# Code Reviewer

> Independent review of a code change - verify requested behavior, correctness, security, compatibility, minimal scope, and test coverage.

- Skill: `flowerf19/code-reviewer` (Agent Skill)
- Install (CLI): `npx skillmds@latest add flowerf19/code-reviewer`
- Raw SKILL.md: https://api.skillmd.com/api/skills/flowerf19/code-reviewer/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: Flowerf19 (https://skillmd.com/u/flowerf19)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/flowerf19/code-reviewer

---


Review only; do not edit code. Judge the actual diff against its requirement and return actionable findings.

## When to use

Use before merge, after a risky change, or when an independent view is requested. Prefer a fresh-context reviewer for security-sensitive or high-blast-radius changes.

## Prepare

Gather:

- The exact diff or ref range.
- The requirement, issue, or implementation plan.
- Affected contracts and callers.
- Relevant test results.

If no range is supplied, state the range selected.

## Review checks

| Dimension | Check |
|---|---|
| Spec fit | The requested behavior is fully delivered. |
| Correctness | Edge cases, null/empty inputs, ordering, error paths. |
| Security | Injection, secret leakage, authn/authz, unsafe parsing. |
| Compatibility | Public APIs, schemas, env vars, downstream callers. |
| Scope | No unrelated edits, renames, formatting, or abstractions. |
| Structure | SOLID split intact; no new/changed class over 300 lines including comments. Collapse or over-cap is **Important**. |
| Conventions | Existing helpers, ownership, style, imports. |
| Tests | Changed behavior and important failures are asserted. |

Trace shared behavior to downstream callers when compatibility could be affected. Keep unrelated refactors out of the verdict.

**Coverage first, filtering later.** Report every issue found, including uncertain or low-severity ones — do not self-filter at the finding stage. Severity labels are how downstream filtering happens; attach your confidence when evidence is incomplete.

Red flags in your own review: judging the diff without reading the requirement, approving without reading the test diff, marking everything Minor to avoid friction, or blocking on refactors unrelated to the task.

## Output

Findings first, ordered by severity:

```md
- **[Severity]** `path/file.ext:LINE` - short title
  - Problem: <what is wrong>
  - Impact: <why it matters>
  - Fix: <smallest correction>
```

Severities:

- **Critical** - security, data loss, or broken core path; blocks merge.
- **Important** - incorrect behavior, compatibility break, or missing meaningful test; fix before merge.
- **Minor** - non-blocking maintainability or convention issue.

End with `Approve`, `Approve with fixes`, or `Request changes`. If no findings exist, say so and name any untested residual risk.