Code Review
Objective
Find high-impact defects in changed code with evidence. Prioritize security, correctness, and regressions over style nits.
Arguments
--fix: After reporting findings, apply all suggested fixes automatically in severity order (CRITICAL -> HIGH -> MEDIUM -> LOW), then rerun targeted checks and report exactly what changed.- Default: Report findings and wait for confirmation before editing.
Scope Resolution
- Verify repository context:
git rev-parse --git-dir. If this fails, stop and tell the user to run from a git repository.
- If user provides file paths/patterns or a commit/range, scope is exactly those targets.
- Otherwise, scope is only session-modified files. Do not include other uncommitted changes.
- If there are no session-modified files, fall back to all uncommitted tracked + untracked files:
- tracked:
git diff --name-only --diff-filter=ACMR
- untracked:
git ls-files --others --exclude-standard
- combine both lists and de-duplicate.
- Exclude generated/low-signal files unless requested: lockfiles, minified bundles, build outputs, vendored code.
- If scope still resolves to zero files, report and stop.
Workflow
- Resolve scope and read diffs plus minimal surrounding context.
- Classify files by domain/risk.
- Load
references/profiles/core.md plus only the domain profiles that match the current diff.
- Generate findings with: location, impact, evidence, confidence, and concrete fix.
- Assign severity with the model below.
- Default behavior: report and wait.
- With
--fix: apply all suggested fixes in severity order, then run targeted verification.
- Report using
references/output-schema.md.
Profile Dispatch
references/profiles/security.md: auth, external input, secrets, crypto, public network surfaces, unsafe parsing.references/profiles/configuration.md: env/config, timeouts, retries, pools, limits, resource tuning, rollout controls.references/profiles/typescript-react.md: TypeScript/JavaScript/React/Node files.references/profiles/python.md: Python services, scripts, async workloads.references/profiles/shell.md: shell scripts, CI command blocks, deployment scripts.references/profiles/smart-contracts.md: Solidity/Solana/on-chain protocol code.references/profiles/data-formats.md: CSV/JSON/YAML/binary ingestion/export/parsing.references/profiles/naming.md: naming/intent clarity (after correctness and security pass).
Load only profiles relevant to touched files. Prefer no more than three domain profiles per pass unless the user requests a deep audit.
Severity Model
- CRITICAL: exploitable security flaw, data loss path, or outage risk on critical paths.
- HIGH: logic defect or performance failure that can break core behavior.
- MEDIUM: maintainability/reliability issue likely to cause near-term defects.
- LOW: localized clarity/style/documentation improvements.
Evidence Rules
- Never fabricate line numbers.
- Tie each finding to concrete code evidence.
- Explain blast radius and failure mode succinctly.
- Prefer targeted fixes over broad rewrites.
Verification
Run the narrowest checks that validate touched behavior:
- formatter/lint on touched files,
- targeted tests for impacted modules,
- typecheck when relevant.
If checks cannot run, state exactly what was skipped and why.
Stop Conditions
Stop and ask for direction when:
- fixes require API/contract redesign,
- behavior intent is too ambiguous to classify severity,
- required validation tooling is unavailable and risk is high.
1---2name: code-review-583description: This skill should be used when the user asks to "review code", "review PR", "code review", "audit code", "check for bugs", "security review", "review my changes", "find issues in this code", "review the diff", or asks for pull request review or code audit.4---5
6# Code Review
7
8## Objective
9
10Find high-impact defects in changed code with evidence. Prioritize security, correctness, and regressions over style nits.
11
12## Arguments
13
14- `--fix`: After reporting findings, apply all suggested fixes automatically in severity order (`CRITICAL -> HIGH -> MEDIUM -> LOW`), then rerun targeted checks and report exactly what changed.
15- Default: Report findings and wait for confirmation before editing.
16
17## Scope Resolution
18
191. Verify repository context: `git rev-parse --git-dir`. If this fails, stop and tell the user to run from a git repository.
202. If user provides file paths/patterns or a commit/range, scope is exactly those targets.
213. Otherwise, scope is **only** session-modified files. Do not include other uncommitted changes.
224. If there are no session-modified files, fall back to all uncommitted tracked + untracked files:
23 - tracked: `git diff --name-only --diff-filter=ACMR`
24 - untracked: `git ls-files --others --exclude-standard`
25 - combine both lists and de-duplicate.
265. Exclude generated/low-signal files unless requested: lockfiles, minified bundles, build outputs, vendored code.
276. If scope still resolves to zero files, report and stop.
28
29## Workflow
30
311. Resolve scope and read diffs plus minimal surrounding context.
322. Classify files by domain/risk.
333. Load `references/profiles/core.md` plus only the domain profiles that match the current diff.
344. Generate findings with: location, impact, evidence, confidence, and concrete fix.
355. Assign severity with the model below.
366. Default behavior: report and wait.
377. With `--fix`: apply all suggested fixes in severity order, then run targeted verification.
388. Report using `references/output-schema.md`.
39
40## Profile Dispatch
41
42- `references/profiles/security.md`: auth, external input, secrets, crypto, public network surfaces, unsafe parsing.
43- `references/profiles/configuration.md`: env/config, timeouts, retries, pools, limits, resource tuning, rollout controls.
44- `references/profiles/typescript-react.md`: TypeScript/JavaScript/React/Node files.
45- `references/profiles/python.md`: Python services, scripts, async workloads.
46- `references/profiles/shell.md`: shell scripts, CI command blocks, deployment scripts.
47- `references/profiles/smart-contracts.md`: Solidity/Solana/on-chain protocol code.
48- `references/profiles/data-formats.md`: CSV/JSON/YAML/binary ingestion/export/parsing.
49- `references/profiles/naming.md`: naming/intent clarity (after correctness and security pass).
50
51Load only profiles relevant to touched files. Prefer no more than three domain profiles per pass unless the user requests a deep audit.
52
53## Severity Model
54
55- **CRITICAL**: exploitable security flaw, data loss path, or outage risk on critical paths.
56- **HIGH**: logic defect or performance failure that can break core behavior.
57- **MEDIUM**: maintainability/reliability issue likely to cause near-term defects.
58- **LOW**: localized clarity/style/documentation improvements.
59
60## Evidence Rules
61
62- Never fabricate line numbers.
63- Tie each finding to concrete code evidence.
64- Explain blast radius and failure mode succinctly.
65- Prefer targeted fixes over broad rewrites.
66
67## Verification
68
69Run the narrowest checks that validate touched behavior:
70
71- formatter/lint on touched files,
72- targeted tests for impacted modules,
73- typecheck when relevant.
74
75If checks cannot run, state exactly what was skipped and why.
76
77## Stop Conditions
78
79Stop and ask for direction when:
80
81- fixes require API/contract redesign,
82- behavior intent is too ambiguous to classify severity,
83- required validation tooling is unavailable and risk is high.
majiayu000