# Code Review Security

> This skill should be used when the user requests a code review, security audit, or pre-merge inspection of a change. Trigger phrases include "review 代码", "代码审查", "安全审计", "审查这个 PR", "review this PR", "security audit", "code review". It applies a five-axis review framework (correctness, readability, architecture, security, performance) with severity classification and a standardized output template.

- Skill: `whaojie797-design/code-review-security` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds@latest add whaojie797-design/code-review-security`
- Raw SKILL.md: https://api.skillmd.com/api/skills/whaojie797-design/code-review-security/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: whaojie797-design (https://skillmd.com/u/whaojie797-design)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/whaojie797-design/code-review-security

---


# Code Review & Security

## Overview
Perform thorough, opinionated pre-merge reviews and security audits. Apply a
five-axis framework, classify findings by severity, and produce a consistent
report so issues are actionable.

## When to Use
- "review 代码", "代码审查", "审查这个 PR", "review this PR", "安全审计", "security audit", "code review".
- Before merging a feature, bugfix, or refactor.
- When the user wants a focused security pass.

## Five-Axis Framework
1. **Correctness** — Does it do what the spec says? Edge cases, off-by-one, null/empty, concurrency.
2. **Readability** — Can another engineer understand it without explanation? Naming, structure, comments.
3. **Architecture** — Follows existing patterns? Right abstraction level? No leaky boundaries.
4. **Security** — Input validation, authz checks, secrets, injection, XSS, rate limiting, IDOR.
5. **Performance** — N+1 queries, unbounded loops, missing pagination, needless allocations.

## Severity Classification
- **Critical** — data loss, security vulnerability, broken functionality. Must fix before merge.
- **Important** — missing test, wrong abstraction, poor error handling. Should fix before merge.
- **Suggestion** — naming, style, optional optimization. Consider.

## Procedure
1. Read the diff / changed files fully; do not skim.
2. Run each axis against the change; note `file:line — description + recommended fix`.
3. Always note at least one thing done well.
4. Emit the report using `references/review-template.md`.
5. Include a verification story (tests run? build verified? security checked?).

## Bundled Resources
- `references/review-template.md` — copy-paste report skeleton.
- `references/security-checklist.md` — common vulnerability checks (OWASP-aligned).