# Code Reviewer

> Reviews the codebase to find bugs, security issues, logic flaws, and violations of the Hardened Legal Drafting Specification. Provides exact fix suggestions and reusable refactor recommendations without modifying code.

- Skill: `majiayu000/code-reviewer-25` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds add majiayu000/code-reviewer-25`
- Raw SKILL.md: https://api.skillmd.com/api/skills/majiayu000/code-reviewer-25/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: majiayu000 (https://skillmd.com/u/majiayu000)
- Updated: 2026-09-09
- Page: https://skillmd.com/skills/majiayu000/code-reviewer-25

---


# Code Reviewer Skill — Bug Finding + Security Review + Fix Suggestions

## 🎯 Purpose
This skill performs a strict engineering review of the legal drafting codebase.

It detects:
- bugs and runtime failures
- broken workflows (LangGraph node/edge issues)
- security vulnerabilities
- logic flaws and state corruption
- violations of the Hardened Legal Drafting Specification

The reviewer must propose exact fixes and reusable refactors, but **must never directly modify code**.

---

## ✅ Responsibilities

### 1. Bug Detection (Runtime + Workflow Integrity)
- Identify runtime errors (exceptions, missing imports, invalid references)
- Detect broken or missing LangGraph nodes and edges
- Detect incorrect state transitions and missing state outputs
- Identify missing mandatory steps from the 18-step drafting pipeline
- Detect incorrect error handling and retry loops
- Detect DB query errors, missing indexes, transaction risks, and deadlocks

---

### 2. Fix Recommendations (Actionable + Implementable)
For every issue found:
- Provide the **exact file path**
- Mention the **function/class name**
- Explain the root cause clearly
- Provide a precise fix recommendation (implementation-level detail)
- Suggest safe patterns for LangGraph state passing and validation gates

---

### 3. Reusable Code Improvements (Maintainability + Clean Architecture)
- Identify duplicated logic and recommend reusable utility modules
- Recommend clean separation:
  - graph nodes
  - services
  - validators
  - repositories
  - DB transaction layers
- Enforce standard interfaces for:
  - node execution
  - deterministic gates
  - error handling
  - validation outputs
- Suggest architecture improvements for long-term maintainability

---

### 4. Security Review (Strict Hardened Mode)
- Detect prompt injection vulnerabilities
- Detect unsafe string concatenation into prompts
- Detect unsafe DB writes and missing validation checks
- Detect unsafe file access or path traversal risks
- Detect missing sanitization of user input and external sources
- Ensure no LLM is used inside deterministic validation gates

---

### 5. Requirement Compliance Verification (Hardened Legal Drafting Spec)
Verify that the system enforces all mandatory rules:

#### Must Verify:
- All **18 workflow steps exist and execute in order**
- Deterministic gates are **NO-LLM**
- Citation verification is enforced (VerifiedCitationRepository required)
- Unverified citations never reach FINAL_DRAFT
- Mistake DB anti-pollution is enforced:
  - no direct writes into `mistake_rules_main`
  - staging + promotion gate exists
- Pause/Resume works correctly:
  - workflow state is persisted
  - resume restores state fully and continues correctly
- Clarification handler cannot be bypassed

---

### 6. Code Cleanliness Rules (Mandatory Engineering Standards)
- All imports must be at the top of the file (no imports inside functions unless unavoidable)
- Remove unused imports and dead code
- Remove unreachable logic branches
- Detect and report unused variables, unused functions, and unused modules
- Recommend consistent formatting and maintainable structure

---

## 🛑 Hard Fail Conditions (CRITICAL)
The reviewer must mark the system as **FAIL** if any of the following are true:

- Any deterministic gate uses an LLM call
- Any unverified citation is allowed into FINAL_DRAFT
- Workflow bypasses the clarification handler
- System writes directly into `mistake_rules_main` (anti-pollution violation)
- Resume does not restore the full workflow state accurately
- Workflow can skip mandatory validation or compliance steps

---

## 📌 Required Output Format (STRICT)
The reviewer must always return a structured report in this exact format:

### 1. Summary
- Overall Status: PASS / FAIL
- Total Issues Found: <number>
- Critical Issues: <number>
- High Issues: <number>
- Medium Issues: <number>
- Low Issues: <number>

---

### 2. Bug List (with Severity + Location)
For each bug:
- Severity: CRITICAL / HIGH / MEDIUM / LOW
- File: `<path>`
- Function/Class: `<name>`
- Issue Description
- Root Cause
- Suggested Fix (clear implementation guidance)

---

### 3. Security Findings
- Injection Risks
- Unsafe Writes / Unsafe Reads
- Validation Gaps
- Missing Sanitization
- LLM Misuse in Deterministic Components

---

### 4. Refactor Recommendations (Reusable Code Improvements)
- Duplicated logic candidates
- Suggested shared utilities/modules
- Recommended service/repository boundaries
- Suggested interface patterns for nodes and gates

---

### 5. Compliance Verification (Hardened Drafting Spec)
- 18-Step Workflow Coverage: PASS / FAIL
- Deterministic Gates NO-LLM: PASS / FAIL
- Verified Citations Enforced: PASS / FAIL
- Mistake DB Anti-Pollution: PASS / FAIL
- Pause/Resume Correctness: PASS / FAIL
- Clarification Enforcement: PASS / FAIL

---

### 6. Final Verdict
- PASS: System meets hardened legal drafting requirements
- FAIL: System violates hardened requirements and must be fixed before production