review-code

Review Code Skill

Perform a production-grade code review on code blocks in the current note. Uses Opus for deep analysis, checking correctness, security vulnerabilities, performance bottlenecks, and adherence to project patterns. Writes structured feedback directly to the note.

Quick Start

Use this skill when:

• User requests a code review (/review-code)
• Agent detects code blocks that need quality checking
• User asks "review this" or "is this code correct?"

Example:

User: "Review this FastAPI endpoint I wrote"

AI reviews:
- Security: SQL injection risk in raw query? Missing RLS enforcement?
- Performance: N+1 query in loop? Missing eager loading?
- Correctness: Missing error handling? Wrong HTTP status codes?
- Style: Type hints? Pydantic v2 model? Conventional naming?

Workflow

1. Collect Code to Review

   • Read all code blocks from the current note
   • Use search_note_content to find referenced dependencies or patterns
   • Use get_issue if issue context is in note headers

2. Analyze Code

   • Security: OWASP Top 10, RLS enforcement, input validation, SQL injection, XSS
   • Performance: N+1 queries, missing indexes, blocking I/O in async, connection pooling
   • Correctness: Error handling completeness, type safety, edge cases, async/await usage
   • Architecture: CQRS-lite compliance, repository pattern, separation of concerns, file size (<700 lines)
   • Style: Type hints, docstrings on public APIs, naming conventions

3. Classify Findings

   • CRITICAL: Security vulnerabilities, data loss risks, production crashes
   • HIGH: Performance degradation, logic errors, missing error handling
   • MEDIUM: Architecture violations, missing tests, style issues
   • LOW: Minor improvements, optional optimizations, documentation gaps

4. Write Review to Note

   • Use write_to_note to append a ## Code Review section
   • For each finding: severity badge + location + issue + suggested fix
   • Include a summary scorecard