Codex Review

Codex Review — Senior Peer Review & Security Audit Skill

The code review and security audit engine of AI Codex. Provides thorough, senior-level critiques focused on correctness, security, concurrency, performance, and maintainability.

Overview

codex-review operates as a rigorous Principal Engineer and Security Reviewer. It analyzes pull requests, git diffs, or existing files for subtle security flaws (OWASP), memory leaks, concurrency races, architectural violations, and anti-patterns. It produces actionable, timestamped review reports in codex-drive/walkthroughs/.

When to Trigger

• User runs /codex-review (e.g., /codex-review review src/auth/, /codex-review security audit on payment module, /codex-review check latest commit diff)
• Before merging pull requests or releasing code to production
• Evaluating third-party dependencies or legacy codebases

Execution Workflow

 ┌────────────────────────────────────────────────────────┐
 │ 1. RETRIEVE CODE DIFF / TARGET FILES                   │
 │    Analyze modified lines, context, and dependencies.  │
 └──────────────────────────┬─────────────────────────────┘
                            │
                            ▼
 ┌────────────────────────────────────────────────────────┐
 │ 2. RUN MULTI-DIMENSIONAL AUDIT                         │
 │    Security, Concurrency, Performance, Standards.      │
 └──────────────────────────┬─────────────────────────────┘
                            │
                            ▼
 ┌────────────────────────────────────────────────────────┐
 │ 3. FORMULATE ACTIONABLE DIFF RECOMMENDATIONS           │
 │    Provide concrete code replacements with rationale.  │
 └──────────────────────────┬─────────────────────────────┘
                            │
                            ▼
 ┌────────────────────────────────────────────────────────┐
 │ 4. WRITE REVIEW REPORT IN CODEX-DRIVE                  │
 │    Write codex-drive/walkthroughs/YYYY-MM-DD-*.review.md│
 └──────────────────────────┬─────────────────────────────┘
                            │
                            ▼
 ┌────────────────────────────────────────────────────────┐
 │ 5. PRESENT CRITIQUE & MERGE RECOMMENDATION             │
 │    APPROVE / REQUEST_CHANGES / BLOCKING_SECURITY_ISSUE │
 └────────────────────────────────────────────────────────┘

Review Walkthrough Specification (codex-drive/walkthroughs/)

All review reports generated by codex-review MUST be Markdown (.md) files with exact date-time metadata.

Filename Format:

codex-drive/walkthroughs/YYYY-MM-DD-<slug>.review.md

Standard Code Review Template:

# [PR / Feature / Module Name] Senior Code Review & Security Audit

> **Created At**: YYYY-MM-DD HH:MM:SS (Local Time)
> **Active Codex Edition**: [`skills/codex/<edition>/`](file:///...)
> **Review Verdict**: [OK] APPROVED | [WARNING] REQUEST_CHANGES |  BLOCKER_SECURITY_ISSUE
> **Files Reviewed**: `src/api/auth.ts`, `src/db/user-repository.ts`

---

## 1. Executive Summary
[High-level evaluation of code quality, architecture adherence, and release readiness]

---

## 2. Findings Summary Matrix

| Severity | Category | File & Line | Brief Description |
| :--- | :--- | :--- | :--- |
|  **CRITICAL** | Security | `auth.ts:L42` | Potential SQL injection in raw query |
| [WARNING] **WARNING** | Concurrency | `session.ts:L88` | Unsynchronized access to shared cache |
|  **NOTE** | Performance | `user-repo.ts:L110` | Missing database index on lookup column |

---

## 3. Detailed Findings & Suggested Diffs

###  [CRITICAL] SQL Injection Hazard in Authentication
- **Location**: `src/api/auth.ts:L42`
- **Issue**: Direct string interpolation into raw database query allows authentication bypass.
- **Remediation**: Use parameterized queries.

```diff
- const query = `SELECT * FROM users WHERE email = '${req.body.email}'`;
+ const query = `SELECT * FROM users WHERE email = $1`;
+ const result = await db.query(query, [req.body.email]);

[WARNING] [WARNING] Data Race on In-Memory Token Cache

• Location: src/services/session.ts:L88
• Issue: Concurrent coroutines/threads mutate dictionary without synchronization.
• Remediation: Use a thread-safe dictionary, mutex, or actor isolation.

4. Code Standards & Architecture Compliance

• Type Safety: No untyped any or blind force unwraps (!).
• Error Handling: Custom typed error hierarchy used consistently.
• Test Coverage: PR includes comprehensive unit and integration tests.

5. Final Recommendation

• Block merge until Critical security item is resolved.
• Address Warning before deployment to production.

---

## Response Protocol

When `codex-review` finishes:
1. Provide a direct link to `[View Code Review Report](file:///.../codex-drive/walkthroughs/YYYY-MM-DD-<slug>.review.md)`.
2. Clearly state the **Review Verdict** (Approved / Request Changes / Blocker).
3. List the top actionable fixes that need to be made immediately.