Code Review

When to Use This Skill

Context

• Review path: $1 (defaults to current directory if not specified)

Parameters

• $1: Path to review (defaults to current directory)

Your task

Delegate this task to the agents-plugin:review agent.

Use the Agent tool with subagent_type: agents-plugin:review to perform a comprehensive code review.

First, use the Glob tool to discover source files to review:

• **/*.py, **/*.js, **/*.ts, **/*.go, **/*.rs for source files
• **/*test* patterns for test files Then pass the discovered files to the agent.

The code-review agent should:

1. Analyze code quality:

   • Naming conventions and readability
   • Code structure and maintainability
   • SOLID principles adherence

2. Security assessment:

   • Input validation vulnerabilities
   • Authentication and authorization issues
   • Secrets and sensitive data exposure

3. Performance evaluation:

   • Bottlenecks and inefficiencies
   • Memory usage patterns
   • Optimization opportunities

4. Architecture review:

   • Design patterns usage
   • Component coupling
   • Dependency management

5. Test coverage gaps:

   • Missing test cases
   • Edge cases not covered
   • Integration test needs

6. Apply fixes where appropriate and safe

7. Re-verify each candidate finding (false-positive gate — run BEFORE reporting): For every candidate finding from steps 1–5, re-read the cited code at the reported file:line and confirm the claim actually holds against the current source — not against a remembered or assumed shape. A finding survives only if the re-read confirms it; drop the rest. See "Re-verification Pass" below.

8. Score every surviving finding against the anchors below:

   • Assign a severity (Critical/High/Medium/Low) using the "Severity Rubric".
   • Assign a confidence (High/Medium/Low) using the "Confidence Scale", and drop or explicitly flag findings below the reporting threshold.

9. Generate report with:

   • Surviving findings ranked most-severe first, each carrying its severity, confidence, and verified file:line
   • Summary of issues found/fixed
   • Remaining manual interventions needed
   • Improvement recommendations

Provide the agent with:

• The review path from context
• Project type (language/framework)
• Any specific focus areas requested

The agent has expertise in:

• Multi-language code analysis (Python, TypeScript, Go, Rust)
• LSP integration for accurate diagnostics
• Security vulnerability patterns (OWASP)
• Performance analysis and optimization

Severity Rubric

Score every surviving finding against these anchors. Rank the report most-severe first.

Confidence Scale

Assign each finding a confidence and let it gate what reaches the report. A finding whose defect you cannot demonstrate from the code in front of you is a guess, and guesses erode trust in the review.

The reporting threshold is Medium: report High and Medium findings; do not present Low-confidence hunches as findings.

Re-verification Pass

Before the report step, re-check every candidate finding against the actual code. This kills false positives mechanically rather than trusting the initial read:

1. Re-open the finding's file:line with Read and confirm the cited code still says what the finding claims (line numbers drift; assumptions decay).
2. Confirm the failure the finding describes is reachable — name the concrete input or state that triggers it. If you cannot, it is Low confidence.
3. Keep only findings that survive both checks. Every reported finding must carry a verified file:line, a severity, and a confidence.

Agent Teams (Optional)

For comprehensive review of large codebases, spawn specialized review teammates in parallel:

This is optional — the skill works without agent teams for standard reviews.

Related Configure Skills

• If security scanning not configured → /configure:security
• If linting not set up → /configure:linting
• If test coverage not tracked → /configure:coverage