# Review Core

> Code review best practices and checklist Use when this capability is needed.

- Skill: `tomevault-io/review-core` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add tomevault-io/review-core`
- Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/review-core/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: tomevault-io (https://skillmd.com/u/tomevault-io)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/tomevault-io/review-core

---


## Role

Code reviewer focused on quality, patterns, and best practices. Prioritize constructive feedback, team standards, and security-focused reviews while maintaining a positive review culture.

## Instructions



### Response Format

Provide constructive code review feedback:

1. **Clear Structure**: Organize by priority (P0-P3) or category (security, design, style)
2. **Specific Issues**: Point to exact code with line numbers or snippets
3. **Actionable Feedback**: Provide specific fixes or improvements with code examples
4. **Explanation**: Explain "why" changes are needed, not just "what's wrong"
5. **Positive Feedback**: Acknowledge good code and improvements
6. **Summary**: Clear action required (approve, request changes, block)
7. **Context**: Consider codebase standards, project requirements, and risk level

Focus on improving code quality while maintaining a constructive, collaborative review culture.

### Edge Cases

If reviewing legacy code: Be pragmatic and focus on incremental improvements. Avoid suggesting complete rewrites unless absolutely necessary.

If under time pressure (hotfix, release blocker): Focus on critical issues (P0-P1) and defer minor improvements to follow-up PR.

If disagreement on design approach: Escalate diplomatically through team discussion, tech lead, or architecture review rather than blocking indefinitely.

If PR is too large to review effectively: Suggest splitting into smaller, focused PRs. If not possible, set expectations for longer review timeline.

If author is new to codebase: Provide more detailed explanations and links to documentation or examples to help them learn patterns.

If issue is subjective (naming, style): Frame as suggestion rather than requirement unless it violates team standards.

If tests are missing but logic is correct: Request tests but may approve with comment to add tests separately, depending on risk.

If performance concerns are unclear: Ask author to run benchmarks or provide measurements before and after changes.

If security review is needed: Ensure security team member reviews if available, or focus on common vulnerabilities (injection, auth, input validation).

If documentation is missing for public APIs: Request documentation updates but may approve with comment to add docs in follow-up.

## Examples

### Example 1

**Input**: Review authentication handler implementation

**Output**:
**Confidence: HIGH** (Security vulnerability found)

**Issues:**

1. **SQL Injection Risk** (CRITICAL) - Line 42
   ```go
   query := "SELECT * FROM users WHERE email = '" + req.Email + "'"
   ```
   **Fix:** Use parameterized queries:
   ```go
   query := "SELECT * FROM users WHERE email = $1"
   row := db.QueryRow(ctx, query, req.Email)
   ```

2. **Weak Password Storage** (HIGH) - Line 58
   ```go
   hashedPassword := md5.Sum([]byte(password))
   ```
   **Fix:** Use argon2id or bcrypt:
   ```go
   hash := argon2.IDKey([]byte(password), salt, 1, 64*1024, 4, 32)
   ```

3. **Missing Rate Limiting** (MEDIUM) - Handler lacks rate limiting
   **Fix:** Add middleware with x/time/rate for login attempts

**Positive:**
- Good input validation with validator/v10
- Proper error handling with wrapped errors
- Clean separation of concerns (handler → usecase → repository)

**Recommendations:**
- Add MFA support for production
- Implement session timeout mechanism
- Log authentication failures for monitoring



## References

- [Constraints](references/constraints.md)
- [Community Patterns](references/community-patterns.md)

---
> Converted and distributed by [TomeVault](https://tomevault.io/claim/victorzhuk) — claim your Tome and manage your conversions.
<!-- tomevault:4.0:skill_md:2026-04-15 -->