code-review

Code Review

Invoke Command

/review
Files changed: [list of files]
Lens: [all | engineering | security | performance]   (optional, defaults to all)
Mode: [compact | isolated]   (optional, defaults to compact)

Or when delegated from the lead skill, the file list is passed automatically.

Not sure which skill to use? Start with /start — it classifies intent and routes to the right skill.

---

Review Lenses

A complete review examines code through three lenses. Each has a distinct focus and catches a different class of issue.

Lens	Focus	Where its checklist lives
Engineering (default)	Clean code, SOLID, architecture, readability, maintainability, error handling	Phase 3 checklists in this skill
Security	OWASP Top 10, threat model for sensitive flows, input/auth/crypto/data handling	Security Checklist (OWASP) in reference.md
Performance	Algorithmic complexity, N+1 access, resource usage, scalability under load	Phase 3 "Performance & complexity" criterion

Review modes

Developers choose the review mode based on PR risk and context budget.

Compact mode (default)

Use compact mode for ordinary PRs, small-to-medium diffs, and CI comments where speed and low context usage matter.

• Run one consolidated review over the diff.
• Use CR, SEC, and SNR as source labels for classification, not as separate loaded workflows.
• Keep the prompt and loaded references minimal: core review instructions, relevant stack search/command files, and the output template.
• Do not load deep architecture, security, or contrarian references unless the diff creates a concrete need.

Isolated mode

Use isolated mode for high-risk PRs: security surfaces, auth, PII, audit/compliance, public contracts, data migrations, IaC, concurrency, large cross-layer changes, or changes where the first compact review found serious issues.

• Run focused passes over the same diff with isolated attention:
  • CR - standard review: correctness, maintainability, DRY, SOLID, Clean Code, and tests.
  • SEC - security review: auth, input validation, data exposure, secrets, injection, dependency, and configuration risk.
  • SNR - senior review: architecture boundaries, operational risk, coupling, API contracts, and long-term maintainability.
• Consolidate the pass outputs into one report.
• De-duplicate by issue, not just by exact line. When two passes flag the same issue, keep one finding, use the highest severity, and list all source labels.
• Report line numbers against the current file, not against diff hunk offsets.