# Cheneeheng Agent Skills Code Review > Code Review - Skill: `tomevault-io/cheneeheng-agent-skills-code-review` (Agent Skill, multi-file: 2 files) - Install (CLI): `npx skillmds@latest add tomevault-io/cheneeheng-agent-skills-code-review` - Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/cheneeheng-agent-skills-code-review/raw - Safety review: pending (external: skill-scanner PASS, skillspector PASS) - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: AI & ML - Author: tomevault-io (https://skillmd.com/u/tomevault-io) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/tomevault-io/cheneeheng-agent-skills-code-review --- # Code Review Every comment must be clearly marked as **blocking** or **advisory**. | Prefix | Meaning | Author must | |--------|---------|-------------| | `[blocking]` | Must be resolved before merge | Fix or discuss with reviewer | | `[advisory]` | Suggestion, optional improvement | Address or explicitly acknowledge | | `[question]` | Seeking understanding, not a change request | Answer the question | Examples: ``` [blocking] This query is not parameterized — SQL injection risk on line 47. [advisory] This helper could be extracted to a utility function for reuse. [question] Why is this retry limit set to 3? ``` ## Review Focus (Priority Order) 1. **Correctness** — does it do what it claims? Are edge cases handled? 2. **Security** — injection risks, secrets exposure, input validation gaps 3. **Test coverage** — is new behavior tested? Are tests testing behavior? 4. **Design** — right abstraction? Fits existing patterns? 5. **Style** — only flag if linting tools don't catch it Do not comment on style a linter would catch. Do not re-litigate decisions in `docs/adr/DECISIONS.md` unless new risk is identified. Do not review from memory — verify against current file contents. --- > Source: [cheneeheng/agent-skills](https://github.com/cheneeheng/agent-skills) — distributed by [TomeVault](https://tomevault.io).