Code Review

Code Review Agent

Purpose

Enforces SYNTHEX coding standards, catches regressions, and validates adherence to architectural patterns, security requirements, and CLAUDE.md guidelines. Performs TypeScript strict mode checks, security reviews, performance analysis, and standards enforcement.

When to Use

Activate this skill when:

• Reviewing pull requests or code changes
• Analyzing code quality across files or directories
• Checking for security vulnerabilities in code
• Validating against CLAUDE.md standards
• Auditing component architecture patterns

When NOT to Use This Skill

• When reviewing visual design or UI aesthetics (use design)
• When validating database schema or migration safety (use database-prisma)
• When testing API endpoint behavior (use api-testing)
• When auditing UX flows or accessibility (use ui-ux)
• When reviewing non-code assets (images, configs, docs)
• Instead use: design for visual reviews, database-prisma for schema work

Tech Stack

• Framework: Next.js 14+ App Router
• Language: TypeScript (strict mode)
• Styling: Tailwind CSS + Glassmorphic UI
• State: React hooks, SWR for data fetching
• Testing: Jest, React Testing Library

Instructions

1. Identify review scope — Determine files, directories, or PR to review
2. Run static analysis — Execute pnpm turbo run type-check lint
3. Check TypeScript compliance — Verify strict mode, no any types, proper generics
4. Validate component patterns — Confirm Server/Client component separation
5. Scan for security issues — Check for hardcoded secrets, exposed env vars, XSS vectors
6. Validate environment variables — Confirm env-validator usage, no client-side secrets
7. Analyse performance — Identify unnecessary re-renders, missing lazy loading, large bundles
8. Check error handling — Verify try-catch on async ops, error boundaries present
9. Enforce naming conventions — PascalCase components, camelCase hooks, kebab-case utils
10. Generate review report — Output findings grouped by severity (critical/warning/info)

Input Specification

Output Specification

Error Handling

Review Checklist

• TypeScript strict mode compliance
• Proper error boundaries
• Security validation on API routes
• Environment variables not exposed
• No hardcoded secrets
• Consistent component patterns
• Adequate test coverage
• Performance considerations
• Australian English in user-facing strings

Key Files

• CLAUDE.md — Project configuration and standards
• .claude/rules/ — Development workflow rules
• tsconfig.json — TypeScript configuration
• eslint.config.js — Linting rules (flat config)

Commands

npm run lint              # Run linting (eslint . --max-warnings 0)
npm run type-check        # Type checking (tsc --noEmit)
npm run type-check && npm run lint && npm test  # Run all checks

Integration Points

• Works with api-testing for endpoint coverage
• Coordinates with database-prisma for query optimisation
• Reports to ui-ux for component standards

Capability Uplift — Override Defaults

NEVER apply generic clean code principles that contradict Synthex conventions. Australian English spellings are correct. Supabase-only auth is correct. SWR with credentials: 'include' is correct. Don't flag these as issues.

INSTEAD reviews enforce Synthex-specific patterns:

• useRouter from next/navigation (never next/router, never window.location.href)
• SWR for all client-side data fetching with credentials: 'include' fetcher
• { error: string, details?: unknown } for all 4xx responses
• { organizationId } filter on every Prisma query
• Zod safeParse (not parse) on all mutation inputs
• getUserIdFromRequestOrCookies (not any other auth helper)

Blockers: security issues (missing auth/org-scope), runtime errors. Warnings: code quality (any types, silent catches, missing error shape). Suggestions: improvements that don't change behaviour.

REFERENCE .claude/skills/synthex-standards/references/code-standards.md

Review Board Output

When invoked as part of the Synthex Review Board pipeline, produce output matching the schema in .claude/skills/review-board/_shared/output-schema.md.

Map this skill's findings to the shared format:

• specialist: Use this skill's name from frontmatter
• severity: Map findings to CRITICAL/HIGH/MEDIUM/LOW per .claude/skills/review-board/_shared/severity-levels.md
• confidence: Assign 0-100 based on certainty. Only findings >= 80 are shown to the developer.
• verdict: BLOCK if any CRITICAL finding exists, otherwise PASS
• Include file, line, issue, fix, and optional reference for each finding
• If no findings, return empty findings array with verdict PASS

Foundation & Gate Wiring (SYN-1049)

Adopted from the senior-skill standard so every artefact this connector produces is checked against the locked foundation before it lands.

Reads at every invocation (never cached — re-read each run):

• .claude/memory/ceo-foundation.md — verification discipline, evidence standard.
• .claude/memory/verification-gates.md — gate state for any claim referenced.

Output gate: every output passes the verification gate (.claude/rules/verification-gate.md) before being reported complete — run the real command/check and report actual results, never "should work".

Evidence standard: every quantitative or factual claim carries exactly one tag — [VERIFIED] / [INFERENCE] / [UNCONFIRMED]. Untagged = defect (.claude/rules/fabel-evidence-standard.md). Never state a projected result as fact.

Spec: see spec.md in this skill directory.