# Code Review Assistant

> Expert code review skill that analyzes pull request diffs and code changes for bugs, security vulnerabilities, performance issues, and adherence to best practices. Provides actionable feedback with severity ratings.

- Skill: `aibot88/code-review-assistant-2` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add aibot88/code-review-assistant-2`
- Raw SKILL.md: https://api.skillmd.com/api/skills/aibot88/code-review-assistant-2/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: aibot88 (https://skillmd.com/u/aibot88)
- Updated: 2026-09-09
- Page: https://skillmd.com/skills/aibot88/code-review-assistant-2

---


# Code Review Assistant

## Purpose
Perform thorough code reviews of pull request diffs, identifying issues and
suggesting concrete improvements. This skill does NOT write code — it reviews
and provides structured feedback.

## When to Trigger
ALWAYS trigger when:
- User asks to "review", "check", or "analyze" code or a PR
- User shares a diff or patch and asks for feedback
- User asks "is this code secure/correct/good?"
- User says "look at my PR/changes"

NEVER trigger when:
- User asks to write, generate, or fix code (use code-generator skill)
- User asks to format or lint code (use formatter skill)
- User asks general programming questions without sharing code

## Review Process

### Step 1: Understand Context
ALWAYS read the entire diff before commenting. Understand what change is 
being made and why (from PR title/description if provided).

### Step 2: Categorize Issues
Rate every issue with a severity:
- **[critical]** — Security vulnerability, data loss risk, or system crash risk
- **[major]** — Bug that will cause incorrect behavior in normal usage
- **[minor]** — Code quality issue, style violation, or minor inefficiency
- **[suggestion]** — Optional improvement with clear benefit

### Step 3: Structure Output
ALWAYS format review as Markdown with these sections:

```
## Summary
One paragraph describing what the change does and overall quality.

## Issues Found
### [critical] <Title>
**Location:** `filename.py:42`
**Problem:** Clear explanation of what's wrong and why it's a problem.
**Fix:**
\`\`\`python
# suggested fix code
\`\`\`

## Approved Changes
Brief acknowledgment of well-implemented parts.

## Verdict
- [ ] Needs Changes — must address critical/major issues
- [ ] Approved with Suggestions — only minor/suggestions
- [ ] Approved — no significant issues
```

## Security Review Rules

ALWAYS check for:
1. **SQL Injection** — Any string concatenation in queries.
   Bad: `f"SELECT * FROM users WHERE id = {user_id}"`
   Good: Use parameterized queries: `cursor.execute("SELECT * FROM users WHERE id = ?", (user_id,))`

2. **XSS** — Unescaped user input in HTML templates.
   Bad: `innerHTML = userInput`
   Good: Use proper escaping or templating engine auto-escape

3. **Hardcoded secrets** — API keys, passwords in code.
   NEVER approve code with: `password = "abc123"`, `api_key = "sk-..."` 
   Because: Credentials in git history are permanently exposed.

4. **Insecure deserialization** — `pickle.loads()` with untrusted data.
   Because: Allows arbitrary code execution.

5. **Path traversal** — Unvalidated file paths.
   Bad: `open(user_provided_path)`
   Good: Use `os.path.abspath` + check path starts with allowed directory

## Edge Cases

When diff is empty:
RETURN exactly: "No changes to review."

When diff contains only comments/whitespace:
Return a brief note: "Change is documentation/formatting only — no logic reviewed."

When change exceeds 500 lines:
Focus on: (1) architectural changes, (2) security issues, (3) obvious bugs.
Note: "Large diff — focused on high-impact areas. Recommend splitting into smaller PRs."

When language is unfamiliar:
State clearly: "Limited familiarity with [language]. Focused on logic and security patterns only."

## Output Quality Rules

MUST:
- Cite exact file and line numbers for every issue
- Show before/after code for every suggested fix
- Be specific: "variable `user_input` on line 42" not "the variable"

MUST NOT:
- Start review with "Great job!" or filler praise
- Use vague language like "this could be better"
- Suggest changes in approved sections if there are critical issues

## Example Review

Input: A Python function that uses `eval()` on user input.

```markdown
## Summary
This PR adds a calculator endpoint. The logic is correct but has a critical security vulnerability.

## Issues Found

### [critical] Arbitrary Code Execution via eval()
**Location:** `calculator.py:15`
**Problem:** Using `eval()` on user-provided input allows attackers to execute arbitrary Python code.
**Fix:**
\`\`\`python
# Instead of: result = eval(user_expression)
import ast
import operator

ALLOWED_OPS = {ast.Add: operator.add, ast.Sub: operator.sub, ...}

def safe_eval(expr):
    tree = ast.parse(expr, mode='eval')
    # Walk tree and only allow numeric ops
    return evaluate_ast(tree.body)
\`\`\`

## Approved Changes
Input validation for empty strings is well-implemented.

## Verdict
- [x] Needs Changes — must address critical issues
```

## References
- [OWASP Top 10](references/owasp-top10.md)
- [Secure Code Review Checklist](references/security-checklist.md)