code-review

Code Review Skill

Overview

A structured, language-agnostic code review process that identifies bugs, security issues, performance problems, and style violations. Always produces actionable output with severity ratings.

Review Process

Step 1: Read Before Commenting

Read the entire code block before writing any feedback. Understanding the full context prevents false positives and surface-level comments.

Step 2: Identify the Language and Context

Note the language, framework, and apparent purpose. Calibrate expectations accordingly (e.g., prototype vs. production, CLI script vs. library).

Step 3: Check for Correctness

• Logic errors and off-by-one bugs
• Unhandled edge cases (null/None, empty collections, negative numbers)
• Incorrect operator precedence or type coercion
• Missing error handling at I/O boundaries
• Race conditions in concurrent code

Step 4: Check for Security Issues

Scan specifically for:

• Injection: SQL injection, shell injection, SSTI, XSS
• Hardcoded secrets: API keys, passwords, tokens in source
• Insecure deserialization: pickle.loads, eval, exec on user input
• Path traversal: user-controlled file paths without sanitization
• Weak cryptography: MD5/SHA1 for passwords, ECB mode, short keys
• IDOR: direct object references without authorization checks
• SSRF: user-controlled URLs in outbound HTTP requests

Step 5: Check for Performance Issues

• N+1 query patterns (database calls inside loops)
• Unnecessary copying of large data structures
• Missing indexes on frequently-queried fields
• Blocking I/O on async event loops
• Redundant computations that could be cached

Step 6: Check for Maintainability

• Unclear variable or function names
• Functions longer than ~50 lines (flag, don't mandate splitting)
• Missing or incorrect type annotations (for typed languages)
• Magic numbers without named constants
• Dead code or unused imports

Step 7: Write Structured Findings

Use this format for each finding:

[SEVERITY] Category: Title
File: path/to/file.py, Line: N
Issue: One sentence describing the problem.
Impact: What could go wrong.
Fix:
  <corrected code snippet>