# Codex Review

> Conducts senior-level peer code reviews, security vulnerability audits, concurrency and memory safety inspections, and architectural compliance checks. Generates timestamped code review walkthroughs in codex-drive/walkthroughs/.

- Skill: `wwwroot/codex-review` (Agent Skill)
- Install (CLI): `npx skillmds@latest add wwwroot/codex-review`
- Raw SKILL.md: https://api.skillmd.com/api/skills/wwwroot/codex-review/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: wwwroot (https://skillmd.com/u/wwwroot)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/wwwroot/codex-review

---


# Codex Review — Senior Peer Review & Security Audit Skill

> The code review and security audit engine of AI Codex. Provides thorough, senior-level critiques focused on correctness, security, concurrency, performance, and maintainability.

---

## Overview

`codex-review` operates as a rigorous Principal Engineer and Security Reviewer. It analyzes pull requests, git diffs, or existing files for subtle security flaws (OWASP), memory leaks, concurrency races, architectural violations, and anti-patterns. It produces actionable, timestamped review reports in `codex-drive/walkthroughs/`.

---

## When to Trigger

- User runs `/codex-review` (e.g., `/codex-review review src/auth/`, `/codex-review security audit on payment module`, `/codex-review check latest commit diff`)
- Before merging pull requests or releasing code to production
- Evaluating third-party dependencies or legacy codebases

---

## Execution Workflow

```
 ┌────────────────────────────────────────────────────────┐
 │ 1. RETRIEVE CODE DIFF / TARGET FILES                   │
 │    Analyze modified lines, context, and dependencies.  │
 └──────────────────────────┬─────────────────────────────┘
                            │
                            ▼
 ┌────────────────────────────────────────────────────────┐
 │ 2. RUN MULTI-DIMENSIONAL AUDIT                         │
 │    Security, Concurrency, Performance, Standards.      │
 └──────────────────────────┬─────────────────────────────┘
                            │
                            ▼
 ┌────────────────────────────────────────────────────────┐
 │ 3. FORMULATE ACTIONABLE DIFF RECOMMENDATIONS           │
 │    Provide concrete code replacements with rationale.  │
 └──────────────────────────┬─────────────────────────────┘
                            │
                            ▼
 ┌────────────────────────────────────────────────────────┐
 │ 4. WRITE REVIEW REPORT IN CODEX-DRIVE                  │
 │    Write codex-drive/walkthroughs/YYYY-MM-DD-*.review.md│
 └──────────────────────────┬─────────────────────────────┘
                            │
                            ▼
 ┌────────────────────────────────────────────────────────┐
 │ 5. PRESENT CRITIQUE & MERGE RECOMMENDATION             │
 │    APPROVE / REQUEST_CHANGES / BLOCKING_SECURITY_ISSUE │
 └────────────────────────────────────────────────────────┘
```

---

## Review Walkthrough Specification (`codex-drive/walkthroughs/`)

All review reports generated by `codex-review` MUST be Markdown (`.md`) files with exact date-time metadata.

### Filename Format:
`codex-drive/walkthroughs/YYYY-MM-DD-<slug>.review.md`

### Standard Code Review Template:

```markdown
# [PR / Feature / Module Name] Senior Code Review & Security Audit

> **Created At**: YYYY-MM-DD HH:MM:SS (Local Time)
> **Active Codex Edition**: [`skills/codex/<edition>/`](file:///...)
> **Review Verdict**: [OK] APPROVED | [WARNING] REQUEST_CHANGES |  BLOCKER_SECURITY_ISSUE
> **Files Reviewed**: `src/api/auth.ts`, `src/db/user-repository.ts`

---

## 1. Executive Summary
[High-level evaluation of code quality, architecture adherence, and release readiness]

---

## 2. Findings Summary Matrix

| Severity | Category | File & Line | Brief Description |
| :--- | :--- | :--- | :--- |
|  **CRITICAL** | Security | `auth.ts:L42` | Potential SQL injection in raw query |
| [WARNING] **WARNING** | Concurrency | `session.ts:L88` | Unsynchronized access to shared cache |
|  **NOTE** | Performance | `user-repo.ts:L110` | Missing database index on lookup column |

---

## 3. Detailed Findings & Suggested Diffs

###  [CRITICAL] SQL Injection Hazard in Authentication
- **Location**: `src/api/auth.ts:L42`
- **Issue**: Direct string interpolation into raw database query allows authentication bypass.
- **Remediation**: Use parameterized queries.

```diff
- const query = `SELECT * FROM users WHERE email = '${req.body.email}'`;
+ const query = `SELECT * FROM users WHERE email = $1`;
+ const result = await db.query(query, [req.body.email]);
```

---

### [WARNING] [WARNING] Data Race on In-Memory Token Cache
- **Location**: `src/services/session.ts:L88`
- **Issue**: Concurrent coroutines/threads mutate dictionary without synchronization.
- **Remediation**: Use a thread-safe dictionary, mutex, or actor isolation.

---

## 4. Code Standards & Architecture Compliance
- **Type Safety**: No untyped `any` or blind force unwraps (`!`).
- **Error Handling**: Custom typed error hierarchy used consistently.
- **Test Coverage**: PR includes comprehensive unit and integration tests.

## 5. Final Recommendation
- [ ] Block merge until Critical security item is resolved.
- [ ] Address Warning before deployment to production.
```

---

## Response Protocol

When `codex-review` finishes:
1. Provide a direct link to `[View Code Review Report](file:///.../codex-drive/walkthroughs/YYYY-MM-DD-<slug>.review.md)`.
2. Clearly state the **Review Verdict** (Approved / Request Changes / Blocker).
3. List the top actionable fixes that need to be made immediately.