TomazWang Code Review Skill
When to Use
Use this skill when the user wants to:
- Review code changes before committing
- Analyze pull requests for quality issues
- Get security, performance, or architecture feedback
- Comprehensive multi-agent code analysis
- User invokes
/code-review:reviewor asks for code review
Overview
Orchestrate a comprehensive code review using specialized agents that analyze different aspects of the code in parallel.
Command Parsing
Parse the user's arguments:
- files: Optional file patterns to review (default: all changed files)
- --focus: Comma-separated list of focus areas (architecture, security, testing, performance, style)
- --quick: Single-agent general review instead of parallel specialized reviews
- --pr : Review a specific pull request
- --commit : Review a specific commit
- --staged: Review only staged changes
- --comment: Post review comments inline (for PRs)
Review Process
1. Determine Scope
If no files specified, detect changes:
# Check for PR context
if --pr flag:
gh pr diff $PR_NUMBER > /tmp/review-diff.patch
files = parse files from diff
# Check for commit
elif --commit flag:
git show $COMMIT_HASH > /tmp/review-diff.patch
files = parse files from diff
# Check for staged changes
elif --staged flag:
git diff --staged --name-only
# Default to branch changes
else:
git diff main...HEAD --name-only
If no changes found: "No changes to review. Current branch matches main."
2. Configure Review
Determine which agents to run:
--quick mode:
- Run single general review (no parallel agents)
- Faster but less thorough
--focus mode:
- Map focus areas to agents:
- architecture → cr-architecture-reviewer
- security → cr-security-reviewer
- testing → cr-test-coverage-reviewer
- performance → cr-performance-reviewer
- style → cr-style-reviewer
Default (full review):
- Run all 5 specialized agents in parallel
3. Launch Review Agents
Parallel execution:
Use Task tool to launch multiple agents simultaneously:
- Task(subagent_type="code-review:cr-architecture-reviewer", ...)
- Task(subagent_type="code-review:cr-security-reviewer", ...)
- Task(subagent_type="code-review:cr-test-coverage-reviewer", ...)
- Task(subagent_type="code-review:cr-performance-reviewer", ...)
- Task(subagent_type="code-review:cr-style-reviewer", ...)
Each agent receives:
- List of files to review
- Diff/patch content
- Project context
- Review configuration
4. Collect Results
Wait for all agents to complete and collect their findings:
Results format:
{
agent: "cr-security-reviewer",
findings: [
{
file: "src/auth/login.ts",
line: 45,
severity: "critical",
category: "sql-injection",
message: "Unsafe SQL query construction",
suggestion: "Use parameterized queries"
},
...
]
}
5. Generate Report
Aggregate findings from all agents:
# Code Review Report
Generated: 2026-02-05 14:30
## Summary
- Files reviewed: 12
- Critical issues: 2
- High priority: 5
- Medium priority: 12
- Low priority: 8
## Critical Issues
### src/auth/login.ts:45 [Security]
**SQL Injection Vulnerability**
Unsafe SQL query construction allows injection attacks.
```typescript
// Current (vulnerable)
const query = `SELECT * FROM users WHERE email = '${email}'`;
// Suggested fix
const query = 'SELECT * FROM users WHERE email = ?';
db.query(query, [email]);
Recommendation: Fix immediately before deploying.
src/payment/process.ts:89 [Security]
Missing Authorization Check Payment processing endpoint doesn't verify user authorization.
// Add authorization check
if (!user.canProcessPayments()) {
throw new UnauthorizedError();
}
Recommendation: Add authorization check and write tests.
High Priority Issues
[List high priority findings...]
Medium Priority Issues
[List medium priority findings...]
Low Priority Issues
[List low priority findings...]
Recommendations
Immediate Actions:
- Fix SQL injection in auth/login.ts
- Add authorization to payment processing
Short Term:
- Increase test coverage (currently 65%, target 80%)
- Optimize N+1 queries in user service
- Add input validation to API endpoints
Long Term:
- Refactor auth module for better separation
- Implement caching strategy
- Update coding style guide
Detailed Reviews
Architecture Review
[Full cr-architecture-reviewer output]
Security Review
[Full cr-security-reviewer output]
Test Coverage Review
[Full cr-test-coverage-reviewer output]
Performance Review
[Full cr-performance-reviewer output]
Style Review
[Full cr-style-reviewer output]
### 6. Save Report
Save report to `docs/reviews/YYYY-MM-DD-<branch-or-pr>.md`
### 7. Create Tasks (Optional)
Ask user: "Would you like me to create tasks for the critical and high priority issues?"
If yes:
```bash
/task create "Fix SQL injection in auth/login.ts" --priority critical
/task create "Add authorization to payment processing" --priority critical
/task create "Increase test coverage to 80%" --priority high
...
8. PR Comments (Optional)
If --comment flag and --pr flag:
gh pr review $PR_NUMBER --comment -b "Review findings..."
Post inline comments at specific lines for critical/high issues.
Output Format
Console output:
🔍 Starting comprehensive code review...
📊 Scope:
- Files: 12 (src/auth/*.ts, src/payment/*.ts, src/api/*.ts)
- Lines changed: ~450
- Branch: feature/payment-flow
🤖 Launching 5 specialized review agents in parallel:
✓ cr-architecture-reviewer
✓ cr-security-reviewer
✓ cr-test-coverage-reviewer
✓ cr-performance-reviewer
✓ cr-style-reviewer
⏳ Review in progress...
✅ Review complete!
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
📋 SUMMARY
Critical: 2 🚨
High: 5 ⚠️
Medium: 12 💡
Low: 8 📝
🚨 CRITICAL ISSUES
1. SQL Injection in src/auth/login.ts:45
→ Use parameterized queries
2. Missing authorization in src/payment/process.ts:89
→ Add user.canProcessPayments() check
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
📄 Full report saved to: docs/reviews/2026-02-05-feature-payment-flow.md
Would you like me to create tasks for the critical and high priority issues?
Error Handling
- No git repository: "Not in a git repository. Please run from project root."
- No changes found: "No changes to review. Current branch matches main."
- Agent failures: Continue with other agents, note failures in report
- Invalid focus area: "Invalid focus area: . Valid options: architecture, security, testing, performance, style"
Configuration
Read from .claude/code-review.local.md:
---
default_agents: [security, testing]
min_severity: medium
auto_create_tasks: true
exclude_patterns:
- "**/*.test.ts"
- "**/migrations/*"
---
Implementation Notes
- Use Task tool for parallel agent execution
- Parse diffs to provide context to agents
- Aggregate findings by severity
- Generate actionable recommendations
- Integrate with task management
- Support PR/commit review modes