Approve / Request Changes / Needs Discussion]
Raw lines 76 to 100
101## If Connectors Available
103If **~~source control** is connected:
104- Pull the PR diff automatically from the URL
105- Check CI status and test results
107If **~~project tracker** is connected:
108- Link findings to related tickets
109- Verify the PR addresses the stated requirements
111If **~~knowledge base** is connected:
112- Check changes against team coding standards and style guides

If Connectors Available

If ~~source control is connected:

  • Pull the PR diff automatically from the URL
  • Check CI status and test results

If ~~project tracker is connected:

  • Link findings to related tickets
  • Verify the PR addresses the stated requirements

If ~~knowledge base is connected:

  • Check changes against team coding standards and style guides
Raw lines 101 to 113
Uses an outside tool ~~source :103
Uses an outside tool ~~project :107
Uses an outside tool ~~knowledge :111
114## Tips
1161. **Provide context** — "This is a hot path" or "This handles PII" helps me focus.
1172. **Specify concerns** — "Focus on security" narrows the review.
1183. **Include tests** — I'll check test coverage and quality too.

Tips

  1. Provide context — "This is a hot path" or "This handles PII" helps me focus.
  2. Specify concerns — "Focus on security" narrows the review.
  3. Include tests — I'll check test coverage and quality too.
Raw lines 114 to 118

From anthropics/knowledge-work-plugins at 2574e29, 2026-10-27. Skills read by DeepSeek V4.1 Flash on 2026-11-04. Summary and techniques by Claude Opus 5.5 on 2026-11-06.