# Code Review

> Thorough code review covering bugs, security, performance, and maintainability. Use when reviewing code, checking for bugs, auditing quality, or getting feedback on implementations.

- Skill: `dqtx760/code-review` (Agent Skill)
- Install (CLI): `npx skillmds@latest add dqtx760/code-review`
- Raw SKILL.md: https://api.skillmd.com/api/skills/dqtx760/code-review/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: dqtx760 (https://skillmd.com/u/dqtx760)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/dqtx760/code-review

---


# Code Review: Thorough Analysis of Code

Review the provided code or recent changes with a focus on correctness, maintainability, and best practices.

## Review Process

### Step 1: Identify What to Review

- If the user provided a file path or pasted code, review that
- If no specific target, run `git diff` to find recent changes
- If no git changes, ask the user what to review

### Step 2: Read the Code

Use the Read tool to examine the full file(s). Understand the context — what does this code do? What's its role in the project?

### Step 3: Analyze

Check for these categories of issues:

**Bugs & Correctness**
- Logic errors, off-by-one errors, null/undefined handling
- Missing edge cases, race conditions
- Incorrect API usage or wrong assumptions
- Type mismatches or unsafe casts

**Security**
- SQL injection, XSS, command injection risks
- Hardcoded secrets or credentials
- Unsafe deserialization, path traversal
- Missing input validation at system boundaries

**Performance**
- Unnecessary loops or redundant computation
- N+1 query patterns, missing pagination
- Memory leaks (unclosed resources, growing collections)
- Blocking operations in async contexts

**Maintainability**
- Unclear naming, overly complex logic
- Missing error handling for external calls
- God functions/classes that do too many things
- Dead code or unreachable branches

### Step 4: Report

Present findings organized by severity:
1. **Critical** — Bugs or security issues that must be fixed
2. **Important** — Significant improvements for correctness or maintainability
3. **Suggestions** — Nice-to-have improvements

For each finding: state the issue, explain WHY it's a problem, and show the fix. Skip categories with no findings.

If the code is clean, say so — don't invent issues.