Classifying Review Findings
Severity Categories
| Emoji |
Category |
Criteria |
| ❌ |
CRITICAL |
Will break, crash, expose data, or violate requirements |
| ⚠️ |
IMPORTANT |
Missing error handling, unhandled edge cases, could cause bugs |
| ♻️ |
DEBT |
Duplicates patterns, violates conventions, needs rework within 6 months |
| 🎨 |
SUGGESTED |
Measurably improves security, reduces complexity by 3+, eliminates bug classes |
| ❓ |
QUESTION |
Requires human knowledge - unclear requirements, intent, or system conflicts |
ALWAYS use hybrid emoji + text format for each finding (if multiple severities apply, use the most severe: ❌ > ⚠️ > ♻️ > 🎨 > ❓):
Before Classifying
Verify ALL three:
- Can you trace the execution path showing incorrect behavior?
- Is this handled elsewhere (error boundaries, middleware, validators)?
- Are you certain about framework behavior and language semantics?
If any answer is "no" or "unsure" → DO NOT classify as a finding.
Not Valid Findings (Reject)
- Praise ("great implementation")
- Vague suggestions ("could be simpler")
- Style preferences without enforced standard
- Naming nitpicks unless actively misleading
- PR metadata issues (title, description, test plan) - handled by summary skill, not classified here
- Renovate/Dependabot minor/patch updates to existing dependencies with passing CI — these are routine Stage 5 monitoring, not reviewable findings
Suggested Improvements (🎨) Criteria
Only suggest improvements that provide measurable value:
- Security gain - Eliminates entire vulnerability class (SQL injection, XSS, etc.)
- Complexity reduction - Reduces cyclomatic complexity by 3+, eliminates nesting level
- Bug prevention - Makes entire category of bugs impossible (type safety, null safety)
- Performance gain - Reduces O(n²) to O(n), eliminates N+1 queries (provide evidence)
Provide concrete metrics:
- ❌ "This could be simpler"
- ✅ "This has cyclomatic complexity of 12; extracting validation logic would reduce to 6"
If you can't measure the improvement, don't suggest it.
1---2name: classifying-review-findings3description: Use this skill when categorizing code review findings into severity levels. Apply when determining which emoji and label to use for PR comments, deciding if an issue should be flagged at all, or classifying findings as CRITICAL, IMPORTANT, DEBT, SUGGESTED, or QUESTION.4---56# Classifying Review Findings78## Severity Categories910| Emoji | Category | Criteria |11| ----- | --------- | ------------------------------------------------------------------------------ |12| ❌ | CRITICAL | Will break, crash, expose data, or violate requirements |13| ⚠️ | IMPORTANT | Missing error handling, unhandled edge cases, could cause bugs |14| ♻️ | DEBT | Duplicates patterns, violates conventions, needs rework within 6 months |15| 🎨 | SUGGESTED | Measurably improves security, reduces complexity by 3+, eliminates bug classes |16| ❓ | QUESTION | Requires human knowledge - unclear requirements, intent, or system conflicts |1718**ALWAYS** use hybrid emoji + text format for each finding (if multiple severities apply, use the most severe: ❌ > ⚠️ > ♻️ > 🎨 > ❓):1920## Before Classifying2122Verify ALL three:23241. Can you trace the execution path showing incorrect behavior?252. Is this handled elsewhere (error boundaries, middleware, validators)?263. Are you certain about framework behavior and language semantics?2728**If any answer is "no" or "unsure" → DO NOT classify as a finding.**2930## Not Valid Findings (Reject)3132- Praise ("great implementation")33- Vague suggestions ("could be simpler")34- Style preferences without enforced standard35- Naming nitpicks unless actively misleading36- PR metadata issues (title, description, test plan) - handled by summary skill, not classified here37- Renovate/Dependabot minor/patch updates to existing dependencies with passing CI — these are routine Stage 5 monitoring, not reviewable findings3839## Suggested Improvements (🎨) Criteria4041**Only suggest improvements that provide measurable value:**42431. **Security gain** - Eliminates entire vulnerability class (SQL injection, XSS, etc.)442. **Complexity reduction** - Reduces cyclomatic complexity by 3+, eliminates nesting level453. **Bug prevention** - Makes entire category of bugs impossible (type safety, null safety)464. **Performance gain** - Reduces O(n²) to O(n), eliminates N+1 queries (provide evidence)4748**Provide concrete metrics:**4950- ❌ "This could be simpler"51- ✅ "This has cyclomatic complexity of 12; extracting validation logic would reduce to 6"5253**If you can't measure the improvement, don't suggest it.**
bitwarden