Code Review Skill
Systematic code review following a fixed sequence: scope the change, assess blast radius, scan for security issues, verify tests, detect breaking changes, check performance, and score quality.
Review Workflow
- Scope -- Identify what changed (files, modules, services). Classify as feature, bugfix, refactor, config, or docs.
- Blast radius -- Trace dependencies to determine how far the change reaches. See blast-radius.md.
- Security scan -- Run pattern-based checks for common vulnerabilities. See security-scan.md.
- Test coverage -- Verify new/changed code has tests. Flag untested branches and edge cases.
- Breaking changes -- Detect API, schema, config, and dependency changes that break consumers. See breaking-changes.md.
- Performance -- Flag N+1 queries, unbounded loops, missing pagination, large allocations, blocking I/O on hot paths.
- Quality -- Score SOLID adherence, complexity, and code smells. See quality-checks.md.
Run the full checklist to ensure nothing is missed.
Output Format
Organize findings into four categories with severity:
| Category |
Severity |
Meaning |
| MUST FIX |
CRITICAL/HIGH |
Bugs, security holes, data loss risks |
| SHOULD FIX |
HIGH/MEDIUM |
Design issues, missing tests, poor patterns |
| SUGGESTIONS |
MEDIUM/LOW |
Style, naming, minor improvements |
| LOOKS GOOD |
-- |
Explicitly call out well-done aspects |
Format each finding as:
[MUST FIX | SHOULD FIX | SUGGESTION] (severity) file:line
Description of the issue.
Recommended fix or alternative.
Always end with a summary: total findings by category, overall quality score (0-100), and a PASS / CONDITIONAL PASS / FAIL verdict.
What You Get
- A structured review report with findings categorized as MUST FIX, SHOULD FIX, SUGGESTIONS, and LOOKS GOOD, each with severity and file location.
- Blast radius analysis showing how far the change reaches through dependency chains.
- A quality score (0-100) and a final verdict (PASS, CONDITIONAL PASS, or FAIL).
Sub-files
| File |
Content |
| blast-radius.md |
Dependency tracing, severity classification |
| security-scan.md |
Vulnerability patterns, polyglot grep rules |
| quality-checks.md |
SOLID violations, smells, scoring rubric |
| checklist.md |
Full 30+ item review checklist |
| breaking-changes.md |
API, schema, config, dependency breakage |
| receiving-review.md |
How to evaluate and respond to review feedback |
1---2name: code-review3description: Structured code review with blast radius analysis, security scanning, quality scoring, and a 30+ item checklist. TRIGGER when: user asks to review a PR, diff, changeset, or code for quality/security/breaking changes; user runs /review or /code-review; reviewing staged or committed changes. DO NOT TRIGGER when: writing new code from scratch, refactoring without review context, general debugging.4---56# Code Review Skill78Systematic code review following a fixed sequence: scope the change, assess blast radius, scan for security issues, verify tests, detect breaking changes, check performance, and score quality.910## Review Workflow11121. **Scope** -- Identify what changed (files, modules, services). Classify as feature, bugfix, refactor, config, or docs.132. **Blast radius** -- Trace dependencies to determine how far the change reaches. See [blast-radius.md](blast-radius.md).143. **Security scan** -- Run pattern-based checks for common vulnerabilities. See [security-scan.md](security-scan.md).154. **Test coverage** -- Verify new/changed code has tests. Flag untested branches and edge cases.165. **Breaking changes** -- Detect API, schema, config, and dependency changes that break consumers. See [breaking-changes.md](breaking-changes.md).176. **Performance** -- Flag N+1 queries, unbounded loops, missing pagination, large allocations, blocking I/O on hot paths.187. **Quality** -- Score SOLID adherence, complexity, and code smells. See [quality-checks.md](quality-checks.md).1920Run the full [checklist](checklist.md) to ensure nothing is missed.2122## Output Format2324Organize findings into four categories with severity:2526| Category | Severity | Meaning |27|--------------|--------------|----------------------------------------------|28| MUST FIX | CRITICAL/HIGH| Bugs, security holes, data loss risks |29| SHOULD FIX | HIGH/MEDIUM | Design issues, missing tests, poor patterns |30| SUGGESTIONS | MEDIUM/LOW | Style, naming, minor improvements |31| LOOKS GOOD | -- | Explicitly call out well-done aspects |3233Format each finding as:3435```36[MUST FIX | SHOULD FIX | SUGGESTION] (severity) file:line37Description of the issue.38Recommended fix or alternative.39```4041Always end with a summary: total findings by category, overall quality score (0-100), and a PASS / CONDITIONAL PASS / FAIL verdict.4243## What You Get4445- A structured review report with findings categorized as MUST FIX, SHOULD FIX, SUGGESTIONS, and LOOKS GOOD, each with severity and file location.46- Blast radius analysis showing how far the change reaches through dependency chains.47- A quality score (0-100) and a final verdict (PASS, CONDITIONAL PASS, or FAIL).4849## Sub-files5051| File | Content |52|--------------------------------------------|--------------------------------------------|53| [blast-radius.md](blast-radius.md) | Dependency tracing, severity classification|54| [security-scan.md](security-scan.md) | Vulnerability patterns, polyglot grep rules|55| [quality-checks.md](quality-checks.md) | SOLID violations, smells, scoring rubric |56| [checklist.md](checklist.md) | Full 30+ item review checklist |57| [breaking-changes.md](breaking-changes.md) | API, schema, config, dependency breakage |58| [receiving-review.md](receiving-review.md) | How to evaluate and respond to review feedback |
DROOdotFOO