# Code Review

> Reviews code changes for type safety, security vulnerabilities, error handling, and performance issues in TypeScript/Next.js projects. Checks for SQL injection, XSS, missing null checks, N+1 queries, and convention violations. Use when reviewing a pull request, checking code changes, reviewing a diff, doing a pre-merge review, or when the implement workflow reaches the review step.

- Skill: `blackbearhq/code-review` (Agent Skill)
- Install (CLI): `npx skillmds@latest add blackbearhq/code-review`
- Raw SKILL.md: https://api.skillmd.com/api/skills/blackbearhq/code-review/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Web & Frontend
- Author: blackbearhq (https://skillmd.com/u/blackbearhq)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/blackbearhq/code-review

---

Review code changes in a TypeScript/Next.js stack for quality, security, and correctness.

## Workflow

1. **Read the diff** — use `git diff --stat` for overview, then read changed files
2. **Check each category** against the checklist below
3. **Compile findings** using the severity format
4. **Present summary** — total counts per severity, then details grouped by file
5. **Verdict** — state whether the PR is ready to merge or needs changes

## Checklist

| Category | What to check |
|----------|--------------|
| Type safety | No `any`, proper generics, correct nullability, exhaustive switch |
| Error handling | try/catch with typed errors, no silent failures, user-facing error messages |
| Security | Input validation, SQL injection via raw queries, XSS in dangerouslySetInnerHTML, auth checks on protected routes |
| Performance | N+1 queries, unnecessary re-renders (missing memo/useMemo), missing DB indexes on filtered columns |
| Patterns | Consistent with existing codebase conventions (naming, file structure, API response shape) |
| Tests | New code paths covered, edge cases (null, empty, boundary), error conditions |

## Severity format

```
🔴 Critical — [file:line] description (must fix before merge)
🟡 Suggestion — [file:line] description (improves quality)
🟢 Nice — [file:line] description (optional polish)
```

### Example

```
🔴 Critical — src/api/users.ts:42 Raw SQL interpolation creates injection risk. Use parameterized query.
🟡 Suggestion — src/components/Dashboard.tsx:15 Large object recalculated every render. Wrap in useMemo.
🟢 Nice — src/utils/format.ts:8 Could use template literal for readability.
```

## Memory

After each review, note recurring issues specific to this project (e.g., "API handlers in this repo often miss auth middleware") to improve future reviews.