Code Review
Objective
Identify quality, security, and maintainability issues BEFORE merge.
Native features first
Claude Code ships a native /code-review that owns the review execution: effort levels from low to max, --fix to apply findings, --comment to post inline PR comments, and ultra for a multi-agent cloud review. Prefer it to run the review.
This skill's delta is the conventions the review is held to — the checklist below (incl. the substance-check.sh gate native review does not run), the naming tables, and the severity taxonomy. Use them to brief or grade a native /code-review run, or as the manual protocol where the native command is unavailable.
Instructions
1. Overview
# View the changes
git diff main...HEAD --stat
git log main...HEAD --oneline
2. Review checklist
Code quality
Typing (TypeScript)
Tests
Security
Performance
3. Comment format
[TYPE] file:line - comment
Types:
- [CRITICAL] - Blocking, must be fixed
- [IMPORTANT] - Should be fixed
- [SUGGESTION] - Optional improvement
- [QUESTION] - Clarification needed
- [NITPICK] - Minor detail
Expected output
## Review: [PR Title]
### Summary
- **Files modified**: X
- **Lines added**: +Y
- **Lines removed**: -Z
- **Verdict**: Approve / Request Changes / Comment
### Positive points
- [Point 1]
- [Point 2]
### Issues identified
#### Critical
- [CRITICAL] `file.ts:42` - Description
#### Important
- [IMPORTANT] `file.ts:87` - Description
### Suggestions
- [SUGGESTION] `file.ts:123` - Description
### Final checklist
- [ ] Code readable and maintainable
- [ ] Sufficient tests
- [ ] No security issue
- [ ] Acceptable performance
Naming analysis
Naming rules to verify
| Element |
Convention |
Good examples |
Bad examples |
| Variables |
Descriptive, camelCase |
userCount, isActive |
x, tmp, data |
| Functions |
Verb + noun, camelCase |
getUserById, validateEmail |
process, handle, do |
| Booleans |
Prefix is/has/can/should |
isValid, hasPermission |
valid, permission |
| Constants |
SCREAMING_SNAKE |
MAX_RETRY_COUNT |
maxRetry |
| Classes |
PascalCase, noun |
UserService, OrderRepository |
Manager, Helper |
| Interfaces |
PascalCase, descriptive |
UserProfile, PaymentMethod |
IUser, DataType |
Naming smells to detect
| Smell |
Problem |
Fix |
| Generic name |
data, result, temp, info |
Name based on content |
| Abbreviation |
usr, btn, msg, idx |
Write in full |
| Double negation |
!isNotValid, !disableButton |
isValid, enableButton |
| Type in the name |
userArray, nameString |
users, name |
| Inappropriate length |
Short global variable, long local |
Reverse: long global, short local |
| Misleading name |
getUser that modifies |
fetchAndUpdateUser |
Patterns to look for
# Single-character variables (except i, j in loops)
\b[a-z]\b\s*[=:]
# Generic names
\b(data|result|temp|tmp|info|item|obj|val|res)\b\s*[=:]
# Booleans without prefix
\b(active|valid|visible|enabled|disabled|open|closed)\b\s*[=:]
Rules
- Be constructive, not destructive
- Explain the WHY
- Propose alternatives
- Distinguish blocking vs nice-to-have
- Verify naming consistency in the code review
See also
The formerly-recommended official code-review plugin is superseded: /code-review is now native in Claude Code at multiple effort levels (incl. the multi-agent cloud ultra tier) — no plugin install needed. This skill keeps the checklist + conventions; the native command owns the orchestration.
Full list of validated vendor skills: docs/recipes/recommended-vendor-skills.md. Audit pilot trace: specs/marketplace-audit/qa-skills-pilot-2026-05-06.md.
1---2name: qa-review3description: Perform a thorough code review. Use when the user requests a review, wants to verify code quality, or before merging a PR.4---56# Code Review78## Objective910Identify quality, security, and maintainability issues BEFORE merge.1112## Native features first1314Claude Code ships a native **`/code-review`** that owns the review *execution*: effort levels from `low` to `max`, `--fix` to apply findings, `--comment` to post inline PR comments, and `ultra` for a multi-agent cloud review. Prefer it to run the review.1516**This skill's delta is the conventions the review is held to** — the checklist below (incl. the `substance-check.sh` gate native review does not run), the naming tables, and the severity taxonomy. Use them to brief or grade a native `/code-review` run, or as the manual protocol where the native command is unavailable.1718## Instructions1920### 1. Overview2122```bash23# View the changes24git diff main...HEAD --stat25git log main...HEAD --oneline26```2728### 2. Review checklist2930#### Code quality31- [ ] Readability (clear names, short functions)32- [ ] DRY (no duplication)33- [ ] SOLID (single responsibility)34- [ ] Reasonable complexity35- [ ] No over-engineering (YAGNI: no speculative options/abstraction; could a stdlib/native/one-liner replace custom code?)3637#### Typing (TypeScript)38- [ ] No `any`39- [ ] Explicit types on public APIs40- [ ] Well-defined interfaces4142#### Tests43- [ ] Tests present and relevant44- [ ] Edge cases covered45- [ ] Mocks limited to I/O46- [ ] Substance: no hollow tests / stubs — run `./scripts/substance-check.sh <changed-files>` (flags no-assertion / always-true / skipped / empty / stub; a green suite over hollow tests is not "done")4748#### Security49- [ ] Inputs validated50- [ ] No hardcoded secrets51- [ ] No injection possible5253#### Performance54- [ ] No N+1 queries55- [ ] No possible infinite loops56- [ ] Memory managed correctly5758### 3. Comment format5960```61[TYPE] file:line - comment6263Types:64- [CRITICAL] - Blocking, must be fixed65- [IMPORTANT] - Should be fixed66- [SUGGESTION] - Optional improvement67- [QUESTION] - Clarification needed68- [NITPICK] - Minor detail69```7071## Expected output7273```markdown74## Review: [PR Title]7576### Summary77- **Files modified**: X78- **Lines added**: +Y79- **Lines removed**: -Z80- **Verdict**: Approve / Request Changes / Comment8182### Positive points83- [Point 1]84- [Point 2]8586### Issues identified8788#### Critical89- [CRITICAL] `file.ts:42` - Description9091#### Important92- [IMPORTANT] `file.ts:87` - Description9394### Suggestions95- [SUGGESTION] `file.ts:123` - Description9697### Final checklist98- [ ] Code readable and maintainable99- [ ] Sufficient tests100- [ ] No security issue101- [ ] Acceptable performance102```103104## Naming analysis105106### Naming rules to verify107108| Element | Convention | Good examples | Bad examples |109|---------|-----------|---------------|------------------|110| Variables | Descriptive, camelCase | `userCount`, `isActive` | `x`, `tmp`, `data` |111| Functions | Verb + noun, camelCase | `getUserById`, `validateEmail` | `process`, `handle`, `do` |112| Booleans | Prefix is/has/can/should | `isValid`, `hasPermission` | `valid`, `permission` |113| Constants | SCREAMING_SNAKE | `MAX_RETRY_COUNT` | `maxRetry` |114| Classes | PascalCase, noun | `UserService`, `OrderRepository` | `Manager`, `Helper` |115| Interfaces | PascalCase, descriptive | `UserProfile`, `PaymentMethod` | `IUser`, `DataType` |116117### Naming smells to detect118119| Smell | Problem | Fix |120|-------|----------|------------|121| **Generic name** | `data`, `result`, `temp`, `info` | Name based on content |122| **Abbreviation** | `usr`, `btn`, `msg`, `idx` | Write in full |123| **Double negation** | `!isNotValid`, `!disableButton` | `isValid`, `enableButton` |124| **Type in the name** | `userArray`, `nameString` | `users`, `name` |125| **Inappropriate length** | Short global variable, long local | Reverse: long global, short local |126| **Misleading name** | `getUser` that modifies | `fetchAndUpdateUser` |127128### Patterns to look for129130```131# Single-character variables (except i, j in loops)132\b[a-z]\b\s*[=:]133134# Generic names135\b(data|result|temp|tmp|info|item|obj|val|res)\b\s*[=:]136137# Booleans without prefix138\b(active|valid|visible|enabled|disabled|open|closed)\b\s*[=:]139```140141## Rules142143- Be constructive, not destructive144- Explain the WHY145- Propose alternatives146- Distinguish blocking vs nice-to-have147- Verify naming consistency in the code review148149## See also150151The formerly-recommended official code-review *plugin* is superseded: `/code-review` is now **native in Claude Code** at multiple effort levels (incl. the multi-agent cloud `ultra` tier) — no plugin install needed. This skill keeps the checklist + conventions; the native command owns the orchestration.152153Full list of validated vendor skills: `docs/recipes/recommended-vendor-skills.md`. Audit pilot trace: `specs/marketplace-audit/qa-skills-pilot-2026-05-06.md`.
christopherlouet