python-review

Python Code Review

This command invokes the python-reviewer agent for comprehensive Python-specific code review.

What This Command Does

1. Identify Python Changes: Find modified .py files via git diff
2. Run Static Analysis: Execute ruff, mypy, pylint, black --check
3. Security Scan: Check for SQL injection, command injection, unsafe deserialization
4. Type Safety Review: Analyze type hints and mypy errors
5. Pythonic Code Check: Verify code follows PEP 8 and Python best practices
6. Generate Report: Categorize issues by severity

When to Use

Use /python-review when:

• After writing or modifying Python code
• Before committing Python changes
• Reviewing pull requests with Python code
• Onboarding to a new Python codebase
• Learning Pythonic patterns and idioms

Review Categories

CRITICAL (Must Fix)

• SQL/Command injection vulnerabilities
• Unsafe eval/exec usage
• Pickle unsafe deserialization
• Hardcoded credentials
• YAML unsafe load
• Bare except clauses hiding errors

HIGH (Should Fix)

• Missing type hints on public functions
• Mutable default arguments
• Swallowing exceptions silently
• Not using context managers for resources
• C-style looping instead of comprehensions
• Using type() instead of isinstance()
• Race conditions without locks

MEDIUM (Consider)

• PEP 8 formatting violations
• Missing docstrings on public functions
• Print statements instead of logging
• Inefficient string operations
• Magic numbers without named constants
• Not using f-strings for formatting
• Unnecessary list creation

Automated Checks Run

# Type checking
mypy .

# Linting and formatting
ruff check .
black --check .
isort --check-only .

# Security scanning
bandit -r .

# Dependency audit
pip-audit
safety check

# Testing
pytest --cov=app --cov-report=term-missing

Example Usage

User: /python-review

Agent:
# Python Code Review Report

## Files Reviewed
- app/routes/user.py (modified)
- app/services/auth.py (modified)

## Static Analysis Results
✓ ruff: No issues
✓ mypy: No errors
⚠️ black: 2 files need reformatting
✓ bandit: No security issues

## Issues Found

[CRITICAL] SQL Injection vulnerability
File: app/routes/user.py:42
Issue: User input directly interpolated into SQL query
```python
query = f"SELECT * FROM users WHERE id = {user_id}"  # Bad

Fix: Use parameterized query

query = "SELECT * FROM users WHERE id = %s"  # Good
cursor.execute(query, (user_id,))

[HIGH] Mutable default argument File: app/services/auth.py:18 Issue: Mutable default argument causes shared state

def process_items(items=[]):  # Bad
    items.append("new")
    return items

Fix: Use None as default

def process_items(items=None):  # Good
    if items is None:
        items = []
    items.append("new")
    return items

[MEDIUM] Missing type hints File: app/services/auth.py:25 Issue: Public function without type annotations

def get_user(user_id):  # Bad
    return db.find(user_id)

Fix: Add type hints

def get_user(user_id: str) -> Optional[User]:  # Good
    return db.find(user_id)

[MEDIUM] Not using context manager File: app/routes/user.py:55 Issue: File not closed on exception

f = open("config.json")  # Bad
data = f.read()
f.close()

Fix: Use context manager

with open("config.json") as f:  # Good
    data = f.read()

Summary

• CRITICAL: 1
• HIGH: 1
• MEDIUM: 2

Recommendation: ❌ Block merge until CRITICAL issue is fixed

Formatting Required

Run: black app/routes/user.py app/services/auth.py